05-10-2012 12:16 AM - edited 03-10-2019 07:04 PM
We are using cisco ACS 4.2.1 on windows 2003 to authenticate with windows 2003 Actice Directory. We have update Active directory server windows 2008 version. We have checked the configuration of ACS on windows database and no problem but we can't see in ACS dynamic user. I have authentication problem ACS 4.2.1 to Windows 2008 R2 active directory.
05-29-2012 02:03 AM
Can someone help to answer this question? I have one customer who also asked me about this. One thing I found is ACS 5.3 can support AD on Windows 2008 R2 but my customer don't want to pay for upgrade.
05-29-2012 07:15 AM
Hi there,
This is a very common question "ACS 4.x supports authentication with 2008 R2", unfortunately the answer is no. The only ACS server that supports authentication against this specific DB is ACS 5.2.0.26 and later, not even ACS 5.1.0.44 supports this.
You can check the Release notes to confirm this:
However there are workarounds, for example you can use LDAP, or you can use Radius proxy. Using LDAP should work unless you are using PEAP as this protocol doesn't support LDAP as the DB.
Radius proxy means that the authentication request will reach the ACS 4.x and this server will send the request to MS IAS or NPS for the authentication, the problem here is that you will need to use two Radius servers.
Rate if it helps!
05-29-2012 07:22 AM
Hi there,
There is a section in the ACS 4.x where you can define if the ACS should show the dynamic users or not, make sure that this option is unchecked, for this go to External User Databases/Unknown User Policy/Configure Caching Unknown Users
Also if you are facing authentication issues with ACS 4.x and Windows 2008 R2, you may want ready my previous answer.
Let me know if this helps.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide