Worked thanks ... View more

Hi I have this working on ACS 4.2 but I have upgraded to ACS Version : 5.5.0.46 and I am now unable to login. I have configured the rules and ACS logs are showing it's successful but on CTC I get error EID-2199 Login failed on <IP address> Exception = The Login did not succeed   Any chance you can update this article for the configuration required for ACS 5.x?       ... View more

Hi Guys, Well I configured the ACS following Scott's information, and I then tried to connect with the laptop and I got this. Logged At: October 12,2012 2:50:17.866 PM RADIUS Status: Authentication failed : 15039 Selected Authorization Profile is DenyAccess NAS Failure: Username: blah\eddy MAC/IP Address: 00-21-6a-07-31-88 Network Device: -WC-5508-01 : 10.10.2.10 :   Access Service: WirelessAD Identity Store: AD1 Authorization Profiles: DenyAccess CTS Security Group: Authentication Method: PEAP(EAP-MSCHAPv2) I copied the two rules used in the setup by Scott and I still get this. I have copied and pasted the logs below any ideas on how to get this to work? I dont have MARS is MARS required for this PEAP setup? 24423  ACS has not been able to confirm previous successful machine authentication for user in Active Directory Evaluating Identity Policy 15006  Matched Default Rule 15013  Selected Identity Store - AD1 24430  Authenticating user against Active Directory 24416  User's Groups retrieval from Active Directory succeeded 24101  Some of the retrieved attributes contain multiple values. These values are discarded. The default values, if configured, will be used for these attributes. 24420  User's Attributes retrieval from Active Directory succeeded 24402  User authentication against Active Directory succeeded 22037  Authentication Passed Evaluating Group Mapping Policy 11824  EAP-MSCHAP authentication attempt passed 12305  Prepared EAP-Request with another PEAP challenge 11006  Returned RADIUS Access-Challenge 11001  Received RADIUS Access-Request 11018  RADIUS is re-using an existing session 12304  Extracted EAP-Response containing PEAP challenge-response 11810  Extracted EAP-Response for inner method containing MSCHAP challenge-response 11814  Inner EAP-MSCHAP authentication succeeded 11519  Prepared EAP-Success for inner EAP method 12314  PEAP inner method finished successfully 12305  Prepared EAP-Request with another PEAP challenge 11006  Returned RADIUS Access-Challenge 11001  Received RADIUS Access-Request 11018  RADIUS is re-using an existing session 12304  Extracted EAP-Response containing PEAP challenge-response 12306  PEAP authentication succeeded 11503  Prepared EAP-Success 24423  ACS has not been able to confirm previous successful machine authentication for user in Active Directory any ideas guys? thanks for the help. ... View more

Hi Scott and George, Thanks very much for this information, I am going to give it a quick go and see how it goes. I have read the MAR doco link you sent Scott and it does seem a few people have issues with the AD and Certificate aspect with EAP TLS. George do you have any doco on the process for this EAP-PEAP/GTC I am intrigued and I would like to research every option available. thanks for your help so far. Eddy ... View more

Hi George, Thanks for your reply to my discussion, we had an external company come in to install the WLC and access points and I think they have confused my company requirements. What my company requires to meet security standard is two form factor authentication for the clients connecting to the wireless network. At first we tried RSA with AD and then we changed to AD with Certificates as each company's portable device has company certificate installed. After reading about the protocols and what you wrote, I guess we would require to use EAP-TLS as the client side would need the certificate can this include Active Directory? I am just looking at our test client laptop now is there a native supplicant client on windows 7 for EAP-TLS for wireless? Here are the settings i am currenly using and the supplicant clients I can choose. any help would be great George! ... View more

Hi Guys, thanks for all the replies the correct link is def what i was after, and the information from abpsoft looks like it will help out alot. My only issue is I am the network engineer and trying to get the server and systems team to help with the certicate is being a pain. I'll message you privately Andre maybe you could help me out? ... View more

Hi Tarki and Anim, Anim, thankyou for that information about functional levels, I am still looking into that.   Tarki, are you sure it's section 5.2.2 I have looked all over and didn't find anything relevant can you copy and paste the first few lines and I will do a search on the link? Thanks for your help guys ... View more

Hi Tarik, I am very close to completing this project but I have ran into a hurdle can you help me out? I have sent this docoument to my CA team (ACS cert setup for EAP export cert and installation.pdf) The only problem is when in this docoument it says select template ACS using your 2003 serverm, we aren't running 2003 server we are running 2008 R2 server, This doesn't have the option to select the ACS template? is there anyway we can import this template into 2008 R2 server? any help would be great ... View more

Hi Tarik, Thanks for that information, I am trying to remove the local ACS certificate that I generated by accident awhile ago, as this is not needed and it might be conflicting, when i try remove the certificate I get this error. This System Failure occurred: Certificate is associated with a protocol. Hence it cannot be deleted.. Your changes have not been save. Click OK to return to the list page. Is it Ok to leave this certificate or should I be removing this? I dont want this to clash with the intermediate and root certs that I have imported. ... View more

Hi Tarik, I have now upgraded my ACS to the latest version Cisco Secure ACS Version : 5.3.0.40.6 I have been given 3 certificates from the server and systems team, I have imported all 3 of these certificates to Users and Identity Stores > ... > Certificate Authorities I am using Cisco Peap on the windows 7 supplicant  Security type WPA2-entireprise AES. I validate the server certificate select my companies certificate in the trusted root cerificate authority field. I then connect to my wireless network, it prompt for username and password......... it access my LDAP setup on the ACS using GTC that i still currently have in place and allows me to connect. Each time I connect it comes up saying do I trust the ACS certificate which is stored here System Administration > ... > Configuration > Local Server Certificates > Local Certificates and lets the client connect. I want the client to only connect if it trusts the Company domain certificate, not the local ACS certifcate that came with the server. Are you able to help with intructions on what I am met to do? Cause I am lost........ ideally I would like it to use the certificates that i put here Users and Identity Stores > ... > Certificate Authorities Happy to take this convo offline really appertice some help. thanks ... View more

Hi Tarik, thanks for the information, I will be trying to implement an AD setup, Are you able to recommend the upgrade path I should take to reach ACS 5.3 My current verison is Cisco Secure ACS Version : 5.1.0.44.3 I am using the ACS appliance and I wouldnt want to revert back in case I did the upgrade incorrectly. ... View more

Hi Tarik, would you recommend using the EAP-TLS authentication method with the LDAP setup on the ACS or the Active Directory setup on the ACS? I found this docoument online and was going to follow this to try have Active directory user authentication and certificate based authentication. But this setup is with Active Directory setup in the ACS as LDAP doesn't support MS-CHAP in ACS. http://www.cisco.com/en/US/products/ps10315/products_configuration_example09186a0080b4cdb9.shtml would this be the ideal setup? it has auto enrollment of the clients so it would check the user that is logged into the PC is currently in AD, and that the machine has the certificates required. Also the supplicant is a standard on a windows 7 box? Any throughts? ... View more