Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About andrew-hunt
08-01-2018
Stats
Member since
04-01-2008
13
Posts
0
Helpful
0
Solutions
Created by
andrew-hunt
in Policy and Access
in Policy and Access
06-24-2015
05:13 PM
06-24-2015
05:13 PM
We have a number of 5508 WLCs running 7.6.100.0 code where we authenticate the management user against Cisco ACS 5.3 using TACACS+ If you attempt to login either via the web or via SSH the first attempt fails, but the second is successful. ACS shows both authentication attempts as succeeding. The WLC shows the first attempt as failing "AAA Authentication Failure for UserName:manager User Type: WLAN USER" However, the second attempt is shown as successful "AAA Authentication Success for UserName:manager User Type: MGMT USER(READ WRITE)" Can anyone shed any light as to why the first login attempt is WLAN USER? I cannot see anything in the configuration that would cause this. Management user priority is set to TACACS first, Local second. Thanks!
... View more
Labels:
Created by
andrew-hunt
in Policy and Access
in Policy and Access
02-25-2014
04:05 AM
02-25-2014
04:05 AM
Yes, NTP is fine. This is a four-node ACS deployment and everything was working fine until recently. However, the issue is actually now fixed. I issued debug-adclient enable from which I was able to see that the ACS instance was connecting to a DC in Singapore (the ACS box is in California) which led me to assume that the subnet wasn't associated with the correct AD site. I added the subnet to AD Sites and Services, waited for replication, and then restarted ACS. It is now associated with the correct local DC and working correctly. I assume the problem was caused by high latency / timeouts. Thanks for your help and suggestions.
... View more
Created by
andrew-hunt
in Policy and Access
in Policy and Access
02-25-2014
02:50 AM
02-25-2014
02:50 AM
Thanks for the post but this is not our issue. We don't see that output in the log. The output is: Feb 25 02:46:02 DRACS adclient[10643]: WARN audit User 'AHunt' not authenticated: AD was unavailable for Kerberos authentication, and validation against cached hash failed: No user hash in cache for lw\ahunt This seems awfully like our issue: http://community.centrify.com/t5/DirectControl-Express-for-UNIX/Maually-specified-DC-s-because-No-DNS-having-issues/td-p/8934 Any thoughts? Thanks! Andrew.
... View more
Created by
andrew-hunt
in Policy and Access
in Policy and Access
02-20-2014
03:28 AM
02-20-2014
03:28 AM
We have a four-node ACS deployment and one node is experiencing problems when handling TACACS authentications. ACS shows "24495 Active Directory Servers are not available" The ACS log via SSH shows: Feb 20 03:01:29 DRACS adclient[10643]: WARN <fd:29 CAPIAuthValidatePlainTextUser > audit User 'AHunt' not authenticated: AD was unavailable for Kerberos authentication, and validation against cached hash failed: No user hash in cache for [domain]\ahunt We're running ACS 5.3 with patch 9 The two scenarios in http://www.cisco.com/c/en/us/support/docs/security/secure-access-control-system/113485-acs5x-tshoot.html#err24495 do not seem to be relevant in our case. ACS shows it is joined to the domain and doing nslookup via SSH lists all the domain controllers. The other three nodes in the deployment don't have an issue and work correctly. Any advice or suggestions appreciated. Thanks, Andrew.
... View more
Labels:
Created by
andrew-hunt
in Wireless and Mobility
in Wireless and Mobility
02-26-2013
02:48 AM
02-26-2013
02:48 AM
Hello all, Is anyone aware of the CLI command to enable / disable the DHCP Addr. Assignment required WLAN option on a 5508 controller running 7.2.110.0 code? I don't seem to be able to find it documented anywhere, and if it is available via CLI it's not intuitive. Thanks for any insight anyone can shed, Andrew.
... View more
Labels:
Created by
andrew-hunt
in Policy and Access
in Policy and Access
10-17-2012
03:47 AM
10-17-2012
03:47 AM
Hello all, I am trying to use RADIUS authentication for Brocade SAN switches, specifically the HP AJ821A switch for the c-class blade enclosure. SAN switch configuration is: aaaconfig --add 10.180.250.222 -conf radius -s sharedsecret -a peap-mschapv2 aaaconfig --authspec "radius;local" -backup ACS is configured with an Access Service set to PEAP with the inner method as EAP-MS-CHAPv2 Authentication works fine if set to PAP (so I know it's hitting the right service and so forth) but when it is set to PEAP I get the following error: 11818 Failed to parse EAP-MSCHAP packet Any suggestions? Anyone else run into this problem? Anyone managed to get it working? Thanks, Andrew.
... View more
Labels:
07-23-2012
05:48 AM
Hello all, I have a 4506-E catalyst with a WS-X45-SUP6L-E running cat4500e-lanbase-mz.122-54.SG1.bin. The switch keeps resetting and the only output we can capture is a single "Vector 0" entry. Logging to a syslog server generates no input. The three linecards are powered down to eliminate them from being the source of the issue. Has anyone come across this issue before? I cannot set boot diagnostics to anything other than minimal - the diagnostic bootup level complete command isn't recognised. Thanks for any suggestions! Cheers, Andrew.
... View more
Labels:
Created by
andrew-hunt
in VPN and AnyConnect
in VPN and AnyConnect
01-20-2012
11:59 AM
01-20-2012
11:59 AM
We have a number of 5505 ASAs at remote sites all of which are configured to connect to one of two head-end servers. Relevant config is: vpnclient server a.b.c.d e.f.g.h We need to change the primary head-end IP addresses. At the moment devices are successfully connected to the secondary. If we issue vpnclient server i.j.k.l e.f.g.h then the device drops off the network and won't reconnect until it is power cycled. If we make the changes in ASDM using the GUI to remove the old primary and add in the new primary the ASDM says "No changes made" Devices are running 8.2 and 8.4 code and behaviour is the same. Question is, therefore, how to change head-end server IP addresses without the device disconnecting and not coming back up? According to the configuration guide the ASA should cycle through the addresses every 8 seconds until it can connect - but it doesn't seem to do this as it won't connect to the good secondary head-end either! Thanks, Andrew.
... View more
Labels:
10-19-2011
09:47 AM
Hello Nik, Looks like you're right. I have just tried with 12.2(55)SE4 and the RPS works as it should. Something's definitely broken in 12.2(58)SE2 and also 15.0 I really appreciate your help with this! Thanks again! Best wishes, Andrew.
... View more
10-19-2011
08:57 AM
Hello Nik, We have done more testing. We have an identical set-up in our Dubai office: 4 x 3750E switches and an RPS 2300. It works as designed. The switches in Dubai are running 12.2(50)SE2 of the 3750 universalk9 image Downgrading Abu Dhabi to the same version of IOS results in the RPS working there too. I have attached a couple of text files showing the results. The question now is in which version of IOS does this become a bug, and how do we get it resolved? I am happy to run with 12.2(50)SE2 for now as we've seen no issues in Dubai but there are a lot of issues with that version and I'd prefer to upgrade to something later - but don't really want to test each release until I find one that breaks... Any thoughts? Thanks again, Andrew.
... View more
10-18-2011
04:07 AM
Hello Nik, We have tested using all four 3750E switches in the stack and the behaviour is the same - the switch will remain online but we lose PoE We have another RPS in our Dubai office so we will ship that to Abu Dhabi on Thursday and test with that. I will follow up on Thursday with the results of the test. Just FYI we also changed the RPS cable order so Port 1 on the RPS goes to Switch 1 in the stack, Port 2 to Switch 2 and so forth just in case there was some weird logic regarding that. We also tried with only two switches connected to RPS power - but the results were identical. Thanks for your continued help. I'll let you know what happens on Thursday. Best wishes, Andrew.
... View more
10-17-2011
01:20 AM
Hello Nik, The info you need is in the attached text file. Just to reiterate one point and that is that this is a new install, so we only have a single PoE device plugged in to the stack at the moment. The behaviour is the same whether we physically unplug the power lead from the catalyst or use the power supply 4 off command. Thanks for taking a look at this - much appreciated. Andrew.
