Role of Appliances?

Do appliances have a role in your integration strategy? If so, for what purpose? Will appliances displace ESB’s as integration hubs? If so, why?

We use datapower in the DMZ to handle the WS-Security functionality. Authenticated requests then get forwarded through the firewall to our SOA servers. The datapower device has XSL capability also but we don't use it. Since we don't have direct development access to the datapower device, we're still using SOA Suite ESB. But I would highly recommend using BPEL to route instead of ESB if you're starting from scratch. The 10.1.3.3 version of ESB that isn't Aqualogic based has alot of things that I don't like. One of the main flaws is that it can't handle multipart wsdl. Also, deploying it can be a real nuisance. Deploying a thin BPEL project that handles the routing and transformations is much easier. And best of all, BPEL can handle multipart wsdl via the Pick component.

Similar Messages

  • ¿How to use user-roles in Ironport WSA (7.6) using ACS 4.1?

    Hello,
    I want to give a client access to a S370 WSA quarantine and I am using an ACS 4.1 for external authentication; that would be used for administrators and for the client access (non-administration access).
    I have created a user-role in the WSA that has access to the quarantine I want, but I need the user to be in the ACS. I created the user in ACS but my question is, what should I configure or change in the ACS in order for the WSA to recognize the user with the specific role I created and not like an administrator role.
    Thanks for your help!
    Sergio

    Hi,
    This can be done by configuring the Radius Class attribute on the ACS and mapping it with the user roles on the WSA.
    "To map RADIUS users to different Web Security appliance user role types, you assign a role type, such
    as Administrator and Operator, to a RADIUS CLASS attribute. Mapping different role types lets you
    specify the authorization level for each RADIUS user."
    Please go to Page 26-12 of the WSA user guide http://www.cisco.com/c/dam/en/us/td/docs/security/wsa/wsa7-5/user_guide/WSA_7-5-0_UserGuide.pdf for more information under the section "Using External Authentication".
    Regards,
    Kush

  • NAC 4.7.1 L3 OOB - Temporary Role bugs ?

    Hi
    We have a L3 OOB routed gateway configuration (with redundant CAS and CAM), We are currently running 4.7.1 on the appliances and the agent is 4.7.10.
    We have experienced two problems:
    1. On several occasions we can abort a valid logon, but can still be allowed access to the network 'silently' ;
    a - without any indication on the CAM i.e. no online users, no certified devices
    b - the switch is still in the 'unauthenticated vlan' and the
    c - ip address of the client is on the 'untrusted' subnet.
    d - the 'unauthenticated' policy DOES NOT ALLOW web traffic.
    It would seem that the user is able to trick the system by aborting the logon with the agent i.e. closing the window etc, (the login credentials are
    correct and posture fails on an optional check and so amber) but the system DOES NOT show the user at all.
    The Temporary role does allow full access, if I disable the policy rule the traffic is stopped.
    The problem is there is no indication of this user on the system at all, this happens a couple of times a week.
    2. When a user is genuinely placed into a TEMPORARY role (as indicated by the system, note: not the same as above),
    about 50% of the time communication is blocked even though the policy allows it (repeated challenges by NAC).
    Close the agent and do it the second time and it will work.
    I think the symptoms are related as they both seem to be related to the usage of the TEMPORARY ROLE - has anyone else seen this bug ?

    Hi,
    You said not to configure a quarantine vlan, but by the time the users get connected how is gonna be the process for authentication (quarantine) and access vlan??? I mean how is it going to perform the nac process and how to control what happens if it fails (not in compliance) or if it suceed??
    It seems that the version 4.9(1) has the integration, but is not so clear:
    http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/49/cam/m_woob.html#wp1139585
    What versions were you running in your deployment.

