Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About dynamitec1
Stats
Member since
07-13-2012
38
Posts
10
Helpful
1
Solution
07-16-2013
05:05 PM
Kashish, Pretty sure you meant MDA puts it on either on DATA or VOICE "domain." You have to create a RULE in your RADIUS server that places VOIP phones into VOICE domain. If you look at topics I responded to, you will see what I have gone through. Sent from Cisco Technical Support iPhone App
... View more
Created by
dynamitec1
in Policy and Access
in Policy and Access
06-26-2013
06:40 PM
06-26-2013
06:40 PM
Mac-move is enabled by default. Unfortunately, authentication violation replace is not an option in my network. Thank you for the response. Sent from Cisco Technical Support iPhone App
... View more
Created by
dynamitec1
in Security Management
in Security Management
06-18-2013
08:30 AM
06-18-2013
08:30 AM
With SINGLE RADIUS-SERVER GROUP configured, dot1x computer authenticates only once (if lucky), and then switch reload is needed. global config dot1x system-auth-control aaa authentication dot1x default group radius aaa authentication network default group radius aaa accounting network default start-stop group radius radius-server host 192.168.128.123 auth-port 1812 acct-port 1646 key radkey radius-server host 192.168.128.121 auth-port 1645 acct-port 1646 key radkey radius-server vsa send cisco-nas-port radius-server vsa send accounting radius-server vsa send authentication interface config: sw mode access sw access vlan ID sw voice vlan ID auth host-mode multi-domain authentication order mab dot1x authentication priority mab dot1x authentication port-control auto authentication periodic mab dot1x pae authenticator dot1x timeout tx-period 3 span portfast span bpduguard enable I reconfigured the switch with TWO RADIUS SERVER GROUPS, now port-security is triggered. global config for TWO radius server-group: aaa group server radius RADIUS-PRI server 192.168.128.123 auth-port 1812 acct-port 1646 aaa group server radius RADIUS-SEC server 192.168.128.121 aaa authentication dot1x default group RADIUS-PRI group RADIUS-SEC aaa authorization network default group RADIUS-PRI group RADIUS-SEC aaa accounting dot1x default start-start group RADIUS-PRI group RADIUS-SEC Thank you, A Message was edited by: Adam Andersen, logs uploaded.
... View more
Created by
dynamitec1
in Policy and Access
in Policy and Access
06-17-2013
05:35 PM
06-17-2013
05:35 PM
Agree with Jatin. The only defaul admin account is "acsadmin." Sent from Cisco Technical Support iPhone App
... View more
Re: dot1x authentication some problom
in Policy and Access
06-17-2013
10:44 AM
06-17-2013
10:44 AM
Mine is 3750X 12.2(55). It worked the first time using multi-domain, but once I unplugged the 7945 phone, it stopped working. The device behind the IP Phone is able to authenticate using dot1x. I had to reload the switch each time I want the "mab" for IP phone to work. Sent from Cisco Technical Support iPhone App
... View more
Created by
dynamitec1
in Security Management
in Security Management
06-13-2013
05:36 PM
06-13-2013
05:36 PM
Im using Cisco ACS for 802.1x with mab, and Im having the same issue. I cant even move to another port as it fails to authenticate. My logs are looks similar to yours. Sent from Cisco Technical Support iPhone App
... View more
06-12-2013
05:15 PM
have you tried this WoL command? "authentication control direction both" Sent from Cisco Technical Support iPhone App
... View more
05-01-2013
08:38 AM
extend system-id enabled and no adverse impact. Sent from Cisco Technical Support iPhone App
... View more
Created by
dynamitec1
in Policy and Access
in Policy and Access
04-19-2013
08:01 AM
04-19-2013
08:01 AM
J, Thank you very much for asking about the ACS error! So, I went to ACS dashboard [Authentication TACACS - Today and Yesterday]. Found multiple errors with reference to our HSRP standby/virtual IP. It was denying packets from 128.1, 128.2, and 128.3. DESCRIPTION A TACACS+ packet was received with a source IP Address that did not match any configured Network Device or AAA Client RESOLUTION Verify that the Network Device or AAA client is configured in Network Resources > Network Devices and AAA Clients > I examined the IP on Network Devices and AAA clients, and added those three IP referenced above. Originally, I only had the Management VLAN IP range for network devices and AAA clients, and the ACS/LMS IPs. License we have is only good for 500 devices, manangement VLAN IP range was /23 [we're not using all IP, so I reverted back to /24]. J: Thank you for asking the RIGHT QUESTION! All is well!!!
