topic Re: ACS 5.4 AD Integration Allows All Users in Network Access Control

ACS 5.4 AD Integration Allows All Users

matt.nasi — Mon, 11 Mar 2019 03:48:12 GMT

Hello,

I've been struggling to find out why our ACS deployment allows everyone within AD to login to our devices. They are not able to do anything because of the command authorization but I don't understand why EVERYONE is allowed in when I specified a specific group to only be allowed access. That group is allowed full access which is fine but it still bothers me that anyone on our domain can just log in period.

Any thoughts? Thanks.

Matt

ACS 5.4 AD Integration Allows All Users

Julio Carvajal — Thu, 22 Aug 2013 03:59:50 GMT

Hello Matt,

Just by specifying a group in a policy does not mean that the rest of users on different groups will get denied.

Make sure that the default action for that policy (I mean if you do not match the previously configured rule) is drop (Then it should work as you want)

Check my blog at http:laguiadelnetworking.com and subscribe so you can get daily information about networking.

Cheers,

Julio Carvajal Segura

Re: ACS 5.4 AD Integration Allows All Users

Tarik Admani — Thu, 22 Aug 2013 06:28:48 GMT

Much like the previous user said, you will need to check your default policy is set to deny.

Sent from Cisco Technical Support iPad App

Re: ACS 5.4 AD Integration Allows All Users

Julio Carvajal — Sun, 25 Aug 2013 19:09:38 GMT

Do you still have any questions??

Otherwise mark the question as answered

For more information about Core and Security Networking follow my website at http://laguiadelnetworking.

Any question contact me at jcarvaja@laguiadelnetworking.com

Cheers,

Julio Carvajal Segura

Re: ACS 5.4 AD Integration Allows All Users

matt.nasi — Mon, 26 Aug 2013 16:22:09 GMT

Identity was already set to drop, the way to fix my issue actually was to CREATE a deny policy under authorization.

Re: ACS 5.4 AD Integration Allows All Users

blenka — Wed, 28 Aug 2013 18:56:16 GMT

The IP addresses and subnet masks that are associated with the network device. Select to enter a single IP address or to define a range.

for the steps to get the job done please go through the link below:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.4/user/guide/net_resources.html#wp1060126