topic Re: Prime and ACS View Server Integration in Network Access Control

Prime and ACS View Server Integration

Ben Meagher — Mon, 11 Mar 2019 03:24:36 GMT

Can anyone point me in the right direction for a good doc on implenting Prime (1.3) with an ACS View Server (5.1)?

Prime and ACS View Server Integration

Jatin Katyal — Wed, 08 May 2013 19:51:26 GMT

The configuration on the Prime Infrastructure side is minimal: define the authentication server Prime is to use and select a mode for Prime Infrastructure to use with it.

Administration > AAA > TACACS+ Servers > add tacacs server.

Administration > AAA > AAA Mode Settings > tacacs+ and enable fallback to local.

The bulk of the configuration is on the authentication server side, particularly indefining groups, services and authorization tasks. This is covered in the "Performing Administrative Tasks" chapter of the Prime Infrastructure Configuration Guide, starting with the topic "Configuring ACS 5.x"

http://www.cisco.com/en/US/docs/wireless/prime_infrastructure/1.3/configuration/guide/admin.html#wp1595935

Jatin Katyal

- Do rate helpful posts -

Re: Prime and ACS View Server Integration

minkumar — Wed, 08 May 2013 19:52:42 GMT

Hey Ben,

Is it ACS view server 5.1 or Acess control system 5.1 (ACS 5.1)?

If its ACS 5.1, you can follow the below link:

https://supportforums.cisco.com/docs/DOC-32603

Regards

Minakshi (Rate it if its helpful )

Prime and ACS View Server Integration

Jatin Katyal — Wed, 08 May 2013 19:54:28 GMT

Keep in mind that you have the below listed attribute added in the policy elements > shell profiles > customer attribute

virtual-domain0 mandatory ROOT

Please post any error you may see while working on it.

Jatin Katyal

- Do rate helpful posts -

Prime and ACS View Server Integration

Ben Meagher — Thu, 09 May 2013 00:41:12 GMT

My apologies, I should have been more precise. I already have tacacs running for user authC with all the attributes and vd parameters. I am trying to leverage the ACS View Server feature that is available within Prime under the Users and Clients troubleshooting section. I have tried setting the External Server to both the ACS primary and the dedicated logging server with no luck. I tried verifying on the ACS server that Prime (also a NAD in ACS) was indeed creating any logs against ACS as admin logins but did not see any... With ACS View now running native since 5.1 is there any additional config within ACS that is necessary?

Re: Prime and ACS View Server Integration

minkumar — Thu, 09 May 2013 21:58:26 GMT

Hi Ben,

May be i am not able to udnerstand your question properly, Could you please share some screen shots for better understanding as in what exactly are you trying to achieve for better understanding.

Regards

Minakshi (Do rate the helpful posts )

Prime and ACS View Server Integration

harvisin — Fri, 10 May 2013 02:34:55 GMT

Hello,

I went throuh your query and found certain steps which may help you out in solving your query.

Configuring ACS View Servers

To facilitate communication between Prime Infrastructure and the ACS View Server and to access the ACS View Server tab, you must add a view server with credentials.

Note Prime Infrastructure only supports ACS View Server 5.1 or later.

To configure the ACS View Server Credentials, follow these steps:

Step 1 Choose Design > External Management > ACS View Servers.

Step 2 Enter the port number of the ACS View Server you are adding. (Some ACS View Servers do not allow you to change the port on which HTTPS runs.)

Step 3 Enter the password that was established on the ACS View Server. Confirm the password.

Step 4 Specify the time in seconds after which the authentication request times out and a retransmission is attempted by the controller.

Step 5 Specify the number of retries to be attempted.

Step 6 Click Save.

Configuring TFTP or FTP Servers

Step 1 Choose Design > External Management > TFTP/FTP Servers.

Step 2 From the Select a command drop-down list, choose Add TFTP/FTP Server.

Step 3 From the Server Type drop-down list, choose TFTP, FTP, or Both.

Step 4 Enter a TFTP/FTP server name. This is a user-defined name for the server.

Step 5 Enter the IP address of the TFTP/FTP server.

Step 6 Click Save.

