Hello Paul, It sounds like the HP Router is expecting additional information or Attributes to be send by the RADIUS server to complete the connection for WebVPN. I have checked and I was not able to find any attributes on Cisco side for HP router VPN access to work. Can you check with HP support and verify if a RADIUS dictionary has to be installed on the ACS server for it to send additional information? Usually 3rd-Party vendors support should provide you with the appropriate dictionary file if applicable. If this was helpful please rate. Regards. ... View more

Hello Ciaran, Is the device properly configured to use RADIUS for the ISDN calls? If the ACS is complaining that it hit a 'default device admin' rule then the request is getting to the server on TACACS+. Please check the default settings for Access Service Selection Rules: As you can see, we will get assigned to the Default Device Admin only if the request comes over TACACS+. Please verify that the request is getting as RADIUS to the server for it to hit Default Network Access instead. If this was helpful please rate. Regards. ... View more

Hello Marco, You should be able to install the same Large Deployment License on all three ACS servers. One of the Distributed Deployment requirements is to have DIFFERENT licenses on all of your ACS servers. However, that requirement refers to the BASE server license installed on the servers. As long as you have three different BASE licenses installed on your ACS servers you can install the upgrade license file (Large Deployment License) being the same on the three of them. If this was helpful please rate. Regards. ... View more

Hello, With the ACS server you include support to both TACACS+ (Device Management) and RADIUS (Network Access) authentication. With TACACS+ you can configure Command Restriction Sets and Assign specific Privilege Levels to the authenticated users. As RADIUS is meant for Network Access (VPN, Wireless) device management authentication and authorization is limited. Regards. ... View more

Hello, You can stop the ACS services from System  Configuration > Service Control > Click "Stop" in order to  simulate an outage on the server side. If you configure  your IOS AAA commands with "group tacacs+" and then "local" as a  fallback method, you should be able to access the device with the local  usernames defined on the IOS configuration. NOTE: If you are not able to access the IOS device after the above a password recovery might be needed on the IOS device. If this was helpful please rate. Regards. ... View more

THello, aaa new-model aaa authentication login default group tacacs+local aaa authorization exec default group tacacs+ local aaa authorization config-commands aaa authorization commands 0 default  group tacacs+ local aaa authorization commands 1 default  group tacacs+ local aaa authorization commands 15 default group tacacs+ local aaa accounting exec default start-stop group tacacs+ aaa accounting commands 0 default start-stop group tacacs+ aaa accounting commands 1 default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ tacacs-server host 10.1.1.1 tacacs-server key cisco123 The appropriate configuration order should be: 1) Define the server: tacacs-server host 10.1.1.1 tacacs-server key cisco123 2) Perform the test authentication command to confirm connectivity: test aaa group tacacs legacy 3) Define the login authentication command: aaa authentication login default group tacacs+local 4) Configure the TACACS+ server with the appropriate Enable and Shell (EXEC) Privilege level 15 and configure IOS for authorization: aaa authorization exec default group tacacs+ local 5) Configure the TACACS+ server with the allowed or restricted command sets based on user/group and then configure Command Authorization: aaa authorization config-commands aaa authorization commands 0 default  group tacacs+ local aaa authorization commands 1 default  group tacacs+ local aaa authorization commands 15 default group tacacs+ local 6) Configure TACACS+ accounting: aaa accounting commands 0 default start-stop group tacacs+ aaa accounting commands 1 default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ NOTE: AAA configurations can end up on lockouts. The above should be the appropriate order to configure the AAA command assuming that the server configuration is the appropriate one to pass Authentication and Authorization checks. If this was helpful please rate. Regards. ... View more

Hello, IOS configuration: Switch(config)#radius-server host 192.168.250.20 key cisco123 Switch(config)#aaa authentication login default group radius local Switch(config)#aaa authorization exec default group radius local IAS configuration: 1) Define the RADIUS client entry: 2) Define the IAS Policies: Click Edit Profile: Enable all methods under Authentication Tab: Under Advance leave only Service Type with Administrative value: The AD acount needs to have Dial-In Permission as "Allow Acces". Note: Click images to enlarge. If this was helpful please rate. Regards. ... View more

Hello, TACACS+ Outbound Password TACACS+ Outbound Password enables a AAA client to authenticate itself to another AAA client or end-user client via outbound authentication. The outbound authentication can be PAP, CHAP, MS-CHAP, or ARAP and results in the ACS password being given out. By default, the user's ASCII/PAP or CHAP/MS-CHAP/ARAP password is used. To prevent compromising inbound passwords, you can configure a separate SENDAUTH password. Use this feature only if you are familiar with TACACS+ SendAuth/OutBound password. For your specific scenario you can leave it blank. I just forgot to delete the default "dots" that the ACS adds to the user account. Regards. ... View more

Hello, Do you have the configuration you used at handy for you to share it with us? Also, which Authentication server are you using (ACS, NPS, IAS, Free Radius)? Regards. ... View more

Hello, You can either disconnect or make the TACACS+/RADIUS server unavailable for the IOS to fallback to the local IOS accounts and access the device. For this to work you should have configured "local" as a fallback method on the AAA Command. If not, a reboot might be needed (if you did not save the configuration after adding the AAA Commands) for you to access the device before activating AAA. If this was helpful please rate. Regards. ... View more

Hello Roberto, I am including the .pdf that describes ACS 5.2 installation on VMWare. Please find the .pdf file attached. If this was helpful please rate. Regards. ... View more

Hello, Was the issue occurring at the moment of the test or was authentication working as expected? We should check the AD connectivity status on both ACS servers when the authentication failures are reported. Regards. ... View more