topic Re: Group connection between Cisco switch and ACS server in Network Access Control

Group connection between Cisco switch and ACS server

CerielRoland — Sun, 10 Mar 2019 23:12:18 GMT

Hello,

My name is Ceriel Roland and I have a small problem:

We are using Cisco 3560 Switches with 12.2(44)SE2 IOS.

These switches are dot1x enabled with the ACS server.

Computers are authenticated trough certificates and it all works fine.

We also want to enable login with ACS server, but we dont want all users to have access.

Only the group AD_Admins needs to have access.

I created the group and added users.

On the switch I entered the command:

aaa authentication login AD_Admins local group radius

But the users cant login to the switch.

If i change the command to:

aaa authentication login default local group radius

Then users can login, but ALL users can login and i only want AD_Admins to be able to login.

How can i set this up for it to work?

Greetings,

Ceriel Roland

Re: Group connection between Cisco switch and ACS server

Collin Clark — Mon, 24 Nov 2008 14:29:32 GMT

Ceriel-

Check this link, it might help you out.

http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=AAA&topicID=.ee6e1fe&fromOutline=&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc25eb6

Re: Group connection between Cisco switch and ACS server

CerielRoland — Mon, 24 Nov 2008 14:46:02 GMT

Hi Collin,

I tried it but the problem is that the ACS server also allows clients to authenticate trough dot1x.

If i adjust that setting, the users cant use the network anymore.

I also tried to achieve it trough Network Access Profiles to allow clients to communicate trough Radius and allow users to login with TACACS, but i cant define TACACS access in the NAP's.

Greetings,

Ceriel