topic Authentication Problem in ACS in Network Access Control

Authentication Problem in ACS

hirenparekh12 — Mon, 11 Mar 2019 02:53:02 GMT

Hi,

i have created two ssid on WLC & authentication Via ACS to AD. after that i have configure TACACS+ on same ACS Server but some of the users can login in Wi-Fi which are not in member of Wi-Fi group.

Please find the below ACS configuration.

Group 1 >>>> HIgh managemnet Users " this user can login in SSID 1"

Group 3 >>>> Corporate User "this users can login in SSID 2"

In group configuration i have configure DNIS/CLI based configuration.

AAA client select

Port *

CLI *

DNIS *SSID1

same configuration for SSID 2

after that i have creat two more group for TACACS + for Device authentication (Shell command based) (Authentication through AD)

Group 5 >>>> Full Access

Group 6 >>>> Read Only Access.

but now what ever user are in group 5 & 6 those are login in Wifi.

how to stop them?

Authentication Problem in ACS

Tarik Admani — Fri, 14 Dec 2012 04:51:47 GMT

Hi,

In your authorization rules is the default rule set to Permit? If so please set it to Deny, when ACS is configured brand new the default policies are always set to permit.

If that is not the case please post screenshots of your policies, and also of the authentication report of the user that was allowed access.

Hope that helps.

Tarik Admani
*Please rate helpful posts*

Re: Authentication Problem in ACS

hirenparekh12 — Sun, 30 Dec 2012 09:10:28 GMT

I have configure above setting for SSID 1 in Group 1 & MAP security group (with AD) with Group 1 in external Database.

I have configure above setting for SSID 2 in Group 3 & MAP security group (with AD) with Group 3 in external Database.

till the time user maped in Group 3 is not login in group1 SSID.

after that i have configure TACACS + on same server with

Group 5 >>>> Full Access ( Shell command authorization Set)

Group 6 >>>> Read Only Access.( Shell command authorization Set)

Exp. hparekh is member of Group 6 & Group 3 but now it is login in Group 1 SSID.

Please find the External database setting