... View more
10-13-2011
03:27 AM
I have a problem with a 4-switch stack of 3750E-48PD-SF catalysts that are connected to a single RPS 2300. Each switch has 1 x 1150W power supply. The RPS 2300 has 2 x 1150W power supplies. The problem is that whenever we lose mains power to a single 3750E switch we lose PoE on that switch, even though the other three switches in the stack retain mains power and the RPS is backing up the switch with the failed PSU. The switch remains online, we just lose PoE. We're running the c3750e-universalk9-mz.150-1.SE version of IOS #sho env rps SW Status RPS Name RPS Serial# RPS Port# -- ------------- ---------------- ----------- --------- 1 Active RPS_2300 FDO1529YJ64 4 2 Active RPS_2300 FDO1529YJ64 3 3 Active RPS_2300 FDO1529YJ64 2 4 Active RPS_2300 FDO1529YJ64 1 RPS Name: RPS_2300 State: Active PID: PWR-RPS2300 Serial#: FDO1529YJ64 Fan: Good Temperature: Green RPS Power Supply A: Present PID : C3K-PWR-1150WAC Serial# : ART1524W04X System Power : Good PoE Power : Good Watts : 300/800 (System/PoE) RPS Power Supply B: Present PID : C3K-PWR-1150WAC Serial# : ART1524W07U System Power : Good PoE Power : Good Watts : 300/800 (System/PoE) DCOut State Connected Priority BackingUp WillBackup Portname SW# ----- ------- --------- -------- --------- ---------- --------------- --- 1 Active Yes 1 No Yes AD_RPS_2300 4 2 Active Yes 2 No Yes AD_RPS_2300 3 3 Active Yes 3 No Yes AD_RPS_2300 2 4 Active Yes 4 No Yes AD_RPS_2300 1 5 Active No 5 No Yes <> - 6 Active No 6 No Yes <> - We only have a single powered device on the switch at the moment (as it's not yet in production). Each switch has been set a separate priority with the intention that in the event of a total power failure the two most critical switches will remain online. When we simulate a power failure the debug shows: Oct 12 19:03:58.693: %PLATFORM_ENV-6-FRU_PS_OIR: FRU Power Supply 1 powered off(CatAD14-4) Oct 12 19:03:59.406: %ILPOWER-7-DETECT: Interface Gi4/0/2: Power Device detected: IEEE PD (CatAD14-4) Oct 12 19:03:59.739: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet4/0/2, changed state to down Oct 12 19:03:59.406: %ILPOWER-5-ILPOWER_POWER_DENY: Interface Gi4/0/2: inline power denied. Reason: Insufficient total available power (CatAD14-4) Has anyone else come across this issue or have any inspired ideas as to what may be the reason? Thanks! Andrew.
... View more
Labels:
Created by
andrew-hunt
in Policy and Access
06-24-2015
06-24-2015
We have a number of 5508 WLCs running 7.6.100.0 code where we
authenticate the management user again...
Created by
andrew-hunt
in Policy and Access
02-25-2014
02-25-2014
Yes, NTP is fine. This is a four-node ACS deployment and everything was
working fine until recently....
Created by
andrew-hunt
in Policy and Access
02-25-2014
02-25-2014
Thanks for the post but this is not our issue. We don't see that output
in the log. The output is:Fe...
02-20-2014
We have a four-node ACS deployment and one node is experiencing problems
when handling TACACS authen...
Created by
andrew-hunt
in Wireless and Mobility
02-26-2013
02-26-2013
Hello all,Is anyone aware of the CLI command to enable / disable the
DHCP Addr. Assignment required ...
Created by
andrew-hunt
in Policy and Access
10-17-2012
10-17-2012
Hello all,I am trying to use RADIUS authentication for Brocade SAN
switches, specifically the HP AJ8...
07-23-2012
Hello all,I have a 4506-E catalyst with a WS-X45-SUP6L-E running
cat4500e-lanbase-mz.122-54.SG1.bin....
Created by
andrew-hunt
in VPN and AnyConnect
01-20-2012
01-20-2012
We have a number of 5505 ASAs at remote sites all of which are
configured to connect to one of two h...
10-19-2011
Hello Nik,Looks like you're right. I have just tried with 12.2(55)SE4
and the RPS works as it should...
10-19-2011
Hello Nik,We have done more testing. We have an identical set-up in our
Dubai office: 4 x 3750E swit...
10-18-2011
Hello Nik,We have tested using all four 3750E switches in the stack and
the behaviour is the same - ...
10-17-2011
Hello Nik,The info you need is in the attached text file. Just to
reiterate one point and that is th...
Public Statistics
| Date Registered | 04-01-2008 03:31 AM |
| Date Last Visited | 08-01-2018 02:27 AM |
| Total Messages Posted | 13 |
