Tacacs authentication problem.

Hy,
I have a network with several layer 2 (c2960) attached to a layer 3 switch (c3750).
All these switches are behind a firewall (ASA 5510) and the firewall is connected to a router c3810.
I have an ACS v.4.x to use as a Tacacs server.
In all the equipments I have aaa authentication with tacacs and vlans.
To test the tacacs authentication in the switch, I created a bypass to the firewall and connected the network (using a management vlan) to the router.
With this scenario the tacacs authentication works.
If I disconnect the bypass, all the traffic cross over the firewall. But I will not have the tacacs working anymore with the switch.
I do not understand why!!?
I have another problem, this time with the firewall.
I configured the tacacs and the aaa in the firewall, as advised by Cisco.
But it seems that it doesn’t work!
In this two cases only the local authentication works.
Can you help me, please?
Thanks in advance,
                      Rui Oliveira

Hy,
I am doing tests in a Lab.
So, the addresses presented here are not Internet routable.
The configuration for the tacacs at the ASA is:
aaa-server TACACS protocol tacacs+
aaa-server TACACS (OUT_MANGMT) host 172.16.20.10
key mykey
aaa authentication enable console LOCAL
aaa authentication serial console LOCAL
aaa authentication telnet console TACACS LOCAL
aaa authentication http console TACACS LOCAL
aaa authentication ssh console TACACS LOCAL
aaa authorization command LOCAL
aaa accounting enable console TACACS
aaa accounting telnet console TACACS
aaa accounting ssh console TACACS
aaa local authentication attempts max-fail 5
aaa authorization exec LOCAL
I´m doing the tests with an ASA with a the IP address 10.183.0.61.
And this address is seen from the outside, but I do a NAT between the 10.183.0.61 and the IP address 192.168.100.2 in the TCP/23.
Besides that I have an interface called OUT_MANGMT, with IP address 192.168.100.2 .
I have another interface that a called GESTAO, with IP address 10.183.0.61.
This interface GESTAO is connected to a management vlan.
My ACS has IP 172.16.20.10 and the standard port for tacacs is tcp/49.
I send the logging file that I take from my firewall.
Thanks,
           Rui