... View more
Created by
dynamitec1
in Policy and Access
in Policy and Access
04-18-2013
08:38 AM
04-18-2013
08:38 AM
J, Attached is the debug output. Also, I ran traceroute from other DSW and random ASW, see results below: DSW4#traceroute 10.10.128.121 Type escape sequence to abort. Tracing the route to 10.10.128.121 1 * * * 2 * * * 3 * * * 4 * * * 5 * * * DSW2#traceroute 10.10.128.119 1 131.34.128.119 0 msec 0 msec 0 msec I ran traceroute from all other switches, they all found the route to 10.10.128.121 via DSW1 Tracing the route to 10.10.128.121 1 10.10.10.24 0 msec 4 msec 0 msec I might just create a static route to 10.10.128.121 from the two DSW that is having this issue. FYI, we are using eigrp.
... View more
04-17-2013
02:15 PM
I, too, am having issue. Solutions attempted, but still failed: 1. entered tacacs key again 2. restarted Cisco ACS 5.2 server 3. added "ip tacacs source-interface" command Here's the original post I created. I didnt know what to search originally, so created a separate topic/thread. https://supportforums.cisco.com/thread/2203407 Thank you, Adam
... View more
04-08-2013
02:36 PM
Giuseppe, I have 3 distro switch have a priority value of 16384. The main distro switch connected to my router has a value of 8192. I, too, received the same message when I attempted to create VLAN1725. I have successfully created the SVI for the said VLAN. Should I enable spanning-tree extend system-id during after-hours? You mentioned that the impact is limited, what's the worst thing that could happen? Thank you.
... View more
Created by
dynamitec1
in Policy and Access
in Policy and Access
03-30-2013
07:31 AM
03-30-2013
07:31 AM
Found the definitive answer for this question: 50,000 network devices, 300,000 internal hosts...wow!! http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.2/migration/guide/Migration_Deploy.html#wp1054675 Sent from Cisco Technical Support iPhone App
... View more
Created by
dynamitec1
in Policy and Access
in Policy and Access
03-29-2013
12:57 PM
03-29-2013
12:57 PM
I hope you're right, jrabinow Because I have 7,000 hosts that I need to add. I dont want to find out that max number of host is less than 7,000..that would be really frustrating..lol @ ewood2624 you are referring to max number to import using csv, not max number of hosts that could reside internally.
... View more
07-16-2013
Kashish,Pretty sure you meant MDA puts it on either on DATA or VOICE
"domain."You have to create a R...
Created by
dynamitec1
in Policy and Access
06-26-2013
06-26-2013
Mac-move is enabled by default. Unfortunately, authentication violation
replace is not an option in ...
Created by
dynamitec1
in Security Management
06-18-2013
06-18-2013
With SINGLE RADIUS-SERVER GROUP configured, dot1x computer authenticates
only once (if lucky), and t...
Created by
dynamitec1
in Policy and Access
06-17-2013
06-17-2013
Agree with Jatin. The only defaul admin account is "acsadmin."Sent from
Cisco Technical Support iPho...
06-17-2013
Mine is 3750X 12.2(55). It worked the first time using multi-domain, but
once I unplugged the 7945 p...
Created by
dynamitec1
in Security Management
06-13-2013
06-13-2013
Im using Cisco ACS for 802.1x with mab, and Im having the same issue. I
cant even move to another po...
06-12-2013
have you tried this WoL command?"authentication control direction
both"Sent from Cisco Technical Sup...
05-01-2013
extend system-id enabled and no adverse impact.Sent from Cisco Technical
Support iPhone App
Created by
dynamitec1
in Policy and Access
04-19-2013
04-19-2013
J,Thank you very much for asking about the ACS error!So, I went to ACS
dashboard [Authentication TAC...
Created by
dynamitec1
in Policy and Access
04-18-2013
04-18-2013
J,Attached is the debug output.Also, I ran traceroute from other DSW and
random ASW, see results bel...
04-17-2013
I, too, am having issue.Solutions attempted, but still failed:1. entered
tacacs key again2. restarte...
04-08-2013
Giuseppe,I have 3 distro switