Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About ivangonz
05-08-2019
Stats
Member since
03-10-2014
75
Posts
59
Helpful
18
Solutions
01-11-2016
05:41 AM
Hello Sandeep,
I am sorry, actually this is configured on ISE on that specific path:
Step 1 Choose Administration > Web Portal Management > Settings > Guest > Portal Policy.
Step 2 Check the Allow only one guest session per user option.
-This is documented on ISE user guide ( looks like this feature is added from ISE 1.2 version and above )
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_guest_pol.html#pgfId-1476405
... View more
12-31-2015
12:17 PM
Hi,
It is giving you a good sing that issue is on NPS server configuration, looks like on policies configured on it.
At this point, I think you might need to engage some Microsoft support to see what is wrong with the policies.
... View more
12-23-2015
07:52 AM
Hi Phil,
You are able to manage Privilege level being assigned to a user with Tacacs, however, you are not able to go into Privilege level without going through enable authentication, unless you go to 9.1 (5) code.
... View more
12-23-2015
04:52 AM
Hello Ruedier,
It might work for you, but I do not think ACS will be able to handle authentication request for 16,000,000, and additional to this, it is documented the ACS deployment limit is 100,000, hence 16,000,000 AAA clients would be an unsupported environment.
... View more
12-22-2015
02:38 PM
Hi Phil,
This is not an available option on the ASA version you are running. The option to be placed into privilege mode is available until ASA 9.1 (5) version:
http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/admin_management.html#pgfId-1223518
Note: Please mark it as answered if applicable
... View more
12-22-2015
02:27 PM
Hi,
Could you please share "show version" output for your 3850. it sounds like a bug.
Best regards,
... View more
12-22-2015
10:04 AM
Hi Ruediger,
This limit is for 100,000 AAA clients ( devices that will be using ACS as radius server, for example IOS devices, ASAs NX-OS etc ) you are able to create AAA clients using subnets ( if you use a subnet all IP addresses on that subnet will be counted for the 100,000 Network device limit ).
I hope this helps to clarify your concerns.
... View more
12-17-2015
08:48 AM
Hello Sandeep,
It seems to be this can not be limited based on ISE configuration, but you can do it on the WLC settings under the following section:
Choose Administration > Web Portal Management > Settings > My Devices > Portal Configuration.
Note: Please mark it as answered if applicable
... View more
12-17-2015
08:02 AM
Hello All,
Here is the issue. The command you are using to perform the test is using "radius" group which is default group IOS device uses to put the devices:
test aaa group radius admin admin$Pwd new-code
In order to test the configuration of the group you created and configured port 1812, you need to execute the test command using the group you created called " ISE-PRIMARY":
test aaa group ISE-PRIMARY admin admin$Pwd new-code/legacy
Note: Please mark it as answered if applicable
... View more
12-17-2015
07:56 AM
Hello Pranav,
For the authorization privileges to take effect you need to add the following command to your configuration on the ASA:
aaa authorization exec authentication-server
After adding it, the ASA will take into account the privilege level being sent by the ACS.
Related to the error you are getting on the GUI of the ACS, please make sure you are using supported browser for ACS 5.4 version based on the release notes :
http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-4/release/notes/acs_54_rn.html#pgfId-222016
Note: Please mark it as answered if applicable.
... View more
12-16-2015
07:24 AM
Hello Mo,
I have this error being either a browser issue, I would recommend to take a look at the ACS 5.3 release notes and confirm if you are actually using a supported browser:
http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-3/release/notes/acs_53_rn.html#pgfId-222016
A restart of the services might take care of it as well in case you are using a supported browser.
Note: Please mark it as answered if applicable
... View more
12-16-2015
07:15 AM
Hi,
It is strange NPS does not show any logs since from the debugs collected, we can see it is responding with "Access-challenge" after "Access-requests" are being sent.
The debug output attach does not contain full authentication thread, you might need to log the session on ".txt" file to see how it ends up.
Regards,
... View more
12-15-2015
10:01 AM
Hello,
I see authentication an authorization is failing from the output you have provided.
On the NPS server, I mean on the event logs, you should be able to see an access-request reaching the server.
At that point it will be necessary to enable the following debugs to see if the issue is with EAP of radius authentication, and check if you are getting access-accept or reject from the NPS server:
debug dot1x all
debug radius
debug authentication all
... View more
12-14-2015
12:25 PM
Hi,
A couple of questions about your setup:
1-Do you see the access request on the radius server logs?
2-Take a "show authentication session interface <interface>" output after recreating the issue
Regards,
... View more
01-11-2016
Hello Sandeep, I am sorry, actually this is configured on ISE on that
specific path: Step 1 Choose A...
12-31-2015
Hi, It is giving you a good sing that issue is on NPS server
configuration, looks like on policies c...
12-23-2015
Hi Phil, You are able to manage Privilege level being assigned to a user
with Tacacs, however, you a...
12-23-2015
Hello Ruedier, It might work for you, but I do not think ACS will be
able to handle authentication r...
12-22-2015
Hi Phil, This is not an available option on the ASA version you are
running. The option to be placed...
12-22-2015
Hi, Could you please share "show version" output for your 3850. it
sounds like a bug. Best regards,
12-22-2015
Hi Ruediger, This limit is for 100,000 AAA clients ( devices that will
be using ACS as radius server...
12-17-2015
Hello Sandeep, It seems to be this can not be limited based on ISE
configuration, but you can do it ...
12-17-2015
Hello All, Here is the issue. The command you are using to perform the
test is using "radius" group ...
12-17-2015
Hello Pranav, For the authorization privileges to take effect you need
to add the following command ...
12-16-2015
Hello Mo, I have this error being either a browser issue, I would
recommend to take a look at the AC...
12-16-2015
Hi, It is strange NPS does not show any logs since from the debugs
collected, we can see it is respo...
12-15-2015
Hello, I see authentication an authorization is failing from the output
you have provided. On the NP...
Public Statistics
| Date Registered | 03-10-2014 09:27 AM |
| Date Last Visited | 05-08-2019 12:01 AM |
| Total Messages Posted | 75 |
| Total Helpful Votes Received | 59 |
Helpful Votes From
