topic Cisco ACS 4.2.1 authentication problem in Network Access Control

Cisco ACS 4.2.1 authentication problem

r.timucin — Mon, 11 Mar 2019 02:04:51 GMT

We are using cisco ACS 4.2.1 on windows 2003 to authenticate with windows 2003 Actice Directory. We have update Active directory server windows 2008 version. We have checked the configuration of ACS on windows database and no problem but we can't see in ACS dynamic user. I have authentication problem ACS 4.2.1 to Windows 2008 R2 active directory.

Cisco ACS 4.2.1 authentication problem

narpornt — Tue, 29 May 2012 09:03:19 GMT

Can someone help to answer this question? I have one customer who also asked me about this. One thing I found is ACS 5.3 can support AD on Windows 2008 R2 but my customer don't want to pay for upgrade.

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.3/device_support/sdt53.html

Cisco ACS 4.2.1 authentication problem

mauzamor — Tue, 29 May 2012 14:15:17 GMT

Hi there,

This is a very common question "ACS 4.x supports authentication with 2008 R2", unfortunately the answer is no. The only ACS server that supports authentication against this specific DB is ACS 5.2.0.26 and later, not even ACS 5.1.0.44 supports this.

You can check the Release notes to confirm this:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.2/release/notes/acs_52_rn.html

However there are workarounds, for example you can use LDAP, or you can use Radius proxy. Using LDAP should work unless you are using PEAP as this protocol doesn't support LDAP as the DB.

Radius proxy means that the authentication request will reach the ACS 4.x and this server will send the request to MS IAS or NPS for the authentication, the problem here is that you will need to use two Radius servers.

Rate if it helps!

Cisco ACS 4.2.1 authentication problem

mauzamor — Tue, 29 May 2012 14:22:48 GMT

Hi there,

There is a section in the ACS 4.x where you can define if the ACS should show the dynamic users or not, make sure that this option is unchecked, for this go to External User Databases/Unknown User Policy/Configure Caching Unknown Users

Also if you are facing authentication issues with ACS 4.x and Windows 2008 R2, you may want ready my previous answer.

Let me know if this helps.