Windows Remote Agent Failover timeout (ACS 4.2)

Hey everybody,
I'm using two Windows 2003 Servers with local users as External User Databases (so they're both usind the \LOCAL domain) for my ACS 4.2 appliance. I've added the machines as Windows Remote Agents and configured them as Primary and Secondary Remote Agents. In general, all this works great including the failover. However, if the primay machine actually fails, it takes about 10 - 15 minutes until the ACS uses the secondary server for authentication. Is there any way to adjust the failover timers? As far as I understand, the Remote Agent response timeout setting on the Remote Agent selection page is only for retrieving the Windows groups for group mapping. I've lowered this setting but it didn't have an effect on my problem.
Can anybody tell me more about the failover mechanism here? Does the ACS simply wait for the Primary Remote Agent for a while and then proceed to the Secondary? How long is failover supposed to take? Can any adjustments be made?
Any hints will be much appreciated!
Matt

Hi,
sorry for the long delay, it took a while to collect the necessary data.
A few comments on the logs. I've abbreviated them to the relevant parts (in my opinion) to make things a little easier to find.
Also, I had to change IP addresses and hostnames (but kept them consistent to represent our actual IP settings).
This is our set-up:
Hostname
IP Adress
ACS
10.10.10.10
CSWinAgent_1
10.11.11.16
CSWinAgent_2
10.10.10.16
Please note that the system clocks are not in sync. I've tried to help with some comments in the logs (marked with ***)
I tested the following:
1. Only CSWinAgent_2 is running, everything working fine.
2. Also started CSWinAgent_1 (see log at 21:47:14)
-> authentication still working (not in the logs)
2. Shut down the service on CSWinAgent_2 (21:52:37)
3. 5 unsuccessful authentication attempts for 15 minutes (see ACS log)
4. First successful attempt (ACS log, 22:06:33)
5. Another fail (strange) and successful login from another client (ACS log, 22:08:01)
6. Shut down the service on CSWinAgent_1 (22:04:47)
7. Started the service on CSWinAgent_2 (22:09:48)
8. Failed attempt (ACS log, 22:09:03)
9. Successful attempt after < 1min (ACS log, 22:09:11)
I would appreciate any ideas and information on how and in which timeframe the switchover process is supposed to work.
Thank you very much for your help.
Matt
Here are the logs:
ACS (10.10.10.10):
*** 5 failed login attempts over 15 minutes (CSWinAgent_1 is available during this time):
Jul 13 21:51:55 10.10.10.10 CisACS_02_FailedAuth 1oz5bgsae 1 0 Message-Type=Authen failed,User-Name=USER_ID,NAS-IP-Address=172.16.1.138,Authen-Failure-Code=External DB is not operational,Caller-ID=192.168.1.6,NAS-Port=tty1,Group-Name=USER_GROUP,
Jul 13 21:52:01 10.10.10.10 CisACS_02_FailedAuth 1qn2vrgaf 1 0 Message-Type=Authen failed,User-Name=USER_ID,NAS-IP-Address=172.16.1.138,Authen-Failure-Code=External DB is not operational,Caller-ID=192.168.1.6,NAS-Port=tty1,Group-Name=USER_GROUP,
Jul 13 21:52:53 10.10.10.10 CisACS_02_FailedAuth 61f498ag 1 0 Message-Type=Authen failed,User-Name=USER_ID,NAS-IP-Address=172.16.1.138,Authen-Failure-Code=External DB is not operational,Caller-ID=192.168.1.6,NAS-Port=tty1,Group-Name=USER_GROUP,
Jul 13 21:56:41 10.10.10.10 CisACS_02_FailedAuth 1xaujikah 1 0 Message-Type=Authen failed,User-Name=USER_ID,NAS-IP-Address=172.16.1.138,Authen-Failure-Code=External DB is not operational,Caller-ID=192.168.1.6,NAS-Port=tty1,Group-Name=USER_GROUP,
Jul 13 22:06:32 10.10.10.10 CisACS_02_FailedAuth k6ymh8aj 1 0 Message-Type=Authen failed,User-Name=USER_ID,NAS-IP-Address=172.16.1.138,Authen-Failure-Code=External DB is not operational,Caller-ID=192.168.1.6,NAS-Port=tty1,Group-Name=USER_GROUP,
*** 2 successful, 1 fail (See 22:02:53 & 22:04:20 on CSWinAgent_1):
Jul 13 22:06:33 10.10.10.10 CisACS_01_PassedAuth kgy7v0ak 1 0 User-Name=USER_ID,NAS-IP-Address=172.16.1.138,Caller-ID=192.168.1.6,NAS-Port=tty1,Group-Name=USER_GROUP,Filter Information=Access Filter Deny_RZ-SAN from USER_GROUP did not fail any criteria. This is sufficient to satisfy an 'Any Selected' SPC NAR config.,
Jul 13 22:06:34 10.10.10.10 CisACS_04_TACACSAcc kqxt8sal 1 0 Group-Name=USER_GROUP,User-Name=USER_ID,NAS-IP-Address=172.16.1.138,NAS-Portname=tty1,Caller-Id=192.168.1.6,Acct-Flags=start,service=shell,task_id=196,
Jul 13 22:06:40 10.10.10.10 CisACS_02_FailedAuth mevdjgam 1 0 Message-Type=Authen failed,User-Name=USER_ID,NAS-IP-Address=172.16.1.138,Authen-Failure-Code=External DB is not operational,Caller-ID=192.168.1.6,NAS-Port=tty1,Group-Name=USER_GROUP,
Jul 13 22:08:01 10.10.10.10 CisACS_01_PassedAuth 18vyhjgan 1 0 User-Name=USER_ID,NAS-IP-Address=172.16.1.139,Caller-ID=192.168.1.6,NAS-Port=tty1,Group-Name=USER_GROUP,Filter Information=Access Filter Deny_RZ-SAN from USER_GROUP did not fail any criteria. This is sufficient to satisfy an 'Any Selected' SPC NAR config.,
Jul 13 22:08:01 10.10.10.10 CisACS_04_TACACSAcc 18vyhjgao 1 0 Group-Name=USER_GROUP,User-Name=USER_ID,NAS-IP-Address=172.16.1.139,NAS-Portname=tty1,Caller-Id=192.168.1.6,Acct-Flags=start,service=shell,task_id=134,
Jul 13 22:08:03 10.10.10.10 CisACS_04_TACACSAcc 19fxob0ap 1 0 Group-Name=USER_GROUP,User-Name=USER_ID,NAS-IP-Address=172.16.1.139,NAS-Portname=tty1,Caller-Id=192.168.1.6,Acct-Flags=stop,service=shell,elapsed_time=1,task_id=134,
Jul 13 22:08:35 10.10.10.10 CisACS_04_TACACSAcc 1ibkojwaq 1 0 Group-Name=USER_GROUP,User-Name=USER_ID,NAS-IP-Address=172.16.1.138,NAS-Portname=tty1,Caller-Id=192.168.1.6,Acct-Flags=stop,service=shell,elapsed_time=121,task_id=196,
*** much faster switchover the other way (one failed attempt, failover in < 1min):
Jul 13 22:09:03 10.10.10.10 CisACS_02_FailedAuth 1q39b9oar 1 0 Message-Type=Authen failed,User-Name=USER_ID,NAS-IP-Address=172.16.1.138,Authen-Failure-Code=External DB is not operational,Caller-ID=192.168.1.6,NAS-Port=tty1,Group-Name=USER_GROUP,
Jul 13 22:09:11 10.10.10.10 CisACS_01_PassedAuth 1sb62bwas 1 0 User-Name=USER_ID,NAS-IP-Address=172.16.1.138,Caller-ID=192.168.1.6,NAS-Port=tty1,Group-Name=USER_GROUP,Filter Information=Access Filter Deny_RZ-SAN from USER_GROUP did not fail any criteria. This is sufficient to satisfy an 'Any Selected' SPC NAR config.,
Jul 13 22:09:17 10.10.10.10 CisACS_01_PassedAuth 1tz3mmkat 1 0 User-Name=USER_ID,NAS-IP-Address=172.16.1.138,Caller-ID=192.168.1.6,NAS-Port=tty1,Group-Name=USER_GROUP,Filter Information=Access Filter Deny_RZ-SAN from USER_GROUP did not fail any criteria. This is sufficient to satisfy an 'Any Selected' SPC NAR config.,
Jul 13 22:09:23 10.10.10.10 CisACS_01_PassedAuth 1vn16x8au 1 0 User-Name=USER_ID,NAS-IP-Address=172.16.1.138,Caller-ID=192.168.1.6,NAS-Port=tty1,Group-Name=USER_GROUP,Filter Information=Access Filter Deny_RZ-SAN from USER_GROUP did not fail any criteria. This is sufficient to satisfy an 'Any Selected' SPC NAR config.,
Jul 13 22:09:42 10.10.10.10 CisACS_01_PassedAuth 1vqtscav 1 0 User-Name=USER_ID,NAS-IP-Address=172.16.1.138,Caller-ID=192.168.1.6,NAS-Port=tty2,Group-Name=USER_GROUP,Filter Information=Access Filter Deny_RZ-SAN from USER_GROUP did not fail any criteria. This is sufficient to satisfy an 'Any Selected' SPC NAR config.,
Jul 13 22:09:42 10.10.10.10 CisACS_04_TACACSAcc 1vqtscaw 1 0 Group-Name=USER_GROUP,User-Name=USER_ID,NAS-IP-Address=172.16.1.138,NAS-Portname=tty2,Caller-Id=192.168.1.6,Acct-Flags=start,service=shell,task_id=3782,
Jul 13 22:10:21 10.10.10.10 CisACS_04_TACACSAcc cpazpoax 1 0 Group-Name=USER_GROUP,User-Name=USER_ID,NAS-IP-Address=172.16.1.138,NAS-Portname=tty2,Caller-Id=192.168.1.6,Acct-Flags=stop,service=shell,elapsed_time=39,task_id=3782,
CSWinAgent_1 (10.11.11.16):
*** service started manually:
CSWinAgent 07/13/2010 21:47:14 A 0528 14340 0x0 Logging mode: LOW
CSWinAgent 07/13/2010 21:47:14 A 0228 14340 0x0 CSWinAgent server starting ==============================
CSWinAgent 07/13/2010 21:47:14 A 0233 14340 0x0 Running as console application.
CSWinAgent 07/13/2010 21:47:14 A 0059 15332 0x0 Will listen on port 2005
CSWinAgent 07/13/2010 21:47:14 A 0064 15332 0x0 Permitted CSWinAgent Clients: *.*.*.*
CSWinAgent 07/13/2010 21:47:14 A 0116 15332 0x0 NTLIB: Library behaviour mode 2
CSWinAgent 07/13/2010 21:47:14 A 0136 15332 0x0 NTLIB: Initialising locally
CSWinAgent 07/13/2010 21:47:14 A 0139 15332 0x0 NTLIB: The local computer name is CSWinAgent_1
CSWinAgent 07/13/2010 21:47:14 A 0171 15332 0x0 NTLIB: The insist on domain is disabled
CSWinAgent 07/13/2010 21:47:14 A 0281 15332 0x0 NTLIB: We are NOT a domain controller
CSWinAgent 07/13/2010 21:47:14 A 0423 15332 0x0 NTLIB: We are NOT a member of a domain => we cannot authenticate accounts on other trusted domains
CSWinAgent 07/13/2010 21:47:14 A 0112 15332 0x0 Listener activated
*** first incoming connection:
CSWinAgent 07/13/2010 22:02:53 A 0140 15332 0x0 Client connecting from 10.10.10.10:2732
CSWinAgent 07/13/2010 22:02:53 A 0390 15480 0x0 RPC: NT_MSCHAPAuthenticateUser received
CSWinAgent 07/13/2010 22:02:53 A 1807 15480 0x0 NTLIB: Got WorkStation ACS
CSWinAgent 07/13/2010 22:02:53 A 1808 15480 0x0 NTLIB: Attempting Windows authentication for user USER_ID
CSWinAgent 07/13/2010 22:02:53 A 1866 15480 0x0 NTLIB: Windows authentication SUCCESSFUL (by CSWinAgent_1)
CSWinAgent 07/13/2010 22:02:53 A 1947 15480 0x0 NTLIB: Domain name in MSCHAPAuthenticateUser is \LOCAL
CSWinAgent 07/13/2010 22:02:53 A 1952 15480 0x0 NTLIB: Group Mapping Flag in MSCHAPAuthenticateUser is enabled
CSWinAgent 07/13/2010 22:02:53 A 1968 15480 0x0 NTLIB: Group Map Count in MSCHAPAuthenticateUser is -1
CSWinAgent 07/13/2010 22:02:53 A 0190 15480 0x0 NTLIB: User has 10 groups
CSWinAgent 07/13/2010 22:02:53 A 0431 15480 0x0 RPC: NT_MSCHAPAuthenticateUser groups: None,LAN_Admins,Users,Administrators
CSWinAgent 07/13/2010 22:02:53 A 0436 15480 0x0 RPC: NT_MSCHAPAuthenticateUser Domain Name is: CSWinAgent_1
CSWinAgent 07/13/2010 22:02:53 A 0452 15480 0x0 RPC: Success
CSWinAgent 07/13/2010 22:02:53 A 0465 15480 0x0 RPC: NT_MSCHAPAuthenticateUser reply sent
*** second authentication:
CSWinAgent 07/13/2010 22:04:20 A 0390 15480 0x0 RPC: NT_MSCHAPAuthenticateUser received
CSWinAgent 07/13/2010 22:04:20 A 1807 15480 0x0 NTLIB: Got WorkStation ACS
CSWinAgent 07/13/2010 22:04:20 A 1808 15480 0x0 NTLIB: Attempting Windows authentication for user USER_ID
CSWinAgent 07/13/2010 22:04:20 A 1866 15480 0x0 NTLIB: Windows authentication SUCCESSFUL (by CSWinAgent_1)
CSWinAgent 07/13/2010 22:04:20 A 1947 15480 0x0 NTLIB: Domain name in MSCHAPAuthenticateUser is \LOCAL
CSWinAgent 07/13/2010 22:04:20 A 1952 15480 0x0 NTLIB: Group Mapping Flag in MSCHAPAuthenticateUser is enabled
CSWinAgent 07/13/2010 22:04:20 A 1968 15480 0x0 NTLIB: Group Map Count in MSCHAPAuthenticateUser is -1
CSWinAgent 07/13/2010 22:04:20 A 0190 15480 0x0 NTLIB: User has 10 groups
CSWinAgent 07/13/2010 22:04:20 A 0431 15480 0x0 RPC: NT_MSCHAPAuthenticateUser groups: None,LAN_Admins,Users,Administrators
CSWinAgent 07/13/2010 22:04:20 A 0436 15480 0x0 RPC: NT_MSCHAPAuthenticateUser Domain Name is: CSWinAgent_1
CSWinAgent 07/13/2010 22:04:20 A 0452 15480 0x0 RPC: Success
CSWinAgent 07/13/2010 22:04:20 A 0465 15480 0x0 RPC: NT_MSCHAPAuthenticateUser reply sent
*** service stopped manually:
CSWinAgent 07/13/2010 22:04:47 A 0046 14340 0x0 Service stopping
CSWinAgent 07/13/2010 22:04:47 A 0049 14340 0x0 Shutting down NT library
CSWinAgent 07/13/2010 22:04:47 A 0192 14340 0x0 NTLIB: Finalising locally
CSWinAgent 07/13/2010 22:04:47 A 0053 14340 0x0 Shutting down EndPoint library
CSWinAgent 07/13/2010 22:04:47 A 0609 15480 0x0 Client disconnected, thread 15480 terminating
CSWinAgent 07/13/2010 22:04:47 A 0153 15332 0x0 Listener terminating
CSWinAgent_2 (10.10.10.16):
*** manual shutdown:
CSWinAgent 07/13/2010 21:52:37 A 0046 1388 0x0 Service stopping
CSWinAgent 07/13/2010 21:52:37 A 0049 1388 0x0 Shutting down NT library
CSWinAgent 07/13/2010 21:52:37 A 0192 1388 0x0 NTLIB: Finalising locally
CSWinAgent 07/13/2010 21:52:37 A 0053 1388 0x0 Shutting down EndPoint library
CSWinAgent 07/13/2010 21:52:37 A 0609 3676 0x0 Client disconnected, thread 3676 terminating
CSWinAgent 07/13/2010 21:52:37 A 0609 0340 0x0 Client disconnected, thread 340 terminating
CSWinAgent 07/13/2010 21:52:37 A 0609 2900 0x0 Client disconnected, thread 2900 terminating
CSWinAgent 07/13/2010 21:52:37 A 0609 3404 0x0 Client disconnected, thread 3404 terminating
CSWinAgent 07/13/2010 21:52:37 A 0153 1944 0x0 Listener terminating
CSWinAgent 07/13/2010 21:52:37 A 0609 2072 0x0 Client disconnected, thread 2072 terminating
CSWinAgent 07/13/2010 21:52:37 A 0609 3576 0x0 Client disconnected, thread 3576 terminating
*** service started manually:
CSWinAgent 07/13/2010 22:09:48 A 0528 3504 0x0 Logging mode: LOW
CSWinAgent 07/13/2010 22:09:48 A 0228 3504 0x0 CSWinAgent server starting ==============================
CSWinAgent 07/13/2010 22:09:48 A 0233 3504 0x0 Running as console application.
CSWinAgent 07/13/2010 22:09:48 A 0059 3480 0x0 Will listen on port 2005
CSWinAgent 07/13/2010 22:09:48 A 0064 3480 0x0 Permitted CSWinAgent Clients: *.*.*.*
CSWinAgent 07/13/2010 22:09:48 A 0116 3480 0x0 NTLIB: Library behaviour mode 2
CSWinAgent 07/13/2010 22:09:48 A 0136 3480 0x0 NTLIB: Initialising locally
CSWinAgent 07/13/2010 22:09:48 A 0139 3480 0x0 NTLIB: The local computer name is CSWinAgent_2
CSWinAgent 07/13/2010 22:09:48 A 0171 3480 0x0 NTLIB: The insist on domain is disabled
CSWinAgent 07/13/2010 22:09:48 A 0281 3480 0x0 NTLIB: We are NOT a domain controller
CSWinAgent 07/13/2010 22:09:48 A 0423 3480 0x0 NTLIB: We are NOT a member of a domain => we cannot authenticate accounts on other trusted domains
CSWinAgent 07/13/2010 22:09:48 A 0112 3480 0x0 Listener activated
*** first authentication:
CSWinAgent 07/13/2010 22:10:42 A 0140 3480 0x0 Client connecting from 10.10.10.10:2782
CSWinAgent 07/13/2010 22:10:43 A 0390 2800 0x0 RPC: NT_MSCHAPAuthenticateUser received
CSWinAgent 07/13/2010 22:10:43 A 1807 2800 0x0 NTLIB: Got WorkStation ACS
CSWinAgent 07/13/2010 22:10:43 A 1808 2800 0x0 NTLIB: Attempting Windows authentication for user USER_ID
CSWinAgent 07/13/2010 22:10:43 A 1866 2800 0x0 NTLIB: Windows authentication SUCCESSFUL (by CSWinAgent_2)
CSWinAgent 07/13/2010 22:10:43 A 1947 2800 0x0 NTLIB: Domain name in MSCHAPAuthenticateUser is \LOCAL
CSWinAgent 07/13/2010 22:10:43 A 1952 2800 0x0 NTLIB: Group Mapping Flag in MSCHAPAuthenticateUser is enabled
CSWinAgent 07/13/2010 22:10:43 A 1968 2800 0x0 NTLIB: Group Map Count in MSCHAPAuthenticateUser is -1
CSWinAgent 07/13/2010 22:10:43 A 0190 2800 0x0 NTLIB: User has 10 groups
CSWinAgent 07/13/2010 22:10:43 A 0431 2800 0x0 RPC: NT_MSCHAPAuthenticateUser groups: None,LAN_Admins,Administrators,Users
CSWinAgent 07/13/2010 22:10:43 A 0436 2800 0x0 RPC: NT_MSCHAPAuthenticateUser Domain Name is: CSWinAgent_2
CSWinAgent 07/13/2010 22:10:43 A 0452 2800 0x0 RPC: Success
CSWinAgent 07/13/2010 22:10:43 A 0465 2800 0x0 RPC: NT_MSCHAPAuthenticateUser reply sent
*** some more logins:
CSWinAgent 07/13/2010 22:10:49 A 0140 3480 0x0 Client connecting from 10.10.10.10:2784
CSWinAgent 07/13/2010 22:10:49 A 0390 2296 0x0 RPC: NT_MSCHAPAuthenticateUser received
CSWinAgent 07/13/2010 22:10:49 A 1807 2296 0x0 NTLIB: Got WorkStation ACS
CSWinAgent 07/13/2010 22:10:49 A 1808 2296 0x0 NTLIB: Attempting Windows authentication for user USER_ID
CSWinAgent 07/13/2010 22:10:49 A 1866 2296 0x0 NTLIB: Windows authentication SUCCESSFUL (by CSWinAgent_2)
CSWinAgent 07/13/2010 22:10:49 A 1947 2296 0x0 NTLIB: Domain name in MSCHAPAuthenticateUser is \LOCAL
CSWinAgent 07/13/2010 22:10:49 A 1952 2296 0x0 NTLIB: Group Mapping Flag in MSCHAPAuthenticateUser is enabled
CSWinAgent 07/13/2010 22:10:49 A 1968 2296 0x0 NTLIB: Group Map Count in MSCHAPAuthenticateUser is -1
CSWinAgent 07/13/2010 22:10:49 A 0190 2296 0x0 NTLIB: User has 10 groups
CSWinAgent 07/13/2010 22:10:49 A 0431 2296 0x0 RPC: NT_MSCHAPAuthenticateUser groups: None,LAN_Admins,Administrators,Users
CSWinAgent 07/13/2010 22:10:49 A 0436 2296 0x0 RPC: NT_MSCHAPAuthenticateUser Domain Name is: CSWinAgent_2
CSWinAgent 07/13/2010 22:10:49 A 0452 2296 0x0 RPC: Success
CSWinAgent 07/13/2010 22:10:49 A 0465 2296 0x0 RPC: NT_MSCHAPAuthenticateUser reply sent
CSWinAgent 07/13/2010 22:10:52 A 0140 3480 0x0 Client connecting from 10.10.10.10:2786
CSWinAgent 07/13/2010 22:10:52 A 0390 1768 0x0 RPC: NT_MSCHAPAuthenticateUser received
CSWinAgent 07/13/2010 22:10:52 A 1807 1768 0x0 NTLIB: Got WorkStation ACS
CSWinAgent 07/13/2010 22:10:52 A 1808 1768 0x0 NTLIB: Attempting Windows authentication for user USER_ID
CSWinAgent 07/13/2010 22:10:52 A 1866 1768 0x0 NTLIB: Windows authentication SUCCESSFUL (by CSWinAgent_2)
CSWinAgent 07/13/2010 22:10:52 A 1947 1768 0x0 NTLIB: Domain name in MSCHAPAuthenticateUser is \LOCAL
CSWinAgent 07/13/2010 22:10:52 A 1952 1768 0x0 NTLIB: Group Mapping Flag in MSCHAPAuthenticateUser is enabled
CSWinAgent 07/13/2010 22:10:52 A 1968 1768 0x0 NTLIB: Group Map Count in MSCHAPAuthenticateUser is -1
CSWinAgent 07/13/2010 22:10:52 A 0190 1768 0x0 NTLIB: User has 10 groups
CSWinAgent 07/13/2010 22:10:52 A 0431 1768 0x0 RPC: NT_MSCHAPAuthenticateUser groups: None,LAN_Admins,Administrators,Users
CSWinAgent 07/13/2010 22:10:52 A 0436 1768 0x0 RPC: NT_MSCHAPAuthenticateUser Domain Name is: CSWinAgent_2
CSWinAgent 07/13/2010 22:10:52 A 0452 1768 0x0 RPC: Success
CSWinAgent 07/13/2010 22:10:52 A 0465 1768 0x0 RPC: NT_MSCHAPAuthenticateUser reply sent