Similar Messages

  • Problem setting 7606 router for TACACS+ authentication

    Hello Support Community,
    I have two Cisco 7606 routers which I have tried in vain to have users authenticated using TACACS+ servers. As shown below, I have two servers (1.1.1.1 and 2.2.2.2) reachable via vrf OAM which is reachable from desktops for ssh login. The true IP addresses and vrf have been altered because it's a company router.
    I use the two servers to authenticate many other Cisco devices in the network they are working fine.
    I can reach the servers from the vrf and the source interface in use. I can also telnet port 49 if the servers from the source interface and the vrf.
    The server key is hidden but at the time of configuration, I can ascertain that it's correct.
    The problem is that after confuring for TACACS authentication, the router still uses the enable password instead of TACACS. While the debug output shows 'bad password', why is the router not authenticating using TACACS? Why is it using the enable password?
    Please study the outputs below and help point out what I may need to change.
    PS: I have tried out many other combinations, including deprecated ones without success including the method suggested in this page;
    http://www.cisco.com/en/US/docs/ios/sec_user_services/configuration/guide/sec_vrf_tacas_svrs.html
    Please help I'm stuck.
    ROUTER#sh running-config | sec aaa
    aaa new-model
    aaa group server tacacs+ admin
    server name admin
    server name admin1
    ip vrf forwarding OAM
    ip tacacs source-interface GigabitEthernet1
    aaa authentication login admin group tacacs+ local enable
    aaa session-id common
    ROUTER#sh running-config | sec tacacs
    aaa group server tacacs+ admin
    server name admin
    server name admin1
    ip vrf forwarding OAM
    ip tacacs source-interface GigabitEthernet1
    aaa authentication login admin group tacacs+ local enable
    tacacs server admin
    address ipv4 1.1.1.1
    key 7 XXXXXXXXXXXXXXXXXXXX
    tacacs server admin1
    address ipv4 2.2.2.2
    key 7 XXXXXXXXXXXXXXXXxxxx
    line vty 0 4
    login authentication admin
    ROUTER#sh tacacs
    Tacacs+ Server -  public  :
                   Server name: admin
                Server address: 1.1.1.1
                   Server port: 49
                  Socket opens:         15
                 Socket closes:         15
                 Socket aborts:          0
                 Socket errors:          0
               Socket Timeouts:          0
       Failed Connect Attempts:          0
            Total Packets Sent:          0
            Total Packets Recv:          0
    Tacacs+ Server -  public  :
                   Server name: admin1
                Server address: 2.2.2.2
                   Server port: 49
                  Socket opens:         15
                 Socket closes:         15
                 Socket aborts:          0
                 Socket errors:          0
               Socket Timeouts:          0
       Failed Connect Attempts:          0
            Total Packets Sent:          0
            Total Packets Recv:          0
    Oct 22 12:38:57.587: AAA/BIND(0000001A): Bind i/f 
    Oct 22 12:38:57.587: AAA/AUTHEN/LOGIN (0000001A): Pick method list 'admin'
    Oct 22 12:38:57.587: AAA/AUTHEN/ENABLE(0000001A): Processing request action LOGIN
    Oct 22 12:38:57.587: AAA/AUTHEN/ENABLE(0000001A): Done status GET_PASSWORD
    Oct 22 12:39:02.327: AAA/AUTHEN/ENABLE(0000001A): Processing request action LOGIN
    Oct 22 12:39:02.327: AAA/AUTHEN/ENABLE(0000001A): Done status FAIL - bad password
    Oct 22 12:39:04.335: AAA/AUTHEN/LOGIN (0000001A): Pick method list 'admin'
    Oct 22 12:39:04.335: AAA/AUTHEN/ENABLE(0000001A): Processing request action LOGIN
    Oct 22 12:39:04.335: AAA/AUTHEN/ENABLE(0000001A): Done status GET_PASSWORD
    Oct 22 12:39:08.675: AAA/AUTHEN/ENABLE(0000001A): Processing request action LOGIN
    Oct 22 12:39:08.675: AAA/AUTHEN/ENABLE(0000001A): Done status FAIL - bad password
    Oct 22 12:39:10.679: AAA/AUTHEN/LOGIN (0000001A): Pick method list 'admin'
    Oct 22 12:39:10.683: AAA/AUTHEN/ENABLE(0000001A): Processing request action LOGIN
    Oct 22 12:39:10.683: AAA/AUTHEN/ENABLE(0000001A): Done status GET_PASSWORD
    Oct 22 12:39:14.907: AAA/AUTHEN/ENABLE(0000001A): Processing request action LOGIN
    Oct 22 12:39:14.907: AAA/AUTHEN/ENABLE(0000001A): Done status FAIL - bad password
    ROUTER#sh ver
    Cisco IOS Software, c7600rsp72043_rp Software (c7600rsp72043_rp-ADVIPSERVICESK9-M), Version 15.1(3)S3, RELEASE SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2012 by Cisco Systems, Inc.
    Compiled Fri 30-Mar-12 08:34 by prod_rel_team
    ROM: System Bootstrap, Version 12.2(33r)SRE, RELEASE SOFTWARE (fc1)
    BOOTLDR: Cisco IOS Software, c7600rsp72043_rp Software (c7600rsp72043_rp-ADVIPSERVICESK9-M), Version 15.1(3)S3, RELEASE SOFTWARE (fc1)
    ROUTER uptime is 7 weeks, 5 days, 16 hours, 48 minutes
    Uptime for this control processor is 7 weeks, 5 days, 16 hours, 49 minutes
    System returned to ROM by reload (SP by reload)
    System restarted at 20:00:59 UTC Wed Aug 28 2013
    System image file is "sup-bootdisk:c7600rsp72043-advipservicesk9-mz.151-3.S3.bin"
    Last reload type: Normal Reload
    Last reload reason: power-on
    This product contains cryptographic features and is subject to United
    States and local country laws governing import, export, transfer and
    use. Delivery of Cisco cryptographic products does not imply
    third-party authority to import, export, distribute or use encryption.
    Importers, exporters, distributors and users are responsible for
    compliance with U.S. and local country laws. By using this product you
    agree to comply with applicable laws and regulations. If you are unable
    to comply with U.S. and local laws, return this product immediately.
    A summary of U.S. laws governing Cisco cryptographic products may be found at:
    http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
    If you require further assistance please contact us by sending email to
    [email protected].
    Cisco CISCO7606-S (M8500) processor (revision 1.1) with 3670016K/262144K bytes of memory.
    Processor board ID FOX1623G61B
    BASEBOARD: RSP720
    CPU: MPC8548_E, Version: 2.1, (0x80390021)
    CORE: E500, Version: 2.2, (0x80210022)
    CPU:1200MHz, CCB:400MHz, DDR:200MHz,
    L1:    D-cache 32 kB enabled
            I-cache 32 kB enabled
    Last reset from power-on
    3 Virtual Ethernet interfaces
    76 Gigabit Ethernet interfaces
    8 Ten Gigabit Ethernet interfaces
    3964K bytes of non-volatile configuration memory.
    500472K bytes of Internal ATA PCMCIA card (Sector size 512 bytes).
    Configuration register is 0x2102