  • Cisco ACS 4.2 authenticating Cisco 4710 ACE appliance failed

    Hi,
    I've got a problem with Cisco ACS 4.2 authenticating Cisco 4710 ACE appliance.
    ACS4.2 has been configured to use both internal and external database. It's been working fine for a couple or years.
    Recently we bought a Cisco 4710 ACE appliance. When I use ACS4.2 internal username and password to login the Cisco 4710 ACE appliance, I have no problem. I can also see the passed authentication log on ACS4.2. However, if I use AD username and password, I couldn't login in. The message is "Login incorrect". I checked the failed attempts log on the ACS4.2, there was no log regarding the failed attempt. My AD username and password works fine on all other cisco routers and switches.
    I've posted my AAA configuration of the 4710 ACE below. ACE is running on the latest version A4(1.1). Please help.
    tacacs-server key 7 "xxxxxxxxxxxxx"
    aaa group server tacacs+ tac_admin
      server xx.xx.xx.xx
    aaa authentication login default group tac_admin local
    aaa authentication login console group tac_admin local
    aaa accounting default group tac_admin

    Hi,
    Since the ACS is receiving the request.
    Could you please ensure that In ACE on every context (including Admin and other) you have  following strings:
    tacacs-server host x.x.x.x key 7 "xxx"
    aaa group server tacacs+  tac_admin
       server x.x.x.x
    aaa authentication login default group  tac_admin local
    aaa authentication login console group  tac_admin local 
    aaa accounting default group x.x.x.x
    On ACS side for group named "Network  Administrators" you should configure in TACACS settting:
    1. Shell  (exec) enable
    2. Privilege level 15
    3. Custom attributes:
               shell:Admin*Admin default-domain
        if you have additional  context add next line
              shell:mycontext*Admin  default-domain
    After  loging to ACE and issuing sh users command you should see following
    User             Context                                                                  Line     Login Time   (Location)        Role   Domain(s)   
    *adm-x        Admin                                                                    pts/0   Sep 21 12:24  (x.x.x.x)    Admin   default-domain
    Hope this helps.
    Regards,
    Anisha
    P.S.: please mark this thread as answered if you fee your query is resolved. Do rate helpful posts.

  • Integrate NAC Appliance with Active Directory

    We try to implement on our customer, NAC appliance integrating with Active Directory Single sign on.
    The NAC configured with L2 OOB. User first connect to switch and got the authentice Vlan, then the user will be authenticate using their domain account login, if success the user will be mapping to the Vlan assign to them.
    The agent SSO installed on Active Directory is running well, and at the CAS also the service SSO started.
    Let say i've this situation:
    1. User A has been assign to Vlan 15 Employee
    2. User A plug to switch and got dummy vlan and will authenticate using Domain account on AD, If succeded than, the port will be bounce, the user running an cisco agent on background
    3. Now user A has their on Vlan ID 15
    I've created the Authentication server on CAM for the Active Directory, but i've find it's so difficult to config mapping rules between user roles to Active directory. The guidance pdf how to implement NAC i've downloaded from cisco, not mention it how to mapping user roles to Active Directory...
    Has any one has been configured mapping rules user roles to Active directory?

    So you would create a mapping rule against your lookup server like so.
    Say the AD group membership is "Finance"
    for ADSSO you would apply the mapping rule to your LOOKUP Server
    where the expression is
    memberOf contains CN=Finance and apply it to role employee if VLAN 15 is your employee vlan then you would designate vlan 15 in your Employee role under user role configuration
    Now you cant test this with ADSSO with the test auth function so what I like to do is create an AD authentication server and test against that as long as you have some form of mapping configured the auth results will return all memberships for the userename you login with so you can get the syntax exactly right.

  • Location Appliance not detecting elements after upgrade

    Hi
    Our loacation appliance had version 2.1.42.0. After upgrading it to version 3.1.36 there are no clients been discovered.
    I must admit we don't have read-write access to the WLAN Controller 4400, and read somehwere that ntp plays a big role from AppLoc ver 3.0 upwards in this. The WCS , Location Appliance and the WLC is syncing to the same NTP server.
    Some errors I have noticed:
    5/15/08 00:12:38 ERROR[locp] [13] Error in ConnectHandler(endPoint) <LocpSessionTarget mode=CLIENT><LocpEndPoint status=HANDSHAKE t
    otalBytesSent=19740 totalBytesReceived=16730><LocpEndPoint.Key host=10.1.30.10 port=16113/></LocpEndPoint></LocpSessionTarget>
    5/15/08 00:12:38 TRACE[com.aes] [13] [ConnectHandler:handle-09] THROW
    javax.net.ssl.SSLException: Received fatal alert: certificate_unknown at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLEngineImpl.fatal(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLEngineImpl.fatal(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLEngineImpl.recvAlert(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLEngineImpl.readRecord(Unknown Source) at om.sun.net.ssl.internal.ssl.SSLEngineImpl.readNetRecord(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLEngineImpl.unwrap(Unknown Source) at javax.net.ssl.SSLEngine.unwrap(Unknown Source) at com.aes.server.locp.transport.IOChannelSecure.doHandshake(Unknown Source) at com.aes.server.locp.transport.LocpTransportService$ConnectHandler.handle(Unknown Source) at com.aes.server.locp.transport.ChannelEventDispatcherImpl$HandlerTask.run(Unknown Source)
    The WCS is Version 5.0.56.2 , Type: Base + Location; Licensed APs: 1000.
    I have reverted back to the old version and its working fine now. And we have only a few hours of change control to get this upgrade right.
    Any ideas? Much appreciated.

    Have you verified that the times are all correct on the devices?
    I had an AP issue with time+certificates and even though all my controllers were set to sync to the same ntp server, the times were off. I manually set the times and that fixed it.

  • NAC Appliance design question

    I have a customer with a central site and two branch office. Routing is configured on the WAN to connect all three locations. All servers and internet access are on the central site.
    Customer wants to install NAC appliance. Do I need a NAC apliance at each location? Or do I just install it at the central location and use that NAC appliance for access control to the two remote sites as well.
    Also how does NAC appliance apply access control to users coming into the network via Citrix or Cisco VPN Clients?
    Thanks

    NAC Appliance (CAM & CAS = Clean Access Manager/Server) can be used in a Layer 3 Out Of Band design. This will provide you with centralized control.
    It works by placing all unauthenticated switch ports into a unathentication VLAN. When a switch port goes up/up, the NAC CAS follows a set of rules you have established on the CAM to make decisions about the computer and user. It then will place that switch port into a VLAN 'dynamically' as dictated by the rules. Your switches must support these features (IOS level) and only Cisco products work with the CAM/CAS (well some others might, but it's a short list). When the port goes down/down the CAS senses this and returns the port to the unauthenticated VLAN.
    For instance, if a user is a vendor, only requiring Internet access, you will have a VLAN for this purpose on all your switches and routed/trunked to your Internet Point of Presence. The CAS will see the switch port he/she jacks into come up/up. It will query the user and the computer and based upon the rules in the CAM, dynamically assign the wire port to the VLAN from the go-no-where unauthenticated VLAN.
    If it were a company user, you could set it to check Anti-virus, levels of service packs, etc. before they were allowed on the network. It could also be set up to allow the person access to only the 'Finance' VLAN (for example) based upon their role in the company. It can do this remotely.
    If you were to remediate VPN users, you could not do this in a dynamic, Out of Band fashion. You would need a second CAS (but not CAM) to operate In Band. This would then allow users in one Interface, traverse the CAS on out another interface on the appropriate VLAN. This is because it's impossible to apply multiple rules to a single port shared by multiple users. You would need a means to make decision on what VLAN the users accesses at the concentrator and move them off dynamically at the virtual interface. It's not supported.
    Remember, NAC is performed at the switch port level. Citrix users would be regarded as local users. You could perform certain rule checking to allow them only onto your Citrix VLAN.
    There is a Cisco Chalk Talk series on the NAC, use the URL below. It will teach you as much as you can absorb on the NAC appliances, how to use them and recommend their purchase to your clients.
    http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5707/ps8418/ps6128/prod_presentation0900aecd80549168.html

  • Cisco NAC - How know why a machine is in Temporary Role?

    Hello,
    In our environment, workstatios that do not conform with the requirements remain under Temporary Role until the remediation is done.
    In Event Logs I see that the Workstation is just under Temporary Role, but do not know why it is in Temporary Role.
    How can I see this information?
    Ex:
    Authentication
    2011-01-21 11:12:26
    [00:21:9B:37:00:F0 ## x.x.x.x] user@domain - Successfully logged in temporary role, Provider: ADSSO, L2 MAC address: 00:21:9B:37:00:F0, Role: Temporary Role, OS: Windows XP Pro/Home
    Tanks
    Daniel Stefani

    Hi Daniel,
    you can check the info about this user/machine on the NAC agent reports:
    http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/48/cam/m_report.html#wp1481407
    There you get details about what checks failed on the client during the posture assessment phase.
    I hope this helps.
    Regards,
    Federico
    If this answers your question please mark the question as "answered" and rate it, so other users can easily find it.

