topic Unable to access NAC using http in Network Access Control

Unable to access NAC using http

Vinayaka Raman — Mon, 11 Mar 2019 02:22:00 GMT

Some how there is an access restitction to my NAC box thorugh http. I can access this box via ssh. Please suggest me how do i configure the device using ssh for http accesss.

https://10.48.252.65/admin

the error message when i access through http is Access not allowed from your IP address [100.9.254.27]

Unable to access NAC using http

Tarik Admani — Tue, 31 Jul 2012 16:57:44 GMT

Looks like someone may have turned on IP Access Restriction on your device. What you can try to do is see if you can remote into a server that is on the same subnet as the manager and see if you can either add or turn this feature off.

http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/49/cam/m_admin.html#wp1274044

Thanks,

Tarik Admani
*Please rate helpful posts*

Unable to access NAC using http

Vinayaka Raman — Tue, 31 Jul 2012 17:08:02 GMT

this is in dmz and we do no have any servers in the same subnet..

I wanted to try this option you listed in the URL

Step 1 Delete the contents of the /perfigo/control/apache/conf/sslacc.conf file in CAM.

Step 2 Run the command /perfigo/control/bin/startapache_g in CAM.

Step 3 This will unlock CAM web console.

Step 4 Login to the CAM web console, edit the access restriction list, and click Update

But can you help me locating these files on my box..here is the structure of my file system

[root@grvguestconnectauth /]# ls

bin dev guest lib media opt root selinux sys usr

boot etc home lost+found mnt proc sbin srv

Unable to access NAC using http

Tarik Admani — Tue, 31 Jul 2012 17:10:07 GMT

Is this a guest server? I may have jumped the gun on this one. If so what version or device are you trying to connect to?

thanks,

Tarik Admani
*Please rate helpful posts*

Unable to access NAC using http

Vinayaka Raman — Tue, 31 Jul 2012 17:16:39 GMT

yes it is a guest server...version 2.0.2

Unable to access NAC using http

Tarik Admani — Tue, 31 Jul 2012 17:32:38 GMT

The steps above will not work since those are for the CAM (clean access manager). However here is the feature that someone may have turned on - http://www.cisco.com/en/US/docs/security/nac/guestserver/configuration_guide/20/g_setup.html#wp1074918

The safest option at this point is to take a backup of your database and open a TAC case and see if they can unlock this for you.

thanks,

Tarik Admani
*Please rate helpful posts*

Unable to access NAC using http

Vinayaka Raman — Sun, 12 Aug 2012 05:39:08 GMT

I got it from TAC

1. Connect to the NGS CLI (either with SSH or console cable) and login

as root.

2. Enter the SQL command line with:

psql -h 127.0.0.1 gapdb -U postgres

3. List the contents of the access restrictions table with the command

below and send me the output for verification:

select * from allowed_ip_addresses;

The output should look like this (in my case only one line is entered, customer may have more values):

aip_id | app | range | created |

ended

--------+-----------+----------------+-------------------------------+-------

5 | NGS_ADMIN | 144.254.7.0/24 | 2011-10-11 15:03:37.173076+02 |

(1 row)

4. If there are values in the table, you can delete them with the command:

truncate allowed_ip_addresses;

Unable to access NAC using http

Tarik Admani — Sun, 12 Aug 2012 05:41:25 GMT

Glad to hear that they got you squared away and that you posted this on the thread it will help anyone in the future that runs across this issue.

Thanks,

Tarik Admani
*Please rate helpful posts*

Unable to access NAC using http

Vinayaka Raman — Sun, 12 Aug 2012 05:51:16 GMT

You are welcome..

Can you help me locating the doc or support thread that decribes how gues traffic web-redirection happens between Anchor controller and NAC ?

Unable to access NAC using http

Tarik Admani — Sun, 12 Aug 2012 05:58:50 GMT

Hi,

The guides are a little dated, as long as you have the anchor controller configured for the guest network then all the radius configuration is done on the wlan settings on the anchor controller only.

http://www.cisco.com/en/US/products/ps6366/products_tech_note09186a00809d6b9a.shtml

Here is a guide that will help you understand how to configure external web authentication:

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076f974.shtml#c5

Once again these guides are a little dated but so is the NGS product and this should help you get started in the right directions.

Also keep in mind that when you make any changes to NGS radius config that you always have to hit the restart button in the NGS config for the changes to take affect.

Thanks,

Tarik Admani
*Please rate helpful posts*