    In order to resolve this issue. Please replace the below listed command
    aaa authentication login admin group tacacs+ local enable
    with;
    aaa authentication login default group admin local enable
    You defined the server group name as method list and instead of using admin as a server-group, you used tacacs+
    Note: Please ensure you have local user and enable password configured in case of tacacs server unreachable.
    ~BR
    Jatin Katyal
    **Do rate helpful posts**

  • TACACS+ Authentication For Cisco NAM

    Hi All,
    I have an cisco ACS v5.1 and also a cisco NAM. Currently, I have configured TACACS+ on the NAM and the ACS v5.1 however when I try to access the NAM, the ACS v5.1 has an error message of "TACACS+ authentication ended with error" and I am not able to access the equipment.
    For your information, I have no problem with others equipment TACACS+ authentication with the same ACS.
    Please advise.
    Thks and Rgds

    Steven
    I would first suggest that you verify that your ACS has an appropriate and correct entry configured for the NAM as a client. Assuming that is correct then I would suggest that you check and verify that the NAM is originating its TACACS requests from the address that you configured for the client on the ACS and that the shared secret is the same on both devices.
    If those are correct then I would suggest to look in the Failed Attempts report of ACS and see if it provides a better identification of the problem.
    HTH
    Rick

  • TACACS+ authentication fails VPN3000 administration sessions

    I have a problem when running TACACS+ authentication of VPN3000 administration sessions. If the admin account in the AAA-server has an expired password the login fails to the VPN3000. If I login to a router with the same account connected to the same AAA-server I get a prompt that tells me to change password since it has expired. After changing password through that login to a router I can also login to the VPN3000. Is it a limitation in VPN3000? Does it have a hard time presenting a password change dialog on a webpage?
    Any help appreciated.
    Håkan

    In concentrators you won't get any prompt for password expiry. You will have to change the password before it expires.

  • SQLNET authentication problem!

    Hi,
    We have a setup in which the database server is running on a 'XXX' domain and all the clients are running in domain 'YYY'.
    On the client, if following is the setup, then the clients face ORA-03113 after around 45 to 90 minutes of idle time.
    SQLNET.ORA
    NAMES.DEFAULT_DOMAIN=YYY
    TNSNames.ORA
    DBName.YYY = (..........
    Note: This is not happening with all the clients in 'YYY' domain.
    Now, we thought this was a domain authentication problem and removed the DEFAULT_DOMAIN setup from the client. Still the client faces ORA-03113.
    As a part of trial, we moved one of the machines which was facing the problem to the domain of the database server and the error is gone.
    But, due to obvious reasons, it is not possible to move all the clients to the domain of database server.
    Is there any way to get around this problem?
    Why is it that only some of the clients are facing this problem?
    Why is it that the error occurs only after idle time and not during work?
    Do we need to set NAMES.DEFAULT_DOMAIN=XXX at client? (I apologize for this question but I am really confused with the matters now)
    Addition info: The database server is Oracle 10.1.0.2.0 and clients are ranging from Oracle 8.1.6 to Oracle 10.1.0. And the errors occur on clients with any version of Oracle.
    Please help us out in this regard.
    Thanks in advance,
    Satish

    I have gone thorugh the Action suggested for this oracle error.
    If problematic machine is shifted to the domain XXX, error is gone,Do you shift physically to some other network?? if yes then there might be a problem with your network. The machines which are disconnected, might be on the same network channel or switch which is creating some problem in your network. this is only luck that your failure occur when there is no activity from that client which is disconnected.
    Shift the places of problem facing client and non-problem facing client with each other and then check. It will clear the mind about the netrowk problem
    Regards

  • Tacacs authentication fails for one user account for only one switch

    Hi,
    I am having an scenario, where as Tacacs authentication fails for one user account for only one switch.
    The same user account works well for other devices.
    The AAA configs are same on every devices in the network.
    Heres the show tacacs output from the switch where only one user account fails;
                  Socket opens:        157
                 Socket closes:        156
                 Socket aborts:        303
                 Socket errors:          1
               Socket Timeouts:          2
       Failed Connect Attempts:          0
            Total Packets Sent:       1703
            Total Packets Recv:       1243
              Expected Replies:          0
    What could be the reason ?
    No errors on ACS server; same rights had been given to the user account.
    Thanks to advise.
    Prasey

