Hi, we have TACACS+ based AAA on our network equipment, authenticating against internal user database on a network of ACS 5.3s. What I want is to limit certain AAA users (namely automated tools) to be only permitted to authenticate from a list of known IPs. I can do this for authorization, easily, that isn't a problem. The problem is to only accept authentication attempts coming from certain IPs and ignore the rest. My problem is, as it is currently, the automated tools are prone to a sort of a DoS attack - if I attempt logging in to any device using the tool's user account and a wrong password, I can get the account disabled in five tries. I want to ignore all authentication attempts, unless they are coming from well known source IPs. Ex: netmon user is the user for a tool running on server 10.20.30.40. If I try to log in from my own laptop with user netmon, it should fail, and the attempt ignored. Currently after five (or whatever is configured) failed attempts, the user will be disabled. Oly attempts from 10.20.30.40 should be considered for user netmon. I can't use ACLs on the devices, as I want other users to be able to log in from other IPs. Any ideas? ... View more

We have a CSM blade in a 6509, IOS 12.2(18)SXF7, CSM softvare version 4.2(7); We'd like to create a serverfarm, where servers are checked for several ports and only considered as working when all probes succeed. Although Cisco docs state that there should be a possibility to associate multiple probes with a serverfarm, I haven't managed to do so. Here's what I've tried: probe PING icmp interval 5 failed 10 receive 4 probe TCP-1234 tcp interval 10 retries 2 failed 25 port 1234 real PROBE-TEST-R address 1.2.3.4 serverfarm PROBE-TEST-SF real name PROBE-TEST-R   health probe PING   health probe TCP-1234 but when trying to add the second probe, I get: % You must first disassociate from probe PING. Any ideas, how multiple probes could be implemented? ... View more