Hello Imran, From the error displayed on the Windows Supplicant it seems that you are using EAP-TLS (User Certificate Authentication). If that is the case you need to check if the Windows XP OS has the ID certificate for the user installed under the Personal ID store for the OS to use that certificate during authentication. Regards, Carlos. ... View more

Hello, Which type of authentication are you performing? Is this for some type of VPN access like VPN Client (IPSec) or AnyConnect? Regards, Carlos. ... View more

Hello Mubashir, Can you please add the following command to the Access Switches that the users are connecting to and experiencing the error? "mac address-table notification mac-move" Please update with the results after adding the command mentioned above. Regards, Carlos. ... View more

Hello, If matching the first bug you can also configure the IOS AAA command: aaa accounting system guarantee-first The above command explanation: The aaa accounting system guarantee-first command guarantees system accounting as the first record, which is the default condition. In some situations, users may be prevented from starting a session on the console or terminal connection until after the system reloads, which can take more than three minutes. To establish a console or telnet session with the router if the AAA server is unreachable when the router reloads, use the no aaa accounting system guarantee-first command. Regards. ... View more

Hello Dean, You might be running on either of the two following known issues: http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsw79561 CSCsw79561            Bug Details DROPACCTFAIL: System Accounting fails with tacacs Symptom: On affected switches, the switch is slow to respond to login requests after reboot, displaying a repeated message of % Authentication failed while not allowing entry of the username for authentication.  This problem fixes itself within minutes, but during the first few minutes of boot, login via telnet or console is impossible. "show log" output from the same time period will show: %AAA-3-DROPACCTFAIL: Accounting record dropped, send to server failed: system Conditions: External accounting enabled for system events such as: aaa accounting system default start-stop group tacacs+ Workaround: Wait for a few minutes after a reboot or restart event prior to telnetting into the switch. Further Problem Description: Symptoms are the same as those described in CSCsk50769. Or http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsx07352 CSCsx07352            Bug Details Console stuck with "authentication failed" on save & reload for sys acco Symptom: With 'aaa accounting' and 'aaa authen' configured on a switch, we are unable to login to the switch at all. Also, it's possible the switch will hang on issue of 'reload' from the CLI. Conditions: The two conditions must be met: - AAA accounting must be configured - AAA authentication must be configured Workaround: Disable 'AAA accounting' configuration If this was helpful please rate. Regards. ... View more

Hello, I am quoting previous post: " Hello, Go  to Cisco.com > Products > Security > Identity Management >  Cisco Secure Access Control System > Cisco Secure Access Control  System 5.1 > Secure Access Control System Software-5.1.0.44 >  Download "ACS_v5.1.0.44.iso" You need to install the .iso file as described on the attached .pdf document. After  properly installing the ACS 5.1 as described on the .pdf you can  generate an Evaluation License as described on the other .pdf document. Hope this helps. Regards. Attachments: csacs_vmware.pdf (782.3 K)     Preview Evaluation License Generation.pdf (501.4 K)     Preview " Refer to: https://supportforums.cisco.com/message/3550029#3550029 If the answers have been helpful please rate. Regards ... View more

Hello, I am attaching two documents. One describes the ACS Integration with AD (In case you would be authenticating VPN access against AD through ACS). Also, I am including a document on how to push the Group Policy the user should get assigned from the ACS server using the RADIUS Class attribute.. If this was helpful please rate. Regards. ... View more

Hello Alex, Can you share a screenshot of your Authorization Rules? NOTE: the ones that refer to the AD Group Membership of the user. I am assuming the ACS "Default" Rule is set to Permit Access when it should be set to Deny Access. If this was helpful please rate. Regards. ... View more