    Hi there,
    Does the user get authenticated in the ACS logs?
    reports and activity----> failed attempts
    ro
    reports and activity----->  passed authentications
    That will help narrow it down.
    Brad

  • Webservice authentication problem

    Web Service Authentication problem
    Posted: Jun 17, 2005 3:32 PM        Reply      E-mail this post 
    Hi
    I have created a portal service and exposed this service as a webservice. I am consuming this webservice in webdynpro. Portal service contains 2 simple methods putdata() and getdatat().
    When i access the webservice i am getting the following error.
    "javax.xml.rpc.soap.SOAPFaultException: The User Authentification is not correct to access to the Portal Service com.sap.portal.prt.soap.GlobalData or the service was not found"
    My Enterprise portal server is configured for SSO to back end R/3 system. I have checked for portal service availability and it is fine.
    My Webdynpro and Portal are running on different machines. EP is running on AIX with SP11.
    Any help please.
    Regards
    NagaKishore V

    Hi Shahab,
    Can you reproduce the issue if you create 2 applications. One that exposes a secured web service and the other one the one, consumes the web service? This would help to isolate the issue and move forward in case is a bug.
    Thanks,
    Juan Camilo

  • Authentication problem - solved, but maybe a bug in Mac OS X?

    Hi,
    I've a rather small installation with only a handful of users configured on a Mac mini (Mac OS X Server, 10.6.8). All of them use the mail, calendar and addressbook server on the Mac, nothing more. They use it with Mac, iPhone and iPad. Everything worked fine for months but suddenly all of them were faced authentication problems: it was not possible to login on the imap server, the calendar server, the addressbook server. It was possible to login using the admin account on the server directly. Moreover, all users disappeared from the workgroup manager, however they still were available on the servers LDAP server and findable using ldapsearch.
    First, I used to completely restart the server to solve the problem, but it reappeared after only few hours again.
    Second, after understanding more about the authentication process, I found the "killall DirectoryService" was sufficient to solve the problem, but it still reappeared after few hours.
    Then I found the, once the problem occured, there was nearly no more communication to the local LDAP server on port 389 on localhost. When everything was working fine, the was a lot of such communication, including queries for usernames, when a login attempt was made. I started a "tcpdump -n -i lo0 port 389" and waited for the problem again. After the problem occured, I found in the pcap files that there were a few final query attempts, actually attempts the open a port 389 TCP connection to the slapd running on localhost, which were answered with a TCP RST. Then, no more attempts were made until l restarted the DirectoryService. Using the logfile of the slapd I found that this happened exactly at the time the slapd was stopped and restarted. And - surprisingly for me - stopping and restarting the slapd happened exactly once an hour.
    I then found that it happened exactly at the time the time machine backup process was started and indeed it was possible to trigger the event of restarting the slapd by manually starting a time machine backup.
    (Indeed, I switched my backup strategy from SuperDuper to time machine the other day and maybe that was the time the problem occured for the first time. I know that time machine is not considered as the best backup strategy for a server but I wanted to try on my own.)
    Google helped my to find a hint that time machine will actually stop and restart slapd - which is a generally a good idea, since otherwise a backup from some open database files would be made, which could work but may fail. So, I thing, someone of the developers thought about that problem too and has considered time machine for backups of a server.
    However, a not running slapd can not answer queries from a DirectoryService and a stopping or starting process might indeed end up with TCP SYNs answered with TCP RST.
    My solution was to disable time machine again and from that time the problem does not occur again.
    I'm wondering why the DirectoryService process isn't starting to query the slapd again after a failed connection. Isn't this a bug? After this experience I consider time machine as not only the not preferred backup solution for a server but as completely incompatible with Mac OS X server - although, as I said, it seems that someone thought about backing up the LDAP database using time machine.
    (On a Lion server this problem does not occur, the slapd will not be stopped and restarted when time machine is running. Moreover, I saw a com.apple.slapd.start notification in the slapd.log ... maybe this tells DirectoryService to try again.)
    Cheers,
    Wolfgang

    Another problem I found with the MacOS X key bindings: the 6 key doesn't work!
    In the config that ships with SQL Developer, I found this:
    <Item class="oracle.javatools.util.Pair">
    <first class="java.lang.String">DOCUMENT_6_CMD_ID</first>
    <second class="oracle.ide.keyboard.KeyStrokes">
    <data>
    <Item class="javax.swing.KeyStroke">6</Item>
    </data>
    </second>
    </Item>
    which should be:
    <Item class="oracle.javatools.util.Pair">
    <first class="java.lang.String">DOCUMENT_6_CMD_ID</first>
    <second class="oracle.ide.keyboard.KeyStrokes">
    <data>
    <Item class="javax.swing.KeyStroke">meta 6</Item>
    </data>
    </second>
    </Item>

  • Wifi Authentication Problem in Lenovo K900

    Hi,
    I am able to connect to wifi at home network. And when I try it at office it is showing Authentication problem and "Not in Range". The password and everything is correct. All my colleagues are able to connect with the same password. I searched online for the solution and there are many other lenovo tab and phone users facing the same problem and I am unable to find the solution. Can anyone resolve this issue and give appropriate answer for this.

    This is the first time I'm hearing this issue, I'm also an K900 user but this never happmed to me or my other friends.
    Are you sure that's the right password, maybe its case sensitive, because this bug is not present in K900.
    Facebook Profile I'm a carefree type of guy but always there to help, so if you have anything to ask don't hesitate.

  • Cisco ACS 4.2.1 authentication problem

    We are using cisco ACS 4.2.1 on windows 2003  to authenticate  with windows 2003 Actice Directory. We have update Active directory server windows 2008 version. We have checked the configuration of ACS on windows database and no problem but we can't see in ACS dynamic user. I have authentication problem ACS 4.2.1 to Windows 2008 R2 active directory.

    Hi there,
    There is a section in the ACS 4.x where you can define if the ACS should show the dynamic users or not, make sure that this option is unchecked, for this go to External User Databases/Unknown User Policy/Configure Caching Unknown Users
    Also if you are facing authentication issues with ACS 4.x and Windows 2008 R2, you may want ready my previous answer.
    Let me know if this helps.

  • Tacacs+ authentication/authorization based on user's subnet

    Hi Guys/Girls
    We have number of production cisco gears, all of which are configured with Tacacs+ and all of them working just fine. But now I have a requirement to implement SSH-ver2 across whole network, comprise of about 8000 cisco gears.
    I need to develop a proof of concept (POC), that enabling SSH on production gears will not affect existing Tacacs+ users authentication and authorization.
    In our lab cisco gears, it has been already configured with production Tacacs+ server for authentication and authorization. Now I am allowed to test SSH on these lab-gears but I without disrupting others users who are using the same lab-gears.
    So, I want to enable SSH version 2 on these lab-gears however, when user coming from a certain specific subnet, this particular user must be authenticated and authorized by LAB Tacacs+ but not from production Tacacs+, however please note that lab-gears I am testing with also already configured for  production Tacacs+ server as well. These lab-gears must be able to do authentication and authorization to two different Tacacs+ server based on users subnet that he or she coming from.
    Is this doable plan? I have been looking for a documentation to implement test this method, not being successful.
    Your feedback will be appreciated and rated.
    Thanks
    Rizwan Rafeek

    Riswan,
    This will not work, tacacs authentication starts once the ssh connection is established, the NAD (switch or router) will open a tacacs connection and send the start flag to the tacacs server in which the message "getusername" is sent from the tacacs server to the device and to the user terminal. You can not create an acl in order to pick which tacacs servers you can authenticate to either. So when it comes to authenticating users from a specific subnet to a specific tacacs server that is not the intended design of tacacs, when you configure multiple servers in a group it is to insure high availability such that when one tacacs server goes down you have a secondary to continue with the authenticaiton requests.
    Here is an example of how the tacacs authentication is performed.
    http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a0080094e99.shtml#comp_traffic
    thanks and I hope that helps,
    Tarik Admani
    *Please rate helpful posts*

  • WLC 5508 WPA Authentication Problems

    Hello,
    We have a WLC 5508 with 7.4.100.0 Firmware.
    We are using 1141 and 1142 APs and we are having authentication problems with clients that are connecting to our WLAN with WPA+AES autentication. The clients receive in her laptop a password error, and we receive the following log in wlc:
    Client Excluded: MACAddress:f8:f1:eb:dd:ff:cd Base Radio MAC :08:ad:dd:76:4d:30 Slot: 0 User Name: unknown Ip Address: unknown Reason:802.1x Authentication failed 3 times. ReasonCode: 4
    The strange thing is that the problem is solved restarting the Access-points.
    Anyone had this problem previusly?
    Thanks in advance.

    I made the configuration using the Cisco Recommended settings, the strange thing its that the users connect normally, until they starts with authentication problems. I restart the access points and the problem its solved.
    Cisco Recommended  and not recommended Authentication Settings
    Security encryption settings need to be identical for WPA and WPA2 for TKIP and AES as shown in this image:
    These images provide examples of incompatible settings for TKIP and AES:
    Note: Be aware that security settings permit unsupported features.
    These images provide examples of compatible settings:

  • WiFi Authentication problem

    I have an iMac, and iPad, a Blackberry (forgive me) and Airport for my WiFi all of my pieces are working fine with my WiFi.  I had guests over the other day and we could not allow my guests iPads or iPhone to sign onto my network.  I bought my dad a generic tablet to use for solving cross words, etc., and I cannot sign into my own network.  No opportunity exists to put in a password because it just reads "Authentication Problem".
    No opportunity exists, therefore, to enter the password.  Signal strength is excellent, Securty is WPA2 PSK, I touch connect and it says Saved Secured with WPA2 and then goes back to "Authentication Problem."
    I've unplugged (and plugged back in) both the Airport / router and Internet Service provider's modem. I've rebooted my iMac and the new generic pad 3 times each. 
    I had 2 networks one for me and one for guests, can't get into either, identical problem. I can see all of the neighbour's networks and they're all locked and say secured with (various WPA/WPA2, etc., just mine says Authentication Problem.  I plugged the tablet into my iMac and it's functioning well.
    I now deleted the guest network and can't open a new network. 
    I've triple checked my passwords, hand written and in the Key Chain.
    I've checked my Apple ID (I'm able to get into this forum).
    Both my iPad (purchased May 2013) and BlackBerry (received free July 2013) signed in without any problems.
    I cannot see why I can't get into my network ~ any ideas?

    Hello,
    Hmmm..."problem"...pretty hard to understand. Can you provide more details? What exactly do you try? What exactly happens at each step of what you try? What is the exact and complete content of any error messages presented?
    Please remember that we can't see you nor your device. We have only your words to help us understand your situation, and such understanding is the natural prerequisite to providing you with any useful guidance.
    Thanks and let us know.
    Occam's Razor nearly always applies when troubleshooting technology issues!
    If anyone has been helpful to you, please show your appreciation by clicking the button inside of their post. Please click here and read, along with the threads to which it links, for helpful information to guide you as you proceed. I always recommend that you treat your BlackBerry like any other computing device, including using a regular backup schedule...click here for an article with instructions.
    Join our BBM Channels
    BSCF General Channel
    PIN: C0001B7B4   Display/Scan Bar Code
    Knowledge Base Updates
    PIN: C0005A9AA   Display/Scan Bar Code

  • Can I intergrate TACACS+ authentication with MS AD?

    hi, I would like to using MS AD account as a tacacs authentication account. I use tac_plus-F4.0.4.7 on Freebsd. Does anyone get some ideas? thank you!

    Although that is an interesting thought, I am also not up on that software and not sure this would be the best place to get that answer. For Cisco's Secure ACS, it is merely a click of the button. ACS from Cisco has many other features that I do know are not availabe in the few open source TACACS+ servers i have seen. I see no advantage even for small companies going this route given that the savings in dollars is little compared to the loss in functionality and interoperability among Cisco's products.

