Great  thanks for you Tomas for very detailed answer! Sorry, but as soon as you answered I prepared more questions. 1. The whole picture of my project is presented in attached file "DMM_VideoLessons_2.0". 1.1 IP-cameras located in the class rooms (training center №1 and №2) are designed for recording the educational process: industrial training lessons, presentations etc. 1.2 Records are feeded to the storage and are published on the video portal. Recorded training lessons are archieved and stored. 1.3 Corporate users receives on-line or off-line remote training lessons using the video portal. 1.4 DMP-devices provides remote training translations for remote user groups and remote classes. Note that IP-camers and video server (DMM, SnS) are located in the same VLAN (testing scheme).      The question is: What is wrong in the topology below?     As far as I understand, according to the "multicast stream fteching",  my topology should looks like this ("DMM_VideoLessons_2.0"): Is it right? 2. Could you be so kind to clarify: 2.1 What should I do to to view video from IP-cameras on corporate users desktops? Special software? Or just using SnS video portal via web-broser? 2.2 It it technically impossible to view video from IP-cameras on DMP and on corporate users desktops simultaneously? If possible what do I need to do? 2.3  What it the problem may be while trying to preview the uploaded video on SnS?  (see the screenshot "SnS_uploaded_video_error"). Appreciate you in advance! ... View more

In the Nexus 1000v config guide "user-vrf" command is named as "optional". Also given tacacs configuration example have no this command. And that fact confused me... Thank you once again! ... View more

Thanks! Now it works! But why does this configuration begin working only after "user-vrf management" command? ... View more

Wow, that's it! Thank you gentlemen, that was the decision: (config)# feature private-vlan This command is really absent in the given link http://www.cisco.com/en/US/docs/switches/datacenter/nexus1000/sw/4_2_1_s_v_1_4/layer_2_switching/configuration/guide/n1000v_l2_4pvlan.html Thanks once again! ... View more

Hi, Abbharga! Thank you for the fast answer! No doubt, that version 1.4 do support PVLAN. But what about my screenshots? As you can see, when I try to issue the "private-vlan primary" in the vlan configuration mode, the CLI answers: "...invalid command..." ... View more

The problem is - my customer do not understand the necessity of creating the account with administrative (or create/delete computer objects) rights. As I understand, if I try to integrate the Cisco ACS and Windows AD using LDAP, so the account for ACS server can just be a user account in domain. I think this is the best decision in my situattion. By the moment I have two questions. 1) When Integrating Cisco ACS and Windows AD using LDAP will I be able to use Radius attributes? For example downloadable access lists for auth-proxy users or remote access users. 2) What can be the problem with adding LDAP groups to Cisco ACS? I can not see any LDAP group in Cisco ACS Directory Group tab. My parameters are the folowing: Subject Object Class: Person Group Object Class: group Subject Name Attribute: sAMAccountname Group Name attribute: memberof Subject Search Base: dc=lab, dc=net Group Object Base: dc=lab, dc=net Test bind to server: Bind test successful. Found 10 groups and 35 objects. ... View more

Hi! If you plan to implement NAC-framework only for your LAN users, you DON'T need ACS. NAC manager authenticates Windows AD users with kerberos tickets. All configurations are made on NAC manager. There are two cases when you NEED Cisco ACS in NAC-enabled network: 1) If you plan to implement VPN single-sign-on. Here NAC manager authenticates remote-access users who connects to Cisco ASA/ISR via RADIUS requests, destined to ACS. 2) If you plan to implement single-sign-on for wireless users. Here NAC manager authenticates wireless users who connects to Cisco Wireless controller via RADIUS requests, destined to ACS. ... View more

Hello! Maybe my answer will help you. So, I had a similar problem with my Out-of-Band Real-IP-Gateway deployment. The reason was that NAC agent was still commnicating with untrusted interface of the NAC server, after logging in with Windows AD login/password. And of course, NAC agent pop up again, after client successfully looged in with active directory login\password, and his computer were transferring from "auth" vlan to "access" vlan. Cisco experts says, that it's better to brake communication between NAC agent and NAC server, if the client machine is in access vlan. You can implement, for example, an access-list for "access" vlan. The goal of that access-list is to deny all packets destined for NAC server, and permit all other packets. ... View more