Users with Superuser security privileges can configure nodes to use RADIUS authentication.
An ONS node operates as a client of RADIUS. The client passes user information to designated RADIUS servers, and then acts on the response. RADIUS servers receive user connection requests, authenticate the user, and return all configuration information necessary for the client to deliver service to the user.
Create a user on ACS with CiscoSecure PAP password that we will use to login ONS
Assign the above created user 454supper to FullAccessGroup group by going tp Group Setup.
Defining ONS as a Radius client
Login To ACS
Click on Network Configuration.
Click on ADD Entry.
Name the Client hostname unique.
Enter the ip address of the ONS node.
Enter the shared secret key, should be same as Node/ONS config.
Make sure Authenticate Using set to "Radius(CiscoIOS/PIX 6.0)
User Security Group Mapping
The possible security levels are Retrieve, Maintenance, Provisioning, and Superuser.
An attribute-value (AV) pair represents a variable and one of the possible values that the variable can hold. Within ONS, users are mapped to different security groups based on Cisco AV Pair. Here is an example:
"shell:priv-lvl=X" where X can be value of 0 to 3:
0 represents Retrieve
. 1 represents Maintenance
2 represents Provisioning
3 represents Super
Defining RADIUS Server On ONS
Log into Cisco Transport Controller (CTC).
Go to the Network view.
Select a specific ONS in order to go to the Shelf view.
Click Provisioning > Security > RADIUS Server.
Type the IP address of the RADIUS server in the IP Address field.
Type a shared secret in the Shared Secret field. A shared secret is a text string that serves as a password between a RADIUS client and RADIUS server.
Type the RADIUS authentication port number in the Authentication Port field.
The default authentication port number is 1812.
Type the RADIUS accounting port number in the Accounting Port field. The default accounting port number is 1813.
Check ACS logs under reports and activities > failed authentication.
Make sure shared-secret key is same on both the sides.
In order to get rds.log file, set the logging level to full and generate package.cab file.
In some cases even your configuration is correct and you see an extra attribute "aaa:supplicant-name=<username>" in the RDS logs pushing down to ONS then this will cause ONS to fail authorization. In order to fix this go to Interface Configuration > RADIUS (Cisco IOS/PIX 6.x) and uncheck the "Enable Authenticated Port cisco-av-pair" option.
The far end can bring up the tunnel; I confirm it with the show IPSec SA command. They launch a ping, the tunnel comes up, but they do NOT see the echo-reply. If I tear down the tunnel, and initiate it from my side, the tunnel comes up, AND the ...
Hi, I'm installing ISE 2.6 with Anyconnect 4.7 with ISE Posture VPN Posture and Compliance Module 4.3 for posture. But When test PC is connected to NAD, it gets authenticated but Compliance Modue shows message "Byppassing anyconnect scan your network...
Dear Support, We have FMC 2500 appliance where fiber card 10 GB is integrated.we are trying to move the management copper port , to the fiber ports 10 GB. however , if you go to system > configuration > management interfaces , you will onl...
Hello together,I normally use the Cisco AnyConnect Secure Mobility Client to connect to my university's network when I'm working from home.For some time, it hasn't been working any more. As soon as I establish a connection over the VPN client, I can not b...