cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1100
Views
0
Helpful
2
Replies

Authentication Problem in ACS

hirenparekh12
Level 1
Level 1

Hi,

i have created two ssid on WLC & authentication Via ACS to AD. after that i have configure TACACS+ on same ACS Server but some of the users can login in Wi-Fi which are not in member of Wi-Fi group.

Please find the below ACS configuration.

Group 1 >>>>  HIgh managemnet Users  " this user can login in SSID 1"

Group 3 >>>> Corporate User    "this users can login in SSID 2"

In group configuration i have configure DNIS/CLI based configuration.

AAA client select

Port *

CLI *

DNIS *SSID1

same configuration for SSID 2

after that i have creat two more group for TACACS + for Device authentication (Shell command based) (Authentication through AD)

Group 5 >>>> Full Access

Group 6 >>>> Read Only Access.

but now what ever user are in group 5 & 6 those are login in Wifi.

how to stop them?

2 Replies 2

Tarik Admani
VIP Alumni
VIP Alumni

Hi,

In your authorization rules is the default rule set to Permit? If so please set it to Deny, when ACS is configured brand new the default policies are always set to permit.

If that is not the case please post screenshots of your policies, and also of the authentication report of the user that was allowed access.

Hope that helps.

Tarik Admani
*Please rate helpful posts*


Hi

 

I have configure above setting for SSID 1 in Group 1 & MAP security group (with AD) with Group 1 in external Database.

I have configure above setting for SSID 2 in Group 3 & MAP security group (with AD) with Group 3 in external Database.

till the time user maped in Group 3 is not login in group1 SSID.

after that i have configure TACACS + on same server with

Group 5 >>>> Full Access ( Shell command authorization Set)

Group 6 >>>> Read Only Access.( Shell command authorization Set)

Exp. hparekh is member of Group 6 & Group 3 but now it is login in Group 1 SSID.

Please find the External database setting

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: