topic Re: Using two ACS for two different authentication on one router in Network Access Control

Using two ACS for two different authentication on one router

sweeann — Sun, 10 Mar 2019 21:48:06 GMT

I have a router with needs to be authenticated by two ACS Server for two different functions. Eg. for ISDN dialing into the router, it gets the authentication from ACS A. While for command authentications, the router needs to talk to ACS B. Can this be done. If yes, how?

Thanks,

sweeann

Re: Using two ACS for two different authentication on one router

ethiel — Wed, 18 Oct 2006 03:55:33 GMT

It sure can. You just need seperate groups for each. For example:

radius-server host 1.1.1.1 key secretkey

radius-server host 2.2.2.2 key secretkey

aaa group server radius consolegrp

server 1.1.1.1 auth-port 1812 acct-port 1813

aaa group server radius isdngrp

server 2.2.2.2 auth-port 1812 acct-port 1813

Then use the following:

aaa authentication login default group consolegrp

aaa authorization exec default group consolegrp

aaa authentication ppp default group isdngrp

You can change that as neccesary (e.g. change console to TACACS) but that is the general template for multiple server groups.

-Eric

Re: Using two ACS for two different authentication on one router

sweeann — Wed, 18 Oct 2006 06:15:52 GMT

Eric,

I believe that'll do the job. Thanks for the input.

-sweeann

Re: Using two ACS for two different authentication on one router

darpotter — Wed, 18 Oct 2006 09:36:52 GMT

If you take a look at ACS v4.0 NAP (Network Access Profiles) you should be able to consolidate your ACSs down to a single server.

You can create a NAP for each service with its own config.

Maybe worth looking at.