Prime Infrastructure & AD

[tira li]

Dear All,

     I'm new with the new network management tool -- Prime Infrastructure which converges the wireless and wired network devices, and my customer knew this tool and wanted to configure the wireless and wired devices through PI by whom in AD Group and audit configuration.

     I have checked the docs about PI 1.3, it can't be integrate with AD to authenticate user to login and so on. Due to lacking of AAA knowledge, hope someone can give me some suggestion or ways about the mentioned test, I will really appreciate for your help, thx in advance!

Thx,

Tira

[Richard Atkin · Accepted solution]

You just need a RADIUS Server between you PI and AD. Configure the AAA Server to return the correct RADIUS Attributes (As listed in the Administration / AAA / User Groups section of the PI GUI and as relevant to the amount of access you want to give)), and the job's a good'un.

Sent from Cisco Technical Support iPad App

[tira li]

Hi Richard,

     Firstly thx for your timely help and read some threads about NCS with TACACS on Support Forums!

     However, I have configured ACS server with AD authentication to return the TACACS Attributes copied by the Root Group of PI, not the RADIUS Attributes.  Now it can access by users of AD Group with their AD username/password and get some basic SNMP information, such as CPU、Memory and sysname etc. However, it can't collecte configuration, even push the configuration temple into device. Then I checked the fail reason of archive configuration and it claimed that Telnet can not be establishd. The test device has been configured AAA and I has made sure that entering the AD user's username/password was correct, of course I also increased the telnet timeout.

     Plz for your suggestion, thx in advance!

[tira li]

Can someone help?!

[james.doukas]

Have you made sure that the AD account being used to access the test device isn't locked out? The log says that authentication failed 3 times so the aaa server does not like the credentials Prime is trying to use to access the device.

[tira li]

Hi James and Cisco Support

    Sorry for late response.

    I am sure the credentials can work by telnet. Maybe let me introduce the detail POC environnment: ACS5.4、PI1.2、One Router C871 for test.

    my customer knew this tool and wanted to configure the wireless and wired devices through PI by whom in AD Group and audit configuration. Then, we configured the ACS as TACACS server for authenticate AD account to login and config the router ; And we configured the PI AAA mode according to the PI Doc and copied the Root task list and pasted into ACS Shell Profiles to authorize AD account to use PI function. Finally, we logined PI by AD account and added the test router successfully, and got some SNMP information about router. However, we can't archive the configuration of router after inventory on PI. Then I found the fail reason as mentionable attachment, and I also checked the AAA log on ACS which contains the success authorization of PI and nothing about gathering configuration of router. If you need more logs, I will attach the logs you want to check!

    I will really appreciate for your help, thx in advance!

Regards,

Tira

[tira li]

      Can Someone Help?！

tira li 编写:
Hi James and Cisco Support
    Sorry for late response.
    I am sure the credentials can work by telnet. Maybe let me introduce the detail POC environnment: ACS5.4、PI1.2、One Router C871 for test.
    my customer knew this tool and wanted to configure the wireless and wired devices through PI by whom in AD Group and audit configuration. Then, we configured the ACS as TACACS server for authenticate AD account to login and config the router ; And we configured the PI AAA mode according to the PI Doc and copied the Root task list and pasted into ACS Shell Profiles to authorize AD account to use PI function. Finally, we logined PI by AD account and added the test router successfully, and got some SNMP information about router. However, we can't archive the configuration of router after inventory on PI. Then I found the fail reason as mentionable attachment, and I also checked the AAA log on ACS which contains the success authorization of PI and nothing about gathering configuration of router. If you need more logs, I will attach the logs you want to check!
    I will really appreciate for your help, thx in advance!
Regards,
Tira