  • Email authentication problem on only some of Verizon's servers

    I use Eudora 6.2.4 on an iMac Core 2 Duo 2.0 20" (Al) Macintosh running OX 10.5.5.  Like many others (see one thread each under FiOS Internet and High Speed Internet and Dialup), since about mid-November, I have been receiving intermittent (about 10% of the time) authentication errors when Eudora checks for new mail.  I have 3 VZ e-mail accounts and one at my employer; the errors occur only on the VZ accounts.
    I've used the freeware app Eavesdrop (http://code.google.com/p/eavesdrop/) to observe the TCP conversations between Eudora and the server. The VZ server offers SASL CRAM-MD5 PLAIN, and Eudora uses CRAM-MD5.  I see the challenge from the server, Eudora's response, and the server's authentication-failure response.  Since the response is hashed, I have no way of telling if Eudora is sending the correct response, but it works most of the time.  (After it fails, Eudora then assumes its stored password is NG, discards it, and prompts me for it on the next mail-check, which is just a bit annoying.)
    Here is an example of a successful mail-check:
    +OK Messaging Multiplexor (Sun Java(tm) System Messaging Server 6.2-6.01 (built Apr  3 2006)) <[email protected]>
    CAPA
    +OK list follows
    TOP
    PIPELINING
    UIDL
    RESP-CODES
    AUTH-RESP-CODE
    USER
    SASL PLAIN CRAM-MD5
    IMPLEMENTATION MMP-6.2p6.01 Apr  3 2006
    auth CRAM-MD5
    + PDQ5MzU1ZWY3LmRlZWZlMEB2bXMxMDkubWFpbHNydmNzLm5ldD4=
    amp3b2xmOSA3MDA0MmE5YWQwYzEzOWRkYjE5NDk0OWZjYjY1NzBmMg==
    +OK Maildrop ready
    STAT
    +OK 0 0
    QUIT
    And here's a failure:
    +OK Messaging Multiplexor (Sun Java(tm) System Messaging Server 6.3-7.04 (built Sep 26 2008)) <[email protected]>
    CAPA
    +OK list follows
    TOP
    PIPELINING
    UIDL
    RESP-CODES
    AUTH-RESP-CODE
    USER
    SASL CRAM-MD5 PLAIN
    IMPLEMENTATION MMP-6.3p7.04 Sep 26 2008
    auth CRAM-MD5
    + PGZjMDAxY2M0ZjZlNDAyNjM3ZTI1MTVmMGU1MWEyYzVjQHZtczE3MTAxMy5tYWlsc3J2Y3MubmV0Pg==
    amp3b2xmOSA1NWNmNzJhYzRhZDdlMmE1ZGExZmIwZDVkMzA3NTc5OQ==
    -ERR [AUTH] Authentication failed
    You'll notice that the VZ server identifies itself at the onset of each conversation, including a build ID and date, followed by a timestamp and a server ID (e.g., vms109.mailsrvcs.net).  I'm in eastern Massachusetts, and when my client connects to incoming.verizon.net, one of a pool of V servers responds.  I've observed about 15 different servers, of which two (vms171011 and vms171013) show "6.3-7.04 (built Sep 26 2008)" and all the others show "6.2-6.01 (built Apr  3 2006)".  Furthermore, I observe that vms171011 and vms171013 consistently give this authentication failure for CRAM-MD5, but all the others (with the older build) consistently succeed in authenticating my accounts.
    I called FiOS Support, and the CSR took down took down some relevant info, said she'd pass it on the the e-mail folks.  Within 2 hours I got a call from a Verizon tech.  He said they "knew" about it and that it was a Mac problem.  It wasn't specific to VZ, and it occurred only on Macs.   He had no explanation for my observation that mail-check authentication works with 13 of VZ's servers and consistently fails with two which have a later build version/date, but he believed it was consistent with it being an Apple problem.  So naturally he was off the hook.
    He referred me to an Apple Support Forum discussion to back up his position.  I hadn't seen (or thought of looking in) the Apple forums, so I had a look and found a total of 5 threads under "Mail and Address Book".  Of course, these deal with Mail.app, .  Comcast as well as VZ.  This is the lengthiest of them:
      http://discussions.apple.com/message.jspa?messageID=8478765#8478765 
    These Apple discussion threads and the two Verizon Forum threads all mention Macintoshes, which lends credence to the tech's assertion that it's a Mac problem, not Verizon's.  I've found one that seems to depict the same thing on a PC (http://groups.google.com/group/comp.mail.eudora.ms-windows/browse_thread/thread/b426c0ca59841ca9), but it's not conclusive. 
    I don't know what PeeCee users use for a mail client or what method they use for authentication (the POP3 protocol, as amended,has several possibilities).  My Eudora app has settings for "Password", "Kerberos", and "APOP", but VZ doesn't offer Kerberos, and Eudora seems to ignore the APOP setting, so it uses only the CRAM-MD5 method, so I'm stuck.  I can't disprove that this is a Mac-only problem, but I can't understand why the CRAM-MD5 authentication always works with 13 of VZ's servers and always fails with 2 others (which happen to have a different build version/date).
    Solved!
    Go to Solution.

    With the help of a Windows-using friend, I have additional evidence that the mail-check authentication problem is NOT Mac-specific, but also can be shown to occur with a POP3 client (the final version, Eudora 7.1.0.9) using a secure authentication method (APOP) on Windows (XP Home, SP 3).  He had been observing no authentication problems, but investigation showed that his authentication setting was for "Password", which uses the basic (and very insecure) USER/PASS messages.  His Eudora does not allow CRAM-MD5, but it does have APOP authentication, which is another secure method that also uses the MD5 algorithm to encrypt the password.
    When he changed the setting to use APOP authentication, he observed the same behavior that I've reported above:
       - with most of the VZ servers (e.g., vms095.mailsrvcs.net, vms104.mailsrvcs.net) that show "6.2-6.01 (built Apr  3 2006)", the authentication succeeds
       - with vms171011.mailsrvcs.net and vms171013.mailsrvcs.net, which show "6.3-7.04 (built Sep 26 2008)", the authentication fails.
    See examples below.
    Here's a successful mail-check (these excerpts are from the Eudora log; I've edited his username):
    3244    64:13.20 Rcvd: "+OK Messaging Multiplexor (Sun Java(tm) System Messaging Server 6.2-6.01 (built Apr  3 2006)) <[email protected]> [ISafe POP3 Proxy] \r\n"
    3244    32:13.20 Sent: "CAPA\r\n"
    3244    64:13.20 Rcvd: "+OK list follows\r\n"
    3244    64:13.20 Rcvd: "TOP\r\n"
    3244    64:13.20 Rcvd: "PIPELINING\r\n"
    3244    64:13.20 Rcvd: "UIDL\r\n"
    3244    64:13.20 Rcvd: "RESP-CODES\r\n"
    3244    64:13.20 Rcvd: "AUTH-RESP-CODE\r\n"
    3244    64:13.20 Rcvd: "USER\r\n"
    3244    64:13.20 Rcvd: "SASL PLAIN CRAM-MD5\r\n"
    3244    64:13.20 Rcvd: "IMPLEMENTATION MMP-6.2p6.01 Apr  3 2006\r\n"
    3244    64:13.20 Rcvd: ".\r\n"
    3244    32:13.20 Sent: "APOP XXXXX 8a45b60f3f4a52a472937e86edbfda70\r\n"
    3244    64:13.21 Rcvd: "+OK Maildrop ready\r\n"
    3244    32:13.21 Sent: "STAT\r\n"
    3244    64:13.21 Rcvd: "+OK 0 0\r\n"
    3244    32:13.21 Sent: "QUIT\r\n"
    3244    64:13.21 Rcvd: "+OK\r\n"
    And here's one that fails; note the different server build-date:
    460     64:13.23 Rcvd: "+OK Messaging Multiplexor (Sun Java(tm) System Messaging Server 6.3-7.04 (built Sep 26 2008)) <[email protected]> [ISafe POP3 Proxy] \r\n"
    460     32:13.23 Sent: "CAPA\r\n"
    460     64:13.23 Rcvd: "+OK list follows\r\n"
    460     64:13.23 Rcvd: "TOP\r\n"
    460     64:13.23 Rcvd: "PIPELINING\r\n"
    460     64:13.23 Rcvd: "UIDL\r\n"
    460     64:13.23 Rcvd: "RESP-CODES\r\n"
    460     64:13.23 Rcvd: "AUTH-RESP-CODE\r\n"
    460     64:13.23 Rcvd: "USER\r\n"
    460     64:13.23 Rcvd: "SASL CRAM-MD5 PLAIN\r\n"
    460     64:13.23 Rcvd: "IMPLEMENTATION MMP-6.3p7.04 Sep 26 2008\r\n"
    460     64:13.23 Rcvd: ".\r\n"
    460     32:13.23 Sent: "APOP XXXXX ab2dde7d89cbbf0bf9cd409dce02e5a8\r\n"
    460     64:13.27 Rcvd: "-ERR [AUTH] Authentication failed\r\n"
    IMHO all this evidence validates my original hypothesis, that two (or more) of VZ's mail servers, which have server builds "6.3-7.04 (built Sep 26 2008)", advertise secure CRAM-MD5 and APOP authentication capabilities, but consistently fail such authentication attempts.  All the other servers with builds "6.2-6.01 (built Apr  3 2006)" handle these authentications correctly.  This has been shown to be the case on both Mac and Windows POP3 email clients.  Email clients that use the simpler and unsecure USER/PASS and AUTH PLAIN methods apparently see no authentication errors on any of the VZ servers.  This strongly points to this being a Verizon problem specific to two of the servers that we see here in eastern Massachusetts.  Others have also observed the same server-specificity; see for example http://eudorabb.qualcomm.com/showthread.php?t=13802 .  This problem has been reported since about mid-November.
    Verizon, the ball is in your court.  Find the problem and fix it!

Maybe you are looking for