Two networks in ACS appliance

hello, the ACS appliace have two Gethernet, and I only can config one interface, is posible configure the other interface with another network address ?? Thanks

Hi Belal,
You can make use of other, if NIC 1 goes bad, so that you can re-configure ACS SE to use NIC 2 as NIC 1 is bad.
Though you cannot have dedicated management port for ACS SE.
These are options that you have :
[1] Only let certain IP addresses/network to have access to manage/administer ACS,
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs41/user/admin.htm#wp726913
[2] You can console into ACS SE, but that wont provide you with complete functionality, that you have though GUI. But it does have some functionality that you do not have through GUI.
So, you can setup ACS SE Console through a Terminal Server,
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacsapp/csapp41/igse41/instalap.htm#wp1065399
Regards,
Prem

Similar Messages

  • New ACS appliance not showing FQDN hostname in GUI

    I've installed two new ACS appliances in our environment running 5.3.  I've just configured the basics to get it on the network (ie DNS, default GW, IP address).  Looking at both running configs, they are identical with exception to the IP addresses.  On one appliance in the GUI next to the user name in the top right hand corner, the hostname is "acs01".  In the GUI on the other appliance, it shows "acs02.corp.mycompany.com".  This is a minor issue but its bugging me.  Anyone have an idea what is going on?
    In both appliances, this statement is identical in the show run:
    ip domain-name corp.mycompany.com

    Hi,
    So you are using a hardware RAID5 in storage pool as a hard disk. Now you added one more hard disk to the RAID5 with the tool "Dell Server Administrator" but it is not recognized in storage pool.
    I think it will not work as hard disk size cannot be changed after storage pool is created. It is by default.
    However why you use the hardware RAID in a storage pool? A hardware RAID seems enough for your storage requirement.
    If you have any feedback on our support, please send to [email protected]

  • ACS Appliance Hardware functionality

    Just received a new ACS Appliance and in testing out the functionality I've encountered a couple of curious issues...
    Shutdown -- Have tried doing shutdown from both HTTP and Serial connections. Command is accepted and the hard drive light flashes for a bit and then nothing. It does not power off, don't get a message on the serial console saying it is OK to power off. Waited 20 minutes then used the power button. Seems to conflict with the doco.
    Can we/How do we use the second Ethernet port? Don't see anything about how to configure it in the doco but when I plug a cable in I do get lights indicating it is active.
    I have been able to complete basic configuration and do have connectivity and authentication against Internal User, still fiddling with getting communication with our LDAP User database, So the unit does function.

    For the 2nd ethernet connection, the doco here (http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacsapp/csapp33/install/ovrvuap.htm#wp1040777) gives the answer:
    Ethernet Connectors
    Your system has two integrated 10/100/1000-megabit-per-second (Mbps) Ethernet connectors. Cisco Secure ACS Solution Engine supports the operation of either Ethernet connector, but not both connectors. Each Ethernet connector provides all the functions of a network expansion card and supports the 10BASE-T, 100BASE-TX, and 1000BASE-TX Ethernet standards.
    Each NIC is configured to automatically detect the speed and duplex mode of the network.
    Note The Cisco Secure ACS Solution Engine supports the operation of only one Ethernet connector at a time. Concurrent operation of both Ethernet connectors is not supported.
    For the shutdown issue, not sure, haven't seen that before.

  • For those having EAP auth issue using the ACS appliance

    Thought I'd pass along my config and resolution to an issue I was having concerning EAP-TLS auth on an ACS appliance.
    We have two ACS Solution Engines (3.2.2) running and doing a database synch and using Generic LDAP as the external database. We did the certificate walk through for the ACS and then turned on EAP-TLS auth. We are trying to use EAP-TLS auth for wireless access through our AP1200s and Windows XP laptops, but we kept getting errors.
    After digging for days I found out that when you request a certificate it pulls the CN name. Our CN name in Active Directory did not match our login name. I changed my CN name to match my login name and I was then able to grab a certificate and authenticate using EAP-TLS for our wireless.
    I am in the process of upgrading our ACSes to ver 3.3.2 so that I can run the Remote Agent for Windows on a Windos 2003 server and then use the Windows database as the external database and not Generic LDAP.
    I hope this helps someone!
    Jeff

    The document discusses the Extensible Authentication Protocol Transport Layer Security (EAP-TLS) authentication protocol deployment in wireless networks.
    http://www.cisco.com/warp/public/cc/pd/sqsw/sq/tech/acstl_wp.htm

  • ACS appliance setup help

    Network environment:
    - Windows 2003 with enterprise CA
    - Cisco ACS appliance 4.1.1.23
    - Cisco 1240 AG series APs
    Wireless clients:
    - Windows XP SP2
    Brief steps taken:
    - Installed Enterprise CA
    - Created copy of web server certificate with option “Mark keys as exportable” enabled. Certificate published.
    - Created global group in AD that contains test user and a single laptop that is a member of domain - for auto enrolment.
    - Generated certificate request from ACS (1024 key length).
    - Submitted server request from ftp server - Submit a certificate request using base 64…
    - Submitted CA certificate request from ftp server - Retrieve CA certificate or revocation list /base 64 encoded.
    - CA & server certificates installed in to ACS appliance (Domain certificate authority approved within ACS)
    Brief cofig of ACS appliance
    Global config
    - PEAP -Selected “Allow EAP-MSCHAPv2”.
    - LEAP - Allow LEAP (For Aironet only)
    - Selected “Allow MS-CHAP Version 1 & 2 authentication
    - Added AAA client (AP) with shared secret with authentication using “Radius (Cisco Aironet)
    - Under External user DB//DB config/windows database, “Enable PEAP machine authentication” selected.
    1240 series AP config
    - Under Server Manager, ACS IP with shared secret entered as a Radius server.
    - Selected EAP authentication.
    - Under SSID Manager selected open Authentication with EAP & selected network EAP.
    - Under Encryption Manager selected WEP Encryption & mandatory.
    - Selected key 1 and entered 128 bit key
    Client (windows XP SP2 domain member) config
    - Connected to Enterprise CA web site, base64 encoding/download CA certificate
    and installed it in local computer store.
    - Under Network authentication selected open with WEP EAP type “protected EAP (PEAP)
    - Authenticate as a computer selected
    - Selected my CA under “Trusted Certification Authorities
    - Authentication method (EAP-MSCHAP V2)
    Errors:
    Automatic certificate enrollment to local system failed to contact the AD. The specified domain does not exist or cannot be contacted.
    Or
    Computer doesn't have correct certificate
    Used 43486, 64067, 71929
    Any suggestions very much apretiated.

    ACS Agent is installed on two DC's as well and they are detected by ACS.
    Thanks

  • ACS appliance External Auth to NT 4.0

    Hi
    I am installing the ACS appliance to do external database authentication to NT 4.0 PDC. It appears with the appliance you have to install a remote agent to make this work. It is my understanding this agent must run on a win2k box. Does the agent have to be installed on the PDC or can it go on any windows server box?
    Is there a work around if you do not have a win2k server. This network is still NT4 with now win2k boxes
    Thanks

    The remote agent was not tested on NT4 and probably wouldn't even install properly. Even if it did work, you would be very limited in the support you'd get if you had strange problems because it is an unsupported configuration.
    It doesn't have to go on a PDC, but things just seem to work better if it is on a DC of some sort. At the very least it needs to be on a member server, but as I said, I'd recommend putting it on a BDC from experience.
    The release notes/install guide for it is here:
    http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacsapp/raig/index.htm

  • Trunked connections to ACS appliance

    We are replacing our Cisco ACS 4x server with a new ACS appliance. It is a Cisco UCS C220.
    We went with the hardened Linux option for the underlying OS.
    Our old server had multiple network adapters on different subnets so that it could authenticate devices on different VRFs (rings basically).
    I see the new appliance has only 2 network adapters in it. Is it possible to configure these as a 802.1q trunk in order to have the device service requests on 4-5 subnets? I haven't seen documentation on how to do this.

    Hi,
    ACS v4.1.1.23 patch 5 is available so go for this new patch.
    You should have a pc which can access ACS through web interface. Keep the patch file on the PC.
    Follow the steps below on the PC:
    [1] Extract zipped file
    [2] Look for ?autorun.exe? file and double click on it
    [3] It will start a tomcat server on your desktop and you?ll see a web page asking for ACS
    SE ip address :
    Provide in the ACS SE ip address and press ?Install?
    [4] It will prompt for ACS admin username and password as shown below :
    Provide in the username and password and login.
    [5] Then it bring up ACS GUI, then go to
    System Configuration > Appliance Upgrade Status > Download,
    Then we?ll get a screen where it will ask for ip address of Install Server :
    Provide in ip address of system from where we are applying this patch, in our case our
    desktop ip address, then click connect.
    [6] It will show us following screen :
    Click on ?Download Now?
    Then it?ll show us this screen :
    Press ?Refresh? Till we see following screen :
    [7] Now press ?Apply Upgrade?. Then it?ll ask for confirmation :
    Press ?Upgrade?, then we?ll get information regarding the patch.
    Click ?Yes?.
    It?ll take few minutes to apply that patch on appliance.
    Then it?ll show us a confirmation message :
    Press ?Done?, then system will reboot.
    To confirm that patch has been applied successfully, goto
    System Configuration > Appliance Upgrade Status
    After everything is fine stop the tomcat server by clicking on ?stop distribution server? or
    if you want to apply this patch on some more appliance click on ?Install Next?
    Hope this helps.
    ~Rohit

  • ACS Appliance - Advance filtering

    Hi all
    Quick question about my NAC setup on the ACS appliance.
    I have create a number of Network Access Profiles from the templates that ACS provide. All is working fine but my question is in regards to the Advanced Filtering under the NAP.
    When I created a template to support L2-802.1x users it placed the following attributes into my advance filter
    [026/009/001]cisco-av-pair not-exist aaa:service
    [006]Service-Type != 10
    And when I created a template to support mac-auth-bypass it placed these following attributes into my advance filter
    [026/009/001]cisco-av-pair not-exist aaa:service
    [006]Service-Type = 10
    What does the following line do?
    [026/009/001]cisco-av-pair not:exist aaa:service
    And what do these 2 lines do exactly.
    [006]Service-Type != 10
    [006]Service-Type = 10
    Thanks
    Dale

    "cisco-av-pair not:exist aaa:service"
    means to match, the incoming request must NOT include a cisco-av-pair VSA attribute that contains the value "aaa:service=........"
    remembering that the cicso-av-pair is like a container for TACACS+ style attributes of the form "protocol:attr=value" eg "ip:addr=1.2.3.4"
    RADIUS Service-Type 10 is "Framed Routing" which has been reused for some purpose by the NAC people. Not sure what it denotes but your filters are looking this attribute != (not equal to) and equal to this value.

  • Installing Cert on ACS Appliance

    I am trying to install a Cert on an ACS Appliance V3.2. I have created the cert using a MS CA on our network but when I try and install it says that the Private Key file cannot be blank. Any help would be appreciated.
    -clyde

    I had the same problem. Cisco's only help was to tell me that ACS Ver 3.2.3 only supported key sizes of 1024 bits minimum.(our root CA had a key size of 512)
    I resolved this by uninstalling the ACS then installing the root CA certificate on the server, next I made an enrollment request to the CA for the ACS's own certificate which was subsequently downloaded and installed.
    After re-installing the ACS server, I just selected "use certificate from storage" rather than "use certificate from file"

  • ACS appliance 3.2.2.5 Remote Agents for Windows DB disappear

    I have two ACS boxes: one is ACSNT and the other an ACS appliance. Both run 3.2.2.5 and have been in production for quite some time. The ACSNT box is the primary and replicates to the appliance as backup. These units authenticate to three different Windows domains: 2 NT domains and 1 AD.
    Recently I just added support for RSA 6.0 servers. Not wanting to mess with the client install on the ACSNT box, I set it up as a RADIUS token server as you do on the appliance. It works just fine on the ACSNT box. On the appliance, however, my Windows external DB quit working with "external db not operational" messages. I rebuilt the Windows external DB, recreated the group mappings, added the remote agents, etc. Things were working fine. I recreated the RSA config and still the Windows DB was working although the RSA config was not working (still working on that if TAC ever calls me back). A few hours later, I decided to check the Windows DB and it was broken again. I checked it out and the remote agents were somehow deleted. Nothing in the logs show it but they were gone. I recreated them and it worked again. This has happened twice now. Does anybody have any advice? The logs show nothing to indicate a problem on the appliance exists and of course the docs state that there should be no problem with both a RADIUS and Windows DBs living together on the same box. All comments welcome!
    Thanks,
    Rik

    Sorry it took so long to get back...I've been out of the office for a few days.
    I did check the the docs for issues like this but found nothing. The TAC Engineer escalated it and both engineers kept saying my new RSA servers were causing my issues. However, a simple reboot of the box (it is built on Win2K after all...) cleared up all of the strange issues.
    Thanks,
    Rik Guyler

  • ACS Appliance User DB to new non-appliance ACS server

    Is it possible to replicate an ACS appliance user DB and replicate it on a new non-appliance ACS server. We're adding additional ACS servers and don't want to re-create all the groups and mappings. Think of it as ghosting an appliance and restoring it on a new server. Thx

    Here is the link,
    http://cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080742f60.shtml
    Here is the troubleshooting check list, in case you face any issue,
    1) Make sure that you are not replicating over NAT. Replication over NAT does not work because the IP is used as part of the server authentication
    2) Next, check to make sure that you are not sending or receiving the distribution table. On the primary server, the distribution table should not be checked in the send list, and on the secondary, the distribution table should not be checked for receive.
    3) Then I would like you to check in the secondary server's partner list, to make sure that the primary is not listed. You should not enter the primary server into the partner list on the secondary server. However, the primary server should have all secondary servers listed in its partner list.
    4) Ensure that the secondary server has it's replication scheduling set to "manual".
    5) Please verify that your servers are all running exactly the same ACS version and build.
    6) Also let me know if we have any firewall in between two acs servers.
    Regards,
    ~JG

  • ACS Appliance 1112 - Authentication Without Enable Secret

    Hello Everybody
    I have a ACS appliance 1112 to authenticate users by TACACS+ with Active Directory.
    The users can access the privileged mode on network devices just with the user AD without typing a enbale secret but after a restart on appliance now the users are asked to typing a enable secret to access the privileged mode.
    Is necessary change something on Network Devices or maybe a configuration on ACS ?
    Thanks

    Please go to the group that belongs to the user in question and make sure we have shell exec checked with priv 15
    Bring users/groups in at level 15
    1. Go to user or group setup in ACS
    2. Drop down to "TACACS+ Settings"
    3. Place a check in "Shell (Exec)"
    4. Place a check in "Privilege level" and enter "15" in the adjacent field
    Also check passed authenticate logs and make sure that user are mapped to the right group of acs.
    Regards,
    ~JG
    Do rate helpful posts

  • Is there a way to connect to two networks simultaneously?

    Here is my scenario:
    I am an audio technician who travels from venue to venue for work have to constantly switch between two networks to do my job.  I use MAC OS w/ the most current version 10.9
    Example:
    99% of the time, there is venue provided wireless internet via DHCP, w/ no wired option available.  I log onto it for all my internet related productivity.  At the same time, I need to stay connected to a manual/static ip local network to remote & monitor audio hardware (wireless mic's, dsp drives, mixing consoles, etc).  I have the ability to use either a wired or wireless connection for the local manual network (new airport express, or wired line). 
    I go to my network preferences in my system prefs and can see a green confirmation indicator that both networks are indeed connected.  However, depending on which network i give priority to by "setting service order", the other network drops.  For example, today Im using a wired line to remote/monitor my audio systems on my manual/static ip network and can stay connected as long as i set my ethernet connection at the top of the 'service order' list.  As soon as I go to launch my Safari browser it says I am no longer connected to the internet, eventhough my network system preferences show I am still connected.  The only way I can get the internet to connect is to reset the 'service order' and put wi-fi back on top.  As soon as I do this though, my manual wired audio network loses it's connection.
    I should note some settings.  Today's networks:
    wireless (internet):
    ip: 10.100.1.159
    sm: 255.255.0.0
    router: 10.100.255.254
    wired (audio network):
    ip: 192.168.0.128
    sm: 255.255.255.0
    router: 192.168.0.1
    Is there a way to stay connected to both, regardless of the 'service order'?  I have a brand new airport express if putting something like that in-line helps in anyway.
    Best,
    Brian

    Is there a way to stay connected to both, regardless of the 'service order'?
    There can only be one active connection at any given time, no matter how many networks you may be connected to.

  • Connecting to two networks at the same time

    Hi Kadin,
    I am looking for the same answer for a long time. I have two situations that requires to connect to two different metworks and that is when I travel with my portable Linksys router WRT54GC .
    1. I stay at a hotel with a wireless Internet network connection and I try to use the network to access the Internet and then (2) I also need to access my external Maxtor harddrive to which I am connected through my portable router WRT54GC .
    2. I have an almost identical situation but instead of the hotel network now I have a brand new T-Mobil cell phone made by ITC, which is called Wings and it uses a new way to connect my laptop to the Internet by using a Windows Mobile 6 Internet-share connection, which basically connects my laptop to the T-Mobile network and assigns it a IP address.
    The problem that I have is that in both cases I can connect to each one of the networks separately but not simultaneously.
    Any advise as to how this can be done. I also tried the Wireless WET54G as a bridge with similar negative results.
    Thanks,
    Pole

    Ok not real clear on your setup, but here is the "networking answer" why you can not connect to two networks.
    A device must have an IP address on the same subnet of the device you want to establish a connection or an IP route must be known to the network routers, since your internal address are most likely in the reserved private range, no internet router is not going to know how to deliver the packets to the correct hosts.
    the simple answer is assign a secondary IP address to the network adapter on your laptop.
    In the windows IP address properties for secondary address you can not set a default gateway. Windows only has 1 default gateway.
    good luck
    jwm

  • How to web filtering via two network cards?

    I have Installed Server 2008 and two network cards
    on my pc. One LAN card for clients access and one for internet router. I need to share internet connection to my client computers with
    web filtering. So how to do that? I need to block some sites to client access.

    Hi,
    According to your description, my understanding is that you want to use the WS 2008 to share Internet connection and provide web filtering function for internal clients.
    Internal clients –(NIC1) WS 2008(NIC2) – Internet router – Internet network
    Manually assign IP address, default gateway, DNS server, etc. on NIC2. Manually assign IP address, DNS server, etc. on NIC1.
    Install Network Policy and Access Services – Routing and Remote Access Services. Detailed steps reference:
    Install and Enable the Routing and Remote Access Service
    https://technet.microsoft.com/en-us/library/cc770798(v=ws.10).aspx
    Then open Routing and Remote Access and start configuration. Enable NAT on NIC2 to transfer IP address. Detailed steps reference:
    Enable and Configure NAT
    https://technet.microsoft.com/en-us/library/dd469812.aspx
    Windows Server itself does not support web-based filter, third-party tools with application-layer firewall might be needed to realize this function. Configure WS as a router, it supports IP packet filtering, which specifies which type of traffic is allowed
    into and out of the router. Reference：
    https://technet.microsoft.com/en-us/library/cc732746(v=ws.10).aspx
    Best Regards,
    Eve Wang
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Maybe you are looking for