topic ACS 5.3 in Network Access Control

ACS 5.3

ewood2624 — Mon, 11 Mar 2019 01:28:06 GMT

Has anyone updated to ACS 5.3 yet? If so, any complications?

Sent from Cisco Technical Support iPad App

ACS 5.3

larsen_2011 — Mon, 10 Oct 2011 11:27:01 GMT

Hi,

yes, I upgraded from 5.2 to 5.3 and have following problems:

Network connectivity error when trying to access the "vendors" and "network devices" sites in the web gui

System error when trying to edit an internal user...

No change after installing backup.

Did it on two different ACS - same problem.

I will now try a complete reimage...

ACS 5.3

ewood2624 — Mon, 10 Oct 2011 15:06:41 GMT

I'm hoping not to have to reimage the appliance. Keep us posted on if you find any other issues.

ACS 5.3

Chris Jackson — Mon, 10 Oct 2011 22:23:57 GMT

I upgraded. running the 5.3.0.40 version. I seem to have an issue specific to MSNPAllowDialin=True string when using AD I can validate group membership but the directory attributes seem to cause problems.

Re: ACS 5.3

ewood2624 — Tue, 11 Oct 2011 15:52:35 GMT

I remember reading that one of the new features on the release notes had something to do with Dial-In Attribute Support:

Dial-In Attribute Support

The Dial-In Attribute feature enhancement includes:

• Dial-in permissions

You can allow, deny, and control access of dial-in permissions of a user. The permissions are

checked during authentications or queries from Active Directory. It is set on the Active Directory

dedicated dictionary.

• Callback

You can set up callback options. The server calls the caller back during the connection process if

this option is enabled. The phone number that is used by the server, is set either by a the caller or

the network administrator.

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.3/release/notes/acs_53_rn.pdf

ACS 5.3

C8602260424 — Mon, 17 Oct 2011 15:26:05 GMT

I upgraded using the upgrade support bundle, from 5.1 to 5.2 to 5.3. No issues upgrading, but the tabs under the Dashboard disappeared when trying to access in both IE8 and Firefox. So brought appliance back to 5.1 factory and used upgrade bundle to go form 5.1 to 5.3. No issues upgrading, Dashboard back and fully functional.

I am seeing strange behavior though from my 7945 Cisco IP Phones. When they authenticated in 5.1 no issues. In 5.3 they authenticate and then a minute later fail with error 5411 EAP session timed out. When I check the phone works fine and appears authenticated on the switch. So the failure might be a bogus message but not sure. has anyone had this issue in 5.3??

Re: ACS 5.3

dal — Fri, 21 Oct 2011 10:26:26 GMT

Hi.

I upgraded using the bundle.

But now the Process status info tells me this:

View-database: Does not exist

View-logprocessor: not monitored

At the same time, i have this message in the Alarms Inbox:

The View 5.2database has been upgraded to 5.3 and is ready for activation.

So the question is: How do i activate it?

Edit:

After another reload of the server, the view-database has now status of running.

But the view-logprocessor is still not monitored.

What does not monitored mean?

And the Cisco ACS View Dashboard is empty, but I guess thats related?

What now?

Thanks

Re: ACS 5.3

jrabinow — Fri, 21 Oct 2011 13:12:45 GMT

Go to following link:

Monitoring and Reports->Launch Monitoring & Report Viewer

then

Monitoring Configuration > System Operations > Data Upgrade Status

Should be an option there to see status of upgrade and activate the database

Re: ACS 5.3

dal — Fri, 21 Oct 2011 14:02:24 GMT

Hi, and thanks for answering.

I see the Data Upgrade Status, and it says Upgrade completed successfully.

But other than that, the page is completely empty. No buttons, no link, nothing exept that short message.

Re: ACS 5.3

jrabinow — Fri, 21 Oct 2011 14:16:41 GMT

There should be an option to "Switch Database". I thought it was on this page.

Re: ACS 5.3

dal — Fri, 21 Oct 2011 18:18:22 GMT

Well, it's not.

Luckily, our ACS runs on VMWare, so it was easy to revert back to v5.2.

Crap. Cannot have a radius server without a working log service. So it stays v5.2 until maybe some of the ACS programmers can answer this?

Thanks.

ACS 5.3

Ayhan Guec — Wed, 26 Oct 2011 08:36:04 GMT

Hi,

after a upgrade from version 5.2 to 5.3 using Application Upgrade Bundle we face following problems:

#show application status acs

ACS role: PRIMARY

Process 'database' running

Process 'management' running

Process 'runtime' running

Process 'adclient' running

Process 'view-database' running

Process 'view-jobmanager' running

Process 'view-alertmanager' running

Process 'view-collector' running

Process 'view-logprocessor' Restarting

After a while:

Process 'database' running

Process 'management' running

Process 'runtime' running

Process 'adclient' running

Process 'view-database' running

Process 'view-jobmanager' running

Process 'view-alertmanager' running

Process 'view-collector' running

Process 'view-logprocessor' not monitored

Any ideas what could be the reason for this behaviour and how to fix it?

