topic Re: Configuring BlueCoat ProxyAV 510 with ACS v5.x in Network Access Control

Configuring BlueCoat ProxyAV 510 with ACS v5.x

Inayat Bunglawala — Tue, 26 Mar 2019 00:29:24 GMT

Hi everyone,

I am trying to configure the ACS v5.x server to accept RADIUS authentication/authorization for BlueCoat ProxyAV 510's. Unfortunately, I can't seem to find any useful documentation for this.

I have created a BlueCoat VSA with an Attribute of 'Blue-Coat-Authorization' with a value of '2' (Admin Access) and Type of 'Unsigned Integer' but this does not seem to work. The ACS reports that authentication has succeeded but I cannot login to the BlueCoat device and have to rely on local access.

Has anyone managed to get this working in the field. Help appreciated!

inayat

Configuring BlueCoat ProxyAV 510 with ACS v5.x

rodmunch999 — Thu, 11 Oct 2012 01:44:02 GMT

Hi,

I am not sure if this is the same as a Blue Coat Proxy SG but I posted about this Blue Coat and ACS v4.x a while back under this thread:

https://supportforums.cisco.com/message/3356662#3356662 (This might help with the Blue Coat side)

If you want to convert it for v5.x then:

Under System Administration > Configuration > Dictionaries > Protocols > RADIUS > RADIUS VSA create a VSA with a name of Blue-Coat and a Vendor Id of 14501
Under the new VSA create an attribute called Blue-Coat-Group and a Type of String
Now under Policy Elements > Authorization and Permissions > Network Access > Authorization Profiles create a policy called something like Blue Coat Privileged.
In the Authorization policy add a manual attribute for Blue-Coat-Group and a string value of whatever group you created on the Proxy SG in the Visual Policy Manager.
Now you can create an Access Policy and assign the new Authorization Policy

Cheers

Dave

Configuring BlueCoat ProxyAV 510 with ACS v5.x

Inayat Bunglawala — Thu, 11 Oct 2012 09:07:52 GMT

Hi Dave,

Thank you for the response. I did step 1 of your five bullet points. But for the second bullet point there is no place to define the attribute as a 'string' type on that screen. It asks for the Vendor Attribute ID. These are the various parameters the ACS seems to be looking for across a number of screens and my tentative answers are on the right.

Vendor Name: Blue-Coat

Vendor ID: 14501

Vendor Attribute: ?

Vendor Attribute ID: ?

Vendor Attribute Type: String

Vendor Attribute Value: ?

Do you know what answers I need to enter above. I am told by my firewall team that the help file on the Bluecoat says that the Vendor Attribute should be 'Blue-Coat-Authorization' and the value should be '2' (admin access). However, the help files says nothing about the Vendor ID, Vendor Attribute ID or Vendor Attribute Type.

Configuring BlueCoat ProxyAV 510 with ACS v5.x

rodmunch999 — Thu, 11 Oct 2012 09:26:45 GMT

Hi Inayat,

It might be different for a a BC ProxyAV 510 than a BC Proxy SG

Here are the screenshots of the setup for the Proxy SG .

Configuring BlueCoat ProxyAV 510 with ACS v5.x

Inayat Bunglawala — Thu, 11 Oct 2012 09:52:21 GMT

Hi Dave,

Thank you for that - yes, I think the ProxyAV requires that the Blue-Coat-Authorization attribute be added - though I don't know if this is in addition to the Blue-Coat-Group attribute that you have defined or not. In any case, when I try and create the attribute I get the following error message:

I had deleted all traces of the previous BlueCoat attributes I had created as well as references to them in my policies but I still get this error message. Any ideas? Thank you for your help so far!

Hi Sir , At the end , how do

david.lung — Tue, 23 Sep 2014 06:03:38 GMT

Hi Sir ,

At the end , how do you resolve this issue , please share

Re: Configuring BlueCoat ProxyAV 510 with ACS v5.x

iVicMMac — Wed, 11 Sep 2024 17:34:50 GMT

can you share the tutorial you posted? the page does not exist anymore

Re: Configuring BlueCoat ProxyAV 510 with ACS v5.x

Greg Gibbs — Wed, 11 Sep 2024 22:15:45 GMT

This post is 12 years old and CS-ACS 5.x has been End of Support for over 2 years. You're not likely to find this content anymore.

Re: Configuring BlueCoat ProxyAV 510 with ACS v5.x

iVicMMac — Wed, 11 Sep 2024 22:36:40 GMT

I've had some luck, I've found a few, but I was really interested in this one, unfortunately now I'm the admin of an ACS 5.x that I need to configure for tacacs and radius auth for different vendors