Similar Messages

Windows Remote Agent upgrade 4.0 to 4.1

I have upgraded my Cisco ACS 1113 Engines from 4.0 to 4.1 using an ACS Recovery CD provided by Cisco TAC. I am now in the process of uninstalling the 4.0 remote agent and installing the remote agent on the 4.1 Recovery CD.
During installation of the Remote Agent the version indicates v1 which is the same as the 4.0 version.
Is there any difference in the remote agents for 4.0 and 4.1?
Do I need to download the 4.1 Remote agent separately?
This is the version of the ACS
Cisco Secure ACS 4.1.1.23
Appliance Management Software 4.1.1.23
Appliance Base Image 4.1.1.4
CSA build 4.0.1.543.2 (Patch: 4_0_1_543)

Hi,
Please ignore that ver 1 that we get during installation.
Go ahead and install the 4.1 remote agent and check it ver from DOS ,
On RA computer go to dos and change prompt to
C:\Program Files\Cisco\CiscoSecure ACS Agent\bin
Type csagent.exe -v and press Enter
It will show you the actual ver of remote agent.
Regards,
~JG
Please rate if that helps

More than one Windows ACS Remote Agent

We recently added a second Windows Remote Agent to have Windows authentication service available for our two ACS.
Agent definition (CSAgent.ini) is correct but in Network Configration - Remote Agent (on each ACS web console) we see that the second Remote Agent is "available" but "not in use" (while the first one is, of course).
If we stop the CSAgent Service on the first Remote Agent server, we do not see any activity on the second one (auth not working) and service still remains "avilable" but "not in use".
Then, debugging with csagent.exe -z -p all we can see is something like:
Debug printing on..
Logging mode: LOW
ACSRemoteAgent server starting ==============================
Running as console application.
Will listen on port 2004
Configuration will be fetched from 10.1.1.101:2003
Agents: CSWinAgent
CSWinAgent File: ..\bin\CSWinAgent.exe
CSWinAgent Port: 2005
1 agents configured
Permitted CSAgent Clients: 10.1.9.10-11
Hit Return/Enter to stop...
Listener activated
Watchdog activated
CSWinAgent launched
Client connecting from 10.1.9.10:4346
RPC: Info request received
RPC: Info reply sent
Client disconnected, thread 944 terminating
Client connecting from 10.1.9.10:4347
RPC: Info request received
RPC: Info reply sent
Client disconnected, thread 2108 terminating
Client connecting from 10.1.9.10:4348
and, in the CSWinAgent log windows we see NO logs at all....
Where are we wrong???

You must use ACS Remote Agent for Windows, version 4.0, with ACS Solution Engine, version 4.0. Other releases of Cisco Secure ACS are not supported.
The following URL may help you:
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_solution_engine/4.0/installation/guide/remote_agent/rawi.html#wp300510

Remote Agent for ACS for Windows 2008 R2 64-bit

Hi,
We having difficulties with installing remote agent on windows 2008 R2 64-bit server and got the attached error.
Our ACS is 4.2.0.124 and remote agents we tried are :Remote-Agent-ACSse-win-v4.2.1.15-K9.zip and Acs-4.2.1.15.9-RA.zip.
I see following urls says it does not support Windows 2008 R2 and also 64-bit Windows,
https://supportforums.cisco.com/message/3135061#3135061
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_solution_engine/4.2/installation/guide/remote_agent/rawi.html#wp289019
However following url says its support 2008 R2 with 64-bit version
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2.1/Release_Notes/acs421_rn.html
Appreciate if someone can adivse us what vesion (file name) of Remote Agent can support (or working) for Windows 2008 R2 64-bit.
thanks in advance

Hi Tarik,
What I wanted to say that the below url says that ACS 4.2 does not support on 64-bit OS:
ACS Requirements
You must use ACS Remote Agent for Windows, version 4.2, with ACS SE, version 4.2. We do not support other Cisco Secure ACS releases.
Note ACS Remote Agent 4.2 for Windows does not support 64-bit operating systems.
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_solution_engine/4.2/installation/guide/remote_agent/rawi.html#wp289019
However could you please let me know what exact Remote Agent file you recommend to use for windwos 2008 R2 64-bit Server. The ACS SE version that I have is 4.2.0.124.
Thanks

ACS appliance 3.2.2.5 Remote Agents for Windows DB disappear

I have two ACS boxes: one is ACSNT and the other an ACS appliance. Both run 3.2.2.5 and have been in production for quite some time. The ACSNT box is the primary and replicates to the appliance as backup. These units authenticate to three different Windows domains: 2 NT domains and 1 AD.
Recently I just added support for RSA 6.0 servers. Not wanting to mess with the client install on the ACSNT box, I set it up as a RADIUS token server as you do on the appliance. It works just fine on the ACSNT box. On the appliance, however, my Windows external DB quit working with "external db not operational" messages. I rebuilt the Windows external DB, recreated the group mappings, added the remote agents, etc. Things were working fine. I recreated the RSA config and still the Windows DB was working although the RSA config was not working (still working on that if TAC ever calls me back). A few hours later, I decided to check the Windows DB and it was broken again. I checked it out and the remote agents were somehow deleted. Nothing in the logs show it but they were gone. I recreated them and it worked again. This has happened twice now. Does anybody have any advice? The logs show nothing to indicate a problem on the appliance exists and of course the docs state that there should be no problem with both a RADIUS and Windows DBs living together on the same box. All comments welcome!
Thanks,
Rik

Sorry it took so long to get back...I've been out of the office for a few days.
I did check the the docs for issues like this but found nothing. The TAC Engineer escalated it and both engineers kept saying my new RSA servers were causing my issues. However, a simple reboot of the box (it is built on Win2K after all...) cleared up all of the strange issues.
Thanks,
Rik Guyler

Test ACS SE / Remote Agents

We are deploying two new ACS SE's using RA's talking to AD. These will be used for PEAP authentication of wireless users. I was wondering if there is an easy way to test user authentication so that I can verify the Remote Agent is talking properly to our AD (RA is not running on a domain controller)? Our test wireless lan controller is being used for other testing, and I don't want to add the ACS to our production controllers at this point. Basically, I have the ACS SE, the server on which the RA is running, and a workstation that I can use for testing. Any help would be greatly appreciated...

If you can fetch all AD groups that means RA is able to communicate with DC.
ACS-->External user db--> Database group mapping--->Windows--->New Configuration--->Highlight your domain name and submit---->Now click on your domain name and ADD Mapping.
If you see all group that means you are all set.
Also make sure your remote agent status should say Available and Used by ACS.
ACS--->Network configuration--->Remote agent.
Regards,
~JG
Do rate helpful posts

ACS 4.2 Remote Agent on Server 2008 R2

Hi,
We are migrating our domain controllers from 2003 to 2008 R2 and would like to know if the remote agents are compatible to run on 2008 R2. I've seen release notes that the RA's have been tested on 2008 SP1 but not R2.
Can anyone advise and/or confirm that the RA's are supported on 2008 R2?
We are currently running Solution Engine 4.2.1.15 as well as the 4.2.1.15-1 fix. RA's are the same version.
Thanks in advance for your help.

Well, this is a known enhancement bug:
CSCta35271 Support for Windows server 2008 R2
Acs 4.2.x doesn't support all newer versions of Windows 2008. It only supports the below listed version. You can also check the release notes.
Supported Operating Systems section
--Windows Server 2008, Standard Edition
--Windows Server 2008, Enterprise Edition
--Japanese Windows Server 2008, Standard Edition, Service Pack 2
--Japanese Windows Server 2008, Enterprise Edition, Service Pack 2
This bug might get fixed in upcoming Release\patches. This is in the pipeline/roadmap and the development team is working on it
Regds,
JK
Do rate helpful posts-

ACS 4.2 Remote agent compatibility issues.

I have been doing a bit of reading on the ACS 4.2 remote agent compatibility with Windows 2008 R2, and it seems like the only way out is to upgrade the ACS to 5.2. We have Cisco ACS 4.2 SE and I would want someone to confirm that what if I install the Remote agent on a Windows 2003 member server instead of the 2008 R2 DC. Will such a scenario work?
Feedback is appreciated.
Regards

Yes, here is this one which has a bug documented with this information CSCtg37183 :
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtg37183
Extracted from previous link:
ACS 4.x doesn't support 2008 R2 Server for AD.
Symptom:
ACS 4.x does not support authentication to a backend 2008 R2 Active Directory server.
Conditions:
ACS 4.x
Windows Server 2008 R2 installed on Domain Controller
ACS or remote agent installed on any member server in the environment (even if the server is 2003/2008)
Workaround:
Install the ACS or Remote Agent on a 2003/2008 domain controller
Cisco doesn't support this scenario because sometimes work fine other doesn't work at all, so nobody wants an unstable network right, unfortunately the workaround doesn't help much. Although there is an ACS 5.2 trial version that you can test, let me know so I can get you the links.

ACS 4.2 Remote agent with WIN server 2008 core Enterprise 64-bit

I need help to clarify if Cisco ACS 4.2 does support remote agent on Win server 2008 core enterprise 64-bit?? if not supported; is there any work-around solution for this?

Hi,
As per the release notes it does support.
Windows 64-bit Support for Remote Agent:-
ACS 4.2.1 Remote Agent is supported on the following Windows 64-bit OS:
•Windows Server 2008, Standard Edition with Service Pack 2
•Windows Server 2008, Enterprise Edition with Service Pack 2
•Windows Server 2003, R2, Standard Edition with Service Pack 2
•Windows Server 2003, R2, Enterprise Edition with Service Pack 2
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2.1/Release_Notes/acs421_rn.html#wp1050574
thanks,
Vinay

Is it posible? two ACS 4.2 Appliance with the same remote agent

Hello,
I have a ACS 4.2 Appliance integrate with Active Directory, CA and Remote Agent, i want to agregate another ACS 4.2 Appliance with the same configuration, the same Active Directory, CA. my question is: can i configure the another ACS with the same Remote Agent of the first? in other words ...
i attach the diagram.
Thank you

I have a
ACS 4.2 Appliance integrate with Active Directory, CA and Remote Agent,
i want to agregate another ACS 4.2 Appliance with the same
configuration, the same Active Directory, CA. my question is: can i
configure the another ACS with the same Remote Agent of the first? in
other words ...i attach the diagram.Thank you
Hi,
Maximum number of appliances supported—While a single Cisco Secure ACS Remote Agent can provide services to many Cisco Secure ACS Appliances, support is limited to five concurrent connections by the appliances served. For example, if you have three appliances that are primary Cisco Secure ACSes and three appliances that are secondary Cisco Secure ACSes used for failover purposes only, the remote agent can provide services to all six appliances and stay below the maximum of five concurrent connections.
http://www.cisco.com/en/US/products/sw/secursw/ps5338/products_installation_and_configuration_guide_chapter09186a0080193aa1.html
Hope to Help !!
Ganesh.H
Remember to rate the helpful post

ACS appliance and remote agent testing

Having problems with integrating ACS appliance with Active Directory. Have installed the remote agent on a member server and from the ACS appliance can enumerate the Active Directory groups correctly so there is at least some communication happening.
Looking at the remote agent logs whenever a request for the AD groups comes through you see corresponding log entrys. When a user tries to authenticate though there are no logs coming through to the remote agent. So maybe it is not being sent to remote agent?
In the failed authentications log on the ACS the error is unknown user, it does show the correct username + domain as the person trying to authenticate.
The Windows server is setup for unknown user policy.
ACS version is 4.1.1.23, Remote Agent is latest version available.
Any ideas or things to check?

Hi,
As per your last line, It seems that ACS and RA ver are not same. Please note that ACS appliance and RA software ver has to be same else it won't work.
Regards,
~JG

ACS Appliance Remote Agent Problem

Hi there
we have te following situation:
- 2 x ACS SE's
- 2 x ACS Remote Agents on Member Servers
- 2 x ASA's
We would like to authenticate the VPN users connecting to the ASA's via the ACS and the active directory.
I configured the remote agent following this link:
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_solution_engine/3.3/installation/guide/remote_agent/rawi.html#wp289426
But we are not able to fetch the active directory groups in the acs gui --> External User Database > Database Group Mappings > Active Directory > New Configuration.
On the Domain Controller we get the errors ID 1030 and 1058, had someone these problemes too?
Thanks in advance and regards
Dominic

Hi JG
We have MS Windows Server 2003 with SP2. At the begining, the service was running as a local admin, then we had access to the AD, but we had some strange issues: after a short time (~1 Day) of zero authentication requests, the first request used about 2 minutes to get back to the ACS.
We debugged the way from the ACS to the remote agent, it must have been on the server it self.
Regards
Dominic

SCOM Windows agent failover

Hi experts,
I need some clarification on resource pool.
If i configure 500 agents on to one management server1 and keeping another management server2 for HA. If i create a resource pool and add both MS1 and MS2. Does all 500 agent failover to MS2 if MS1 fails. please clarify
Regards, Pratap

Hi
Windows agents do not use resource pools.
When you push deploy a windows agent from the console, you set its primary management server and it automatically knows of all the other management servers and can fail over to any of them. You can set, via powershell, which MS agents can \ cannot failover
to but not in the console for push agents.
Cheers
Graham
Regards Graham New System Center 2012 Blog! -
http://www.systemcentersolutions.co.uk
View OpsMgr tips and tricks at
http://systemcentersolutions.wordpress.com/

Monitoring Microsoft Windows 2008 Active Directory by a remoted Agent

Oracle documentation (E14542-01) said that for remote Agent monitoring with default settings, Grid Control can monitor only the Active Directory associated with the primary domain controller.
But for Microsoft Windows 2008 Active Directory primary domain doesn't exist anymore, can we use a remote Agent to monitor Microsoft Windows 2008 Active Directory ?
Thanks
Dominik

Dominik wrote:
Oracle documentation (E14542-01) said that for remote Agent monitoring with default settings, Grid Control can monitor only the Active Directory associated with the primary domain controller.
But for Microsoft Windows 2008 Active Directory primary domain doesn't exist anymore, can we use a remote Agent to monitor Microsoft Windows 2008 Active Directory ?I think , you can monitor it . Please check :
Oracle Enterprise Manager Grid Control Certification Checker [ID 412431.1]
How to Install the Microsoft Active Directory Plugin for Grid Control R2 [ID 359621.1]
Regards
Rajesh

ACS 3.3 Appliance Remote Agents

Hi,
Can I configure Cisco ACS Appliance 3.3 to send logs to different remote agents which are not Cisco, for example Envision appliance.
Regards,
Ejaz

No, because the protocol used between ACS and the RA is proprietary.

Windows Remote Agent Failover timeout (ACS 4.2)

Similar Messages

Maybe you are looking for