Next Steps

Now that you have completed the basic setup steps, you might want to do the following tasks:

Table 2-3 Next Steps after Completing Setup Tasks
Task	GUI Path	Documentation Reference
Set up additional users	Administration > Users, Roles & AAA, then click Users	Controlling User Access
Add additional virtual domains	Administration > Virtual Domains	Setting Up Virtual Domains
Refine your sites	Design > Site Map Design	Designing Sites
Create additional port groups and change existing port groups	Design > Port Grouping	Changing Port Groups
Start monitoring and responding to alarms	Operate > Alarms & Events	Monitoring Alarms

Prime and ACS View Server Integration

Ben Meagher — Mon, 13 May 2013 14:14:35 GMT

I have already completed the initial configuration steps, my original question, is there anything additional needed to configure on the ACS server for this feature? Any additional config or enablements?

Prime and ACS View Server Integration

David Jaoui — Fri, 14 Jun 2013 01:04:48 GMT

any chance you figured this one out? the documentation kinda sucks on this topic...

Prime and ACS View Server Integration

Ben Meagher — Fri, 14 Jun 2013 12:10:34 GMT

Havent been able to make it a priority lately...

Re: Prime and ACS View Server Integration

David Jaoui — Fri, 14 Jun 2013 17:14:16 GMT

Yea I know what you mean ... If I have a chance I'll try to bug TAC about it

Sent from Cisco Technical Support iPhone App

Re: Prime and ACS View Server Integration

Jatin Katyal — Sun, 16 Jun 2013 12:46:03 GMT

Guys: I was doing little research on this topic and just wanted to add that there is not much config we have to perform on ths ACS.

All you need to have this command on ACS via CLI "acs config-web-interface view enable"

On the Prime, we already have ACS view server ip and port information. In addition to that we have to integrate Prime with ACS using a super admin privilige account. By-default acsadmin has super admin rights so we can use it on the prime side or you can create a specific account on ACS and assign super admin rights under system administrator > administrators > accounts > create new account.

Once done, please try to pull the logs from NCS and let me know how it goes.

Jatin Katyal
- Do rate helpful posts -

Re: Prime and ACS View Server Integration

David Jaoui — Mon, 17 Jun 2013 20:15:19 GMT

Hey Jatin,

That missing command was the issue!

It would be nice if the PI documentation referenced that...

Thanks!

-David

Re: Prime and ACS View Server Integration

Jatin Katyal — Mon, 17 Jun 2013 20:25:25 GMT

huh...thanks david for updating this thread. I'll surely create a doc on this soon and post it here.

In case you are all set, would appreciate if you can mark this long going thread stands resolved.

Jatin Katyal
- Do rate helpful posts -

Re: Prime and ACS View Server Integration

Jatin Katyal — Tue, 18 Jun 2013 09:12:13 GMT

I was able to create a small doc on this issue.

https://supportforums.cisco.com/docs/DOC-34210

Jatin Katyal

- Do rate helpful posts -

Re: Prime and ACS View Server Integration

Andrew MacTaggart — Fri, 02 Aug 2013 00:04:11 GMT

It looks straight forward, but I have not been able to get this to actually show any results in the troubleshooting section for clients.

Are you using the self-signed cerificates on the acs and the ncs?

Have you tried to get this working with an certificates signed by any internal CA or a wild cert?

These are the NCS error logs

05/20/13 12:00:06.210 ERROR [system] [http-443-12] [ACSViewServerAction] Max number of retries reached for connecting to 10.x.x.x at port 443

05/20/13 12:00:06.211 ERROR [system] [http-443-12] THROW

javax.xml.ws.WebServiceException: Failed to access the WSDL at: https://10.x.x.x:443/ACSViewWebServices/ACSViewWebServices?wsdl. It failed with:

https://10.x.x.x:443/ACSViewWebServices/ACSViewWebServices?wsdl.

at com.sun.xml.ws.wsdl.parser.RuntimeWSDLParser.tryWithMex(RuntimeWSDLParser.java:162)

at com.sun.xml.ws.wsdl.parser.RuntimeWSDLParser.parse(RuntimeWSDLParser.java:144)

----------------------------------------------------------------------------------------------

at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)

at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)

at java.lang.Thread.run(Unknown Source)

Caused by: java.io.FileNotFoundException: https://10.x.x.x:443/ACSViewWebServices/ACSViewWebServices?wsdl

at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)

at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(Unknown Source)

at com.sun.xml.ws.wsdl.parser.RuntimeWSDLParser.parse(RuntimeWSDLParser.java:129)

... 76 more

05/20/13 12:00:06.216 ERROR [system] [http-443-12] [ACSViewServerAction] Unable to connect to any ACS View Server.

Cheers