After the upgrade we get also this error in the "Cisco Secure ACS View":

"Data Upgrade Failed. Click here to view details"

Internal Error. Please see below: An unexpected error has occured. If this error continues, please contact Cisco Technical Assistance Center Error Type ACS Server Exception Error Summary

java.lang.NullPointerException

Error Cause

Possible Workaround

An unexpected error has occured. If this error continues, please contact Cisco Technical Assistance Center View Stack Trace Hide Stack Trace Server Stack Trace java.lang.NullPointerException

com.cisco.nm.acs.view.ui.actions.logrecovery.LogRecoveryAction.loadLogRecoveryConfig(LogRecoveryAction.java:66)

sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) java.lang.reflect.Method.invoke(Unknown Source)

org.apache.struts.actions.DispatchAction.dispatchMethod(DispatchAction.java:270)

org.apache.struts.actions.DispatchAction.execute(DispatchAction.java:187)

org.apache.struts.actions.MappingDispatchAction.execute(MappingDispatchAction.java:169)

org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:431)

org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:236)

org.apache.struts.action.ActionServlet.process(ActionServlet.java:1196)

org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:414)

javax.servlet.http.HttpServlet.service(HttpServlet.java:617)

javax.servlet.http.HttpServlet.service(HttpServlet.java:717)

org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)

org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

com.cisco.nm.acs.view.ui.utils.HttpDataValidationFilter.doFilter(HttpDataValidationFilter.java:41)

org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)

org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

org.ajaxanywhere.AAFilter.doFilter(AAFilter.java:46)

org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)

org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

com.cisco.nm.acs.view.ui.utils.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:26)

org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)

org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)

org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)

org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:525)

org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)

org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)

org.apache.catalina.authenticator.SingleSignOn.invoke(SingleSignOn.java:421)

org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)

org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)

org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:845)

org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)

org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)

java.lang.Thread.run(Unknown Source)

It seems that the applet class is not found in the specified path to run. I remember that cumulative patches for version 5.1 fixed this problem. Are there any patches for version 5.3 available ?

It would be great if you could provide me a solution / workaround

Thanks

Re: ACS 5.3

ewood2624 — Wed, 26 Oct 2011 11:47:26 GMT

Does a software reboot give you the same error as a cold reboot?

Sent from Cisco Technical Support iPhone App

Re: ACS 5.3

Ayhan Guec — Wed, 26 Oct 2011 12:25:58 GMT

Hi ewood,

we tried both variants of rebooting (soft & cold) but still the same error.

Re: ACS 5.3

JUSTIN LOUCKS — Fri, 28 Oct 2011 14:47:27 GMT

We are having this same issue after upgrading from 5.1 to 5.2 and I have not been able to get it resolved. We are using the 1121 physical server appliance so no way to go back. I just cannot figure out why that 'view log-processor' will not go to Monitored. Without it, we appear to have no visibility to the reports. We are seeing the following in the contents of the associated log file if anyone can make sense of it.

Oct 18 2011 16:42:36 com.cisco.nm.acs.view.collector.Main.main(Main.java:117) INFO main Acs.MGMT.ACSVIEW Log processor initializing...

Oct 18 2011 16:42:36 com.cisco.nm.acs.view.collector.Main$ShutdownListener.run(Main.java:160) DEBUG ShutdownListener Acs.MGMT.ACSVIEW Listening for shutdown

ACS 5.3

dal — Fri, 28 Oct 2011 15:13:59 GMT

I got it up and running now.

I reverted back to v5.2. After I did that, I found out the clock wasn't set right.

After i synced it against our NTP server, I tried upgrading again, and this time I had no problems.

I still had to build the Dashboard manually, though.

Maybe this is the problem for some of you others here too?

ACS 5.3

vciric — Mon, 31 Oct 2011 11:46:35 GMT

After upgrading from 5.2 to 5.3 we got:

Process ‘view-database’ Restarting

After restarting the ACS appliance all processes have been running.

ACS 5.3

robdowson — Mon, 14 Nov 2011 12:02:23 GMT

We upgraded a few weeks ago using the upgrade bundle from 5.2 to 5.3.

The upgrade itself went fairly smoothly - but I had to manually reboot each ACS (primary and secondary) during the upgrade - instead of them rebooting themselves automatically. Had to sit on my hands for an hour to stop me rebooting it in case it really was still doing something - but gave up and rebooted in the end and came back up fine.

Also had some very odd issues with network devices seemingly being 'corrupted' aswell.

I did a fresh install at 5.2 - and used the bulk import to import all our ND's from the CVS file - and I've found (on 5.2 aswell) that some of them look ok - but they don't authenticate (and no messages in the ACS View at all - not even saying eg. wrong tacacs key or IP etc) - until you make some sort of change to the tacacs key - eg. add a '1' onto the end of the string - and then remove it again (back to the same key) - and it suddenly starts working. TAC seem to think this may be 'non unicode characters' issue in the key - but lots of our keys are the same - and I created the CSV file with all devices (eg. copy & paste) - so don' t see how some work and some don't - and I would have thought that the import tool should pick that up anyway?

Since the 5.3 upgrade - I then had some issues with some ND's showing a very odd error when you clicked on them in the network devices list - "This System Failure occurred: Has empty AVPair.. Your changes have not been saved. Click ok to return to the list page" - so you couldn't even view what was in the ND. Each ND needed to be manually deleted - and then re-added - and then worked fine - so I think this is an upgrade ND-corruption issue - but TAC can't replicate or see anything in any backups etc. Not a major issue as we just deleted ND's and re-created - but a bit of a pain.

Anyone else seen any similar issues?

Apart from that - all is good with 5.3. Quite a few little things seem to have been fixed along the way aswell.

ACS 5.3

brock0150 — Tue, 15 Nov 2011 15:09:36 GMT

robdowson,

I had that same issue with importing from a CVS file. However, it was with 5.2. Very strange indeed.

On a side note, It seems I can no longer authenticate to my child domain. Everything looks fine, including the directory groups and the policies. Pretty annoying.

ACS 5.3

BuddeMcBudde — Thu, 01 Dec 2011 21:49:00 GMT

I had the same issue with the TACACS keys in 5.2. Nothing shows up in the logs for some devices. Copy and pasting the key or even resubmitting and it works.