Cisco ACS5.7

[Aphea]

Dear experts,

I would like to ask if anyone can guide me through user authentication in ACS5.7.

The problem is, I want to create internal users with the same name as in Active Directory, and take only password from AD.

Do you have any experiences on this issue? Your response is highly appreciated :) 

Best regards,

Aphea

[Ivan Gonzalez · Accepted solution]

Hi,

To accomplish this task, basically you need to create the user internally on the ACS, but configure the password to be checked against AD as on the attached example.

And the identity for either "Default Network Access" or "Default Device Admin" should still point to "Internal users" under the following section "Access Policies > Access Services > Default network access > Identity"

Note: Please mark it as answered if applicable

[Aphea]

Dear ivangonz,

Highly appreciated with your response.

Actually, I forget to tell that I am using vpn with downloadable access lists with radius. 

But Cisco ACS requires me to put the same password and user in order to grant access.

I have followed this links. http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113449-asa-vpn-acs-00.html, but I get no luck.

You have any experiences with this issue? With creating internal username, and password from AD to authenticate with ACS Radius.

Thanks,

Aphea

[Ivan Gonzalez · Accepted solution]

Hi Aphea,

On the step #5 from the link you provided, you need to change the "password type" from Internal Users ( which is local password ), to AD so the ACS will check the password against AD.