topic login limit through Cisco ACS 5.0 in Network Access Control

login limit through Cisco ACS 5.0

Avijit Chowdhury — Mon, 11 Mar 2019 03:29:41 GMT

Hi all ,

Few days ago in my wireless infrastrucer i deploy Cisco ACS 5.0 with Active directory integration. My wireless users are login through web authentication process. The authentication process is passed by AD & its working fine. But i want to do a work on my ACS 5.0 that a user cannot login simultaneously multiple device at a time.

login limit through Cisco ACS 5.0

Jatin Katyal — Sun, 02 Jun 2013 07:48:45 GMT

Hello Avijit,

"max sessions" featre was introduced acs 5.3.

Maximum User Sessions

For optimal performance, you can limit the number of concurrent users accessing the network resources. ACS 5.3 imposes limits on the number of concurrent service sessions per user.

The limits are set in several different ways. You can set the limits at user level or at group level. Depending upon the maximum user session configurations, the session count is applied on the user.

IMPORTANT: To make the maximum sessions work for the user access, the administrator should configure the RADIUS accounting.

You may go through the below listed link for more info:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.3/user/guide/access_policies.html#wp1176806

The code you're running at this moment ACS 5.0 is not recommended for a production environment. You need to upgrade ACS to avail the max session feature.

Jatin Katyal
- Do rate helpful posts -

login limit through Cisco ACS 5.0

Avijit Chowdhury — Sun, 02 Jun 2013 08:25:23 GMT

Thanks Jatin ,

I know these feature are avilabe on ACS 5.3 ........... thats why i put this problem on these forum ... Do you have the upadate patch of ACS 5.3 .. So if i summerise the whole discussion with out updatating the ACS i am not able to do my task.. right ..

Thanks

login limit through Cisco ACS 5.0

Jatin Katyal — Sun, 02 Jun 2013 08:38:29 GMT

Go with patch 8. I found it very stable on ACS 5.3 code.

Download the below listed patch from

http://software.cisco.com/download/release.html?mdfid=283883841&flowid=34705&softwareid=282766937&release=5.3.0.40&relind=AVAILABLE&rellifecycle=&reltype=latest

ACS 5.3.0.40.8 cumulative patch

5-3-0-40-8.tar.gpg

Jatin Katyal
- Do rate helpful posts -

login limit through Cisco ACS 5.0

Avijit Chowdhury — Sun, 02 Jun 2013 08:50:52 GMT

Thanks Jatin ,

But my service contract with cisco was expier........... . I have to renew it ... nothing can do at this time ...

Thanks

login limit through Cisco ACS 5.0

Jatin Katyal — Sun, 02 Jun 2013 08:54:49 GMT

That's a concern. Either renew the contract or Contact your accounts team to get this image and patch for this time.

Jatin Katyal
- Do rate helpful posts -

login limit through Cisco ACS 5.0

Avijit Chowdhury — Sun, 02 Jun 2013 09:02:42 GMT

Thansks Jatin ,

For your positive reply if you dont mind can you help me on this issue ... to getting this patch for this time..

Thanks

Avijit

login limit through Cisco ACS 5.0

Jatin Katyal — Sun, 02 Jun 2013 09:09:32 GMT

Hi Avijit,

Unfortunately, I cannot get that patch for you. As it needs a valid contract with cisco. With every single publish for cisco softwares, there is a team who entitles the support for a customer. Even TAC might not be able to do that unless you are hitting some defect and its impacting or degrading the network. I can only suggest you to open a TAC case or contact your accounts team.

You may google it to see if someone has uploaded sometime in past.

Sorry, couldn't help you much on this matter.

Jatin Katyal
- Do rate helpful posts -

login limit through Cisco ACS 5.0

Avijit Chowdhury — Sun, 02 Jun 2013 09:12:20 GMT

Thanks Jatin ,

Thanks a lot............. for your suggestion

Avijit

Re: login limit through Cisco ACS 5.0

Jatin Katyal — Sun, 02 Jun 2013 09:18:03 GMT

Your Welcome Avijit. Have a good one.

Jatin Katyal
- Do rate helpful posts -

login limit through Cisco ACS 5.0

Avijit Chowdhury — Mon, 03 Jun 2013 05:13:17 GMT

hello jatin ,

I am facing another issue.. like after join my WLC with AAA ...my users are authenticate their account through AD ...... but suddenly i saw that. My Wireless controller root user name & password is not working....... so i did not write anything .... Can u give me a suggestion how i would be able to access my root permission.........

Thanks

Avijit

login limit through Cisco ACS 5.0

Jatin Katyal — Mon, 03 Jun 2013 09:24:26 GMT

When you say root user, do you mean tacacs account for accessing GUI (Web Access) of WLC? If yes what error are you getting on WLC?

Have you added an attribute role1=ALL on the ACS under the policy elements > custom attributes?

Jatin Katyal
- Do rate helpful posts -

login limit through Cisco ACS 5.0

Avijit Chowdhury — Mon, 03 Jun 2013 09:38:36 GMT

WLC says you have no privilized to write.. any thing because WLC root users is not working. Using AD user name & password i can login WLC GUI Mode... but not write permission are avilable,,,,,,,,,,,

Thanks

Avijit

login limit through Cisco ACS 5.0

Jatin Katyal — Mon, 03 Jun 2013 09:54:47 GMT

What protocol are you using for accessing WLC GUI (tacacs or radius)? As per the screen shots, it seems radius. Please confirm.

Where is the root user located? ACS or WLC?

Jatin Katyal
- Do rate helpful posts -

login limit through Cisco ACS 5.0

Avijit Chowdhury — Mon, 03 Jun 2013 10:00:04 GMT

I am using Raduis ... its located on WLC.. when i join this WLC on ACS wlc root users is not working..

Thanks

Avijit

login limit through Cisco ACS 5.0

Jatin Katyal — Mon, 03 Jun 2013 10:11:01 GMT

Hi Avijit,

If you go through the below listed document, you will see that how we can configure priority for management user to authenticate against a specific method.

From this page you can specify the order of authentication. Here is an example.

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a0080782507.shtml#wlcmanagement

If LOCAL is selected as second priority, then the user will be authenticated using this method only if the method defined as the first priority (RADIUS/ TACACS) is unreachable.

Since in your case radius server is up and running so it will always check the radius database and get failed with an error message " user not found "because root user is not defined on the radius server. It act as a fallback that means in case your radius server is down in that case you should not be locked out and can use the root user for a back door entry.

Jatin Katyal
- Do rate helpful posts -

login limit through Cisco ACS 5.0

Avijit Chowdhury — Mon, 03 Jun 2013 10:20:29 GMT

I agree with your comments ....... so what will happen when radius is UP i am not able to write some thing ... after disconnect then i can write......... so your suggestion is first i have authenticate local then radius right............ so due to this process is that login process is going lengthy for AD users ?

login limit through Cisco ACS 5.0

Jatin Katyal — Mon, 03 Jun 2013 10:44:28 GMT

Keep the stuff as it is. Just give read-write privileges to radius account so that you can use that account for making changes.

All you need to do set radius-ietf attribute

Service-type = Administrative --- for Full access

Service-type= Nas-Prompt ----- Read only access.

Hope it helps.

Jatin Katyal
- Do rate helpful posts -

login limit through Cisco ACS 5.0

Avijit Chowdhury — Mon, 03 Jun 2013 11:00:02 GMT

Well it works but can you tell me if i want to give the administrative facility to one specific user what should i do ?

Re:login limit through Cisco ACS 5.0

Jatin Katyal — Mon, 03 Jun 2013 11:15:15 GMT

In acs under access-policies click on the radius policy ...click on customize tab at the bottom right corner ...select the attribute username ...click ok. edit the authorization rule ....use the username attribute equals to save changes.

Enjoy 🙂

Jatin
*Do rate helpful posts*

Sent from Cisco Technical Support Android App