Hi Everyone, I wanted to note an issue I ran into today with our MS Windows 7 workstations and 2008 servers being unable to access the web management interface on our instance of ACS 5.3 and its solution, which is outlined below: ######################## ###      The Problem      ### ######################## When I tried accessing the web management interface on our ACS 5.3 appliance, the browser was unable to connect.  NMS applications showed that the device was up and I was able access it via SSH.  I then tried connecting to 443 via telnet on my workstation and was successful in establishing a connection.  I proceeded to issue the "show application status acs" command showed all associated processes running.  I had a co-worker attempt to access it and he ran into the same issue.  I then proceeded to restart the ACS application by stopping and starting the associated processes.  After the processes were back up, attempts to connect to the web management interface still failed.  I then proceeded to reboot the appliance.  Again, after the applicance and processes were back up, attempts to connect continued to fail.  As a last ditch effort I used a portable version of Firefox to connect and was then successfully able to connect. ######################## ###       The Source        ### ######################## After additional troubleshooting, it was discovered that the MS Internet Explorer patch associated with MS Security Advisory 2661254 just so happened to be the culprit.  This restricts the use of certificates with RSA keys less than 1024 bits in length.  The default management certificate just so happens to be 512 bits in length. ######################## ###          The Fix           ### ######################## Using FireFox, I navigated to System Administration > Configuration > Local Server Certificates > Local Certificates.  I then proceeded to add a certificate in the following steps: Select Generate Self Signed Certificate & click next Populate the Certifcate Subject field with the appropriate DN information of the ACS server. Change the key length to 1024 or above. Check "Management Interface:  Used to authenticate the web server (GUI). Check "Replace Certificate". Click Finish. The ACS server should then generate the new certifcate, replace the existing management certificate, and restart the ACS processes.  After everything is back up, you shouldn't have any issues in accessing the web interface. Cheers, Dan Great job. To add to it, here is the workaround (if the cert cannot be replaced immediately): certutil -setreg chain\minRSAPubKeyBitLength 512 Run this on the PC accessing the page. Rate if useful Hello Dan, Thank you for trying to share the information you have. Note please if you want to share information you can post a document, not a discussion. You can convert this discussion into a document from the right pane menu. Greetings, Amjad Rating useful replies is more useful than saying " Thank you " This document was generated from the following discussion: Unable to Access CSACS 5.3 Web Interface... ... View more

############################# #####       The Problem        ##### ############################# Last Friday, I was asked "What did you do to the routers?", shortly after arriving on site.  The person who asked me the question was referring to two ASR1001s that were going to be deployed.  I went to the deployment area to see what he was talking about and noted that the ASR would boot the image and then it would fail to initialize NVRAM.  A symptom we replicated on three routers.  ############################# #####      The Resolution      ##### ############################# Not noted above was the fact that these ASRs are on DC power.  The unit supplying power was initially set to 48v and we ended up changing it to 52v.  Once the change was made, the ASR1001s were able to initialize NVRAM and operate normally.  ... View more

Hi Everyone, I wanted to note an issue I ran into today with our MS Windows 7 workstations and 2008 servers being unable to access the web management interface on our instance of ACS 5.3 and its solution, which is outlined below: ######################## ###      The Problem      ### ######################## When I tried accessing the web management interface on our ACS 5.3 appliance, the browser was unable to connect.  NMS applications showed that the device was up and I was able access it via SSH.  I then tried connecting to 443 via telnet on my workstation and was successful in establishing a connection.  I proceeded to issue the "show application status acs" command showed all associated processes running.  I had a co-worker attempt to access it and he ran into the same issue.  I then proceeded to restart the ACS application by stopping and starting the associated processes.  After the processes were back up, attempts to connect to the web management interface still failed.  I then proceeded to reboot the appliance.  Again, after the applicance and processes were back up, attempts to connect continued to fail.  As a last ditch effort I used a portable version of Firefox to connect and was then successfully able to connect. ######################## ###       The Source        ### ######################## After additional troubleshooting, it was discovered that the MS Internet Explorer patch associated with MS Security Advisory 2661254 just so happened to be the culprit.  This restricts the use of certificates with RSA keys less than 1024 bits in length.  The default management certificate just so happens to be 512 bits in length. ######################## ###          The Fix           ### ######################## Using FireFox, I navigated to System Administration > Configuration > Local Server Certificates > Local Certificates.  I then proceeded to add a certificate in the following steps: Select Generate Self Signed Certificate & click next Populate the Certifcate Subject field with the appropriate DN information of the ACS server. Change the key length to 1024 or above. Check "Management Interface:  Used to authenticate the web server (GUI). Check "Replace Certificate". Click Finish. The ACS server should then generate the new certifcate, replace the existing management certificate, and restart the ACS processes.  After everything is back up, you shouldn't have any issues in accessing the web interface. Cheers, Dan ... View more