  • NAC Appliance and LDAP Lookup

    Hello,
    I have two CAM in HA and two CAS in HA.
    I configure the LDAP Lookup for create rule to role allocation.
    In this configuration are only one windows server to make find the user properties.
    There are one problem when this Windows servers is down. There are any configuration to mitigation when the server is not there.
    Thank you all.

    The LDAP lookup server configs state it uses the LDAP Authentication Provider. The LDAP Authentication Provider says you can have multiple entries in the single field
    LDAP
    http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/413/cam/m_auth.html#wp1158614
    You can add redundancy for LDAP Authentication servers by entering multiple LDAP URLs in the Server URL field separated by a space, for example:
    ldap://ldap1.abc.com ldap://ldap2.abc.com ldap://ldap3.abc.com

  • WAVE 294 roles

    hi
    the question is simply...
    can i implement a WAAS accelerator and Central Manager roles on a WAVE 294 appliance at same time, or do i need one appliance for each role?.
    thanks!

    Hi Julio,
    Accelerator and Central manager roles are mutually exclusive, you can never implement both at the same time in one single device (regardless of the model)
    Regards
    Daniel

  • Assign roles to SSO integrated users

    Hello everyone,
    I'm trying to assign roles to SSO users but I can't. I achieved it with local and LDAP users, but not for SSO users (I want to use my AD users but without LDAP config)
    My platform is vCenter 5.5 U1 for SSO, vCAC appliance + IaaS server, and vCAD appliance. When you register your vCAD with vCAC you can use SSO integrated authentication of vCAC. But, how can I assign roles to SSO users?
    I can access to vCAD with AD users through SSO integrated authentication but all options are read-only.
    Best regards,
    Jose Luis Gomez

    Hello everyone,
    Auto-response.
    When you've registered your vCAD with vCAC, new roles appears in vCAC. This roles are:
    Application Architect
    Application Catalog Administrator
    Application Cloud Administrator
    Application Publisher And Deployer
    Application System Administrator
    You can apply this roles to users or groups but always from vCAC --> Administration --> Groups/Users
    Best regards,
    Jose Luis Gomez

  • Cisco NAC Appliance SSO AD by OU (Organization Unit) is posible?

    Hello, I have a question. it is posible implement NAC Appliance SSO AD VG/Real IP - L2/L3 for OU (Organization Unit), for example; if i have OU sales and OU market in the windows domain X. it is posible restrict the police and assign diferent network (10.1.1.0/24 for OU sales and 10.1.2.0/24 for OU market).
    Regards
    Alvaro

    Yes that is possible, first you will create a user role for the two seperate OU, then you assign a user role vlan to each role. then you will have to create a ldap lookup server. You will then create a attribute condition which will map users that are a memberOf xxx to user role yyy.
    this is for out of band scearios because the clients at first will get the same authenticaiton ip address but after the port is switched over then the ip address they get after will be based off the vlans they land on.
    let me know if you need anything else.
    Tarik

  • User Role empty - Cannot connect to DB2

    Hello,
    I'm having trouble with a WLSE 2.13 that we have installed. It doesn't let us access via web to the software; the error that appears when trying to do so is "User role is empty". There also appears a moving banner saying "Database failed to respond correctly" after trying to authenticate the user.
    however, when trying t oaccess through SSH, it works OK.
    This is what I get with a diag all command:
    <<< Executing ALL Diagnostics (except SmartMonTools) >>>
    DIAG: IMAGE -- [Mon Oct 9 08:27:07 UTC 2006]
    (please wait) ... DONE.
    *** PASS: Software image verification passed. ***
    DIAG: BIOS -- [Mon Oct 9 08:28:03 UTC 2006]
    *** Drive model ST340014A, FwRev does not require BIOS patch. ***
    DIAG: DMA -- [Mon Oct 9 08:28:03 UTC 2006]
    Checking disk for DMA errors (please wait) ...
    *** PASS: NO DMA IO errors found. ***
    Checking disk sectors for errors (please wait) ...
    *** PASS: NO disk sector errors found. ***
    DIAG: DB2CLEAN -- [Mon Oct 9 08:32:48 UTC 2006]
    *** PASS: No dump files found. ***
    DIAG: DB2VERIFY -- [Mon Oct 9 08:32:48 UTC 2006]
    *** FAIL: Cannot connect to DB2. Integrity verification failed. ***
    DIAG: SERIALNO -- [Mon Oct 9 08:32:49 UTC 2006]
    *** No Serial Number obtained for this appliance. ***
    So it looks like the DB is corrupt for some reason. We have executed the initdb but no change in the error has been detected.
    This is the result of the show version command:
    (C) Copyright 2006 by Cisco Systems Inc.
    WLSE 1130 Release 2.13.1FCS Mon Aug 14 12:16:20 UTC 2006
    (build number 54)
    Device Limit = 2550
    Build Version (79) Fri Jan 6 23:20:15 UTC 2006
    Uptime: 0 days 0 hours 34 mins
    Linux version 2.4.32-8_WLSEsmp ([email protected]) (gcc version 2.96 20000731 (Red Hat Linux 7.3 2.96-113
    )) #1 SMP Wed Jan 25 13:16:55 PST 2006
    I do think that there may be a sector in the hard drive that is not working (you can see why in the bootlog.txt file that I'm also attaching), but it looks a bit strange that it has only affected the access through the web...
    Any ideas?

    Hi Fernando,
    This might be related to few things:
    - file anisnmp.conf corrupted preventing TomCat to start properly (# reset device-snmp would fix it)
    - database corrupted and not accessible at all
    (... reiniting the db might be the only solution)
    - user roles corrupted
    (would need to delete the user roles to reconstruct them)
    Opening a shell and hit "#show tomcatlog" would give you a more accurate idea.
    In case of broken anisnmp.conf, the error message is pretty explicit.
    In case of other problems, that would need more investigation by TAC.
    Before doing anything, remind to perform backups!
    Pierre

  • What is a Cisco NAC appliance used for?

    We have a 5508 WLC in use already and have this 3310 lying around unused.  I am trying figure out if adding a 3310 would be of any benefit.
    From the documentation, the features of a 3310 NAC are,
    Recognize users, their devices, and their roles in the network
    Evaluate whether machines are compliant with security policies
    Enforce security policies by blocking, isolating, and repairing noncompliant machines
    Provide easy and secure guest access
    Simplify non-authenticating device access
    Audit and report whom is on the network
    What does enforce security polices by blocking, isolating, repairing really mean?
    "Provide easy and secure guest access"  I already have a public wireless ssid set on the wlc.
    I can recognize users in reports like Solarwinds.  I can see the username, IP, MAC, AP location.
    I can get an report from my logging traps collector, Solarwinds.

    Well usually when I have deployed them back in the days, you had a NAC Appliance and another NAC Manager. But what you have read, that is exactly what it does.
    What does enforce security polices by blocking, isolating, repairing really mean?
    It will block and isolate the device if it doesn't meet the requirements that you have set, but the user has to manually repair the items.
    "Provide easy and secure guest access" I already have a public wireless ssid set on the wlc.
    I can recognize users in reports like Solarwinds. I can see the username, IP, MAC, AP location.
    I can get an report from my logging t
    You will not see any username or ap locations. I wouldn't use it as it might be more of a headache to implement unless you know what you are doing.
    Sent from Cisco Technical Support iPhone App

  • ACS 5.2 appliance cli access

    Hi~
    Could you please tell me how can I make user access for CLI (shell) on ACS appliance by means of WEB GUI. The point is that I have ACSAdmin as well as another administrator role users, but can't get access to appliance through SSH (Permission denied (publickey,password,keyboard-interactive).). I need to troubleshoot RADIUS requests from my APC Networc Management Cards, by means of some sort of tcpdump, becouse I dont get any logs in ACS from APC cards.

    then either you need to enable more detailed logging on the ACS applicance
    How can I do this?
    or the RADIUS requests from the APC cards aren't reaching the ACS applicance
    This is what I'm trying to find out.
    Are there any firewalls, etc between the two devices that might be blocking RADIUS packets?
    No man, there is a clear IP connectivity between, but problem is that I can't troubleshoot RADIUS requests/replies on this part of transmission nor from APC side neither from ACS. I check all possible log records in "Monitoring and Reports" tab, but didn't find any request from APC devices.
    Also, if you have any configuration examples for APC (APC9630) devices RADIUS authentication by ACS 5.2 will be appreciated for the information. I have followed this  howto to configure VSA and apply policy, but still it doesn't work. I just want to verify are the RADIUS requests reach ACS or not.
    Thank you.

Maybe you are looking for