topic ACS 5.2 Cisco-AV-Pair Problem in Network Access Control

ACS 5.2 Cisco-AV-Pair Problem

Andreas_Seybold-Epting — Mon, 11 Mar 2019 01:09:05 GMT

Hi at all

i have a Problem with the cisco-av-pair string on the Cisco ACS and a SSID.

We have here some SSID and some AD Groups. It was no Problem with the old Cisco ACS 4.2. I have here configured the string: cisco-av-pair ssid=myssid. The Clients have only rights to this ssid. It works without Problems.

On the new ACS 5.2. I have here Problem to configure this.

My Configuration is a new Identity Policy.

Compound Condition:

Radius-Cisco -->cisco-av-pair-->equals-->myssid

But this string works not.

Did you have any ideas about this Problem.

My System:

Cisco ACS 5.2 with all new Patches

Cisco WLC newest Version

Thanks

regards

Andreas

ACS 5.2 Cisco-AV-Pair Problem

jrabinow — Thu, 09 Jun 2011 06:52:54 GMT

I think you need to match on the string that appears in the attribute. In this case. "ssid=myssid"

If you want to confirm what string should be used select: Monitoring and reports -> Launch Monitoring & Report Viewer

and then select Authentications -> RADIUS today

You should see a list of the requests including the ones you had tried. In the details column click on the icon and you will see the details of your RADIUS request. This includes the list of RADIUS attributes received. You can look at what is in the AV pair field and make sure a correct condition is specified

ACS 5.2 Cisco-AV-Pair Problem

Andreas_Seybold-Epting — Thu, 09 Jun 2011 07:01:05 GMT

Hi jrabinow,

thanks for your Answer.

My Authorization Policy is with follow string:

RADIUS-Cisco:cisco-av-pair equals ssid=OFFEN

I can the in Other Attributes:

ACSVersion=acs-5.2.0.26-B.3075
ConfigVersionId=56
Device Port=32769
RadiusPacketType=AccessRequest
Protocol=Radius
Service-Type=Framed
Framed-MTU=1300
Called-Station-ID=1c-17-d3-fc-9b-00:OFFEN
Airespace-Wlan-Id=7
Device IP Address=10.99.11.16

OFFEN is my SSID.

In the Steps from the Report i can see:

regards

Andreas

15006 Matched Default Rule

15012 Selected Access Service - DenyAccess

11019 Selected DenyAccess Service

11003 Returned RADIUS Access-Reject

ACS 5.2 Cisco-AV-Pair Problem

jrabinow — Thu, 09 Jun 2011 07:34:54 GMT

from the steps can see that no Access Service is being matched. It is selecting the default rule.

A first step will be to look at the Service Selection Policy (Access Policies > Access Services > Service Selection Rules) and see why an access service is not being selected

ACS 5.2 Cisco-AV-Pair Problem

Andreas_Seybold-Epting — Thu, 09 Jun 2011 08:53:08 GMT

I have make a Test with the "Airespace-WLAN-ID" Attribute.

I can configure a rule with

RADIUS-Cisco Airespace-Wlan-ID=7

This works. I can only connect to this Wlan-ID.

I have found this in the Other Attributes list.

ACSVersion=acs-5.2.0.26-B.3075

ConfigVersionId=56

Device Port=32769

RadiusPacketType=AccessRequest

Protocol=Radius

Service-Type=Framed

Framed-MTU=1300

Called-Station-ID=1c-17-d3-fc-9b-00:OFFEN

Airespace-Wlan-Id=7

Device IP Address=10.99.11.16

But i can not find only the name of the SSID, only in the String "Called-Station-ID..."

Is it possible that the ACS get not this Information from the WLC?

ACS 5.2 Cisco-AV-Pair Problem

jrabinow — Thu, 09 Jun 2011 09:18:56 GMT

You could try a condition:

Called-Station-ID ends-with ":0FFEN"

ACS 5.2 Cisco-AV-Pair Problem

Andreas_Seybold-Epting — Thu, 09 Jun 2011 11:24:25 GMT

Hi Jrabinow,

thanks for your help. I have configured this condition and now it works.

regards

Andreas