topic Re: Centralized (IAS/Radius) Authentication under IDS/IPS 4260 in Network Security

Centralized (IAS/Radius) Authentication under IDS/IPS 4260

Racquel_Mays — Sun, 10 Mar 2019 12:01:55 GMT

All,

I have been tasked with the configuring centralized authentication via IAS for all the IPS/IDS devices in the enterprise. After much invest I'm almost sure that due to limitations inherent to the device my goal is not obtainable. However, I am still not 100% sure. My questions are:

1. Can anyone provide a link or any documentation showing definitively whether or not the IPS 4260 supports IAS/Radius authentication?

a. If not, what would be a suitable alternative? CSM, etc.?

Re: Centralized (IAS/Radius) Authentication under IDS/IPS 4260

Scott Fringer — Thu, 17 Jun 2010 16:28:17 GMT

Cisco's IPS sensors do not currently support externally authenticated access. They will only support

local username/password authentication and role assignment.

Scott

Re: Centralized (IAS/Radius) Authentication under IDS/IPS 4260

trippi — Fri, 30 Jul 2010 20:47:33 GMT

This is available with the latest release.

Re: Centralized (IAS/Radius) Authentication under IDS/IPS 4260

mikecrowe4ICS_2 — Tue, 10 Aug 2010 08:21:09 GMT

To be specific, software release 7.0(4)E4 adds support for AAA via RADIUS (but not TACACS+). For more information, check out the Cisco document here:

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_setup.html#wp1033251

It's important to note that AAA/RADIUS is NOT supported with the latest release of IME (7.0(3)).

Re: Centralized (IAS/Radius) Authentication under IDS/IPS 4260

Racquel_Mays — Tue, 17 Aug 2010 21:36:33 GMT

Thanks! I'll try this.

Re: Centralized (IAS/Radius) Authentication under IDS/IPS 4260

Farrukh Haroon — Sat, 26 Feb 2011 08:54:26 GMT

Please note that the latest IME version (7.1.1) supports the Radius (AAA) Feature on CIsco IPS Sensors:

http://www.cisco.com/en/US/docs/security/ips/7.1/release/notes/24340_01.html#wp1296082

Please rate if helpful.

Regards

Farrukh

Re: Centralized (IAS/Radius) Authentication under IDS/IPS 4260

bestsoftware — Wed, 16 Nov 2011 23:56:43 GMT

Hi All,

I have several IPS ASA-SSM-10 and IPS 4260, I spent several hours trying to get them to authenticate through MS IAS 2003 R2, I was able to get them authenticated thru SSH but not in ASDM. I really appreciate if anyone have any information how to get these working in ASDM.

Thanks

Re: Centralized (IAS/Radius) Authentication under IDS/IPS 4260

Farrukh Haroon — Thu, 17 Nov 2011 03:25:38 GMT

Hello

What version are you running on the IPS?

Login to the CLI and keep running the show events command, then login with HTTPS (IDM) and post the exact error in the event log

Regards

Farrukh

Re: Centralized (IAS/Radius) Authentication under IDS/IPS 4260

bestsoftware — Thu, 17 Nov 2011 17:08:28 GMT

Hi Farrukh,

All IPS/IDS are running version 7.0.4. I did what you recommended and below are the logs I captured:

evStatus: eventId=1306479664548993105 vendor=Cisco

originator:

hostId: NACAIRVIDLAB1

appName: cidwebserver

appInstanceId: 349

time: 2011/11/17 16:57:45 2011/11/17 16:57:45 UTC

loginAction: action=loginFailed

description: User failed to authenticate with the HTTP server

userName: best\xsxtran

userAddress: port=64368 10.90.204.17

evStatus: eventId=1306479664548993106 vendor=Cisco

originator:

hostId: NACAIRVIDLAB1

appName: cidwebserver

appInstanceId: 349

time: 2011/11/17 16:57:58 2011/11/17 16:57:58 UTC

loginAction: action=loginFailed

description: User failed to authenticate with the HTTP server

userName: best\xsxtran

userAddress: port=64369 10.90.204.17

Thanks for all your help

Re: Centralized (IAS/Radius) Authentication under IDS/IPS 4260

Farrukh Haroon — Sat, 19 Nov 2011 07:24:09 GMT

Hello,

I think I saw the same issue before, in your AAA config on the sensor(s) please change the default user role to administrator.

On the CLI:

service aaa

default-user-role administrator

This can also be done through the GUI (IDM).

Regards

Farrukh

Re: Centralized (IAS/Radius) Authentication under IDS/IPS 4260

bestsoftware — Mon, 21 Nov 2011 16:28:44 GMT

Hi Farrukh,

Thanks for helping. I figured out the problem. It was the IOS bug. It worked as soon as I upgraded to version 7.0.6. All my IPS/IDS authenticated through Microsoft Radius now.

Re: Centralized (IAS/Radius) Authentication under IDS/IPS 4260

Farrukh Haroon — Mon, 21 Nov 2011 17:51:33 GMT

I'm glad you have it working now and thanks for sharing with everybody

Regards

Farrukh