ACS 5.4 AD Integration Allows All Users

[matt.nasi]

Hello,

I've been struggling to find out why our ACS deployment allows everyone within AD to login to our devices.  They are not able to do anything because of the command authorization but I don't understand why EVERYONE is allowed in when I specified a specific group to only be allowed access.  That group is allowed full access which is fine but it still bothers me that anyone on our domain can just log in period.

Any thoughts?  Thanks.

Matt

[Julio Carvajal · Accepted solution]

Hello Matt,

Just by specifying a group in a policy does not mean that the rest of users on different groups will get denied.

Make sure that the default action for that policy (I mean if you do not match the previously configured rule) is drop (Then it should work as you want)

Check my blog at http:laguiadelnetworking.com  and subscribe so you can get daily information about networking.

Cheers,

Julio Carvajal Segura

[Tarik Admani]

Much like the previous user said, you will need to check your default policy is set to deny.

Sent from Cisco Technical Support iPad App

[Julio Carvajal]

Do you still have any questions??

Otherwise mark the question as answered

For more information about Core and Security Networking follow my website at http://laguiadelnetworking.

Any question contact me at jcarvaja@laguiadelnetworking.com

Cheers,

Julio Carvajal Segura

[matt.nasi]

Identity was already set to drop, the way to fix my issue actually was to CREATE a deny policy under authorization. 

[blenka]

The IP addresses and subnet masks that are associated with the network device. Select to enter a single IP address or to define a range.

for the steps to get the job done please go through the link below:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.4/user/guide/net_resources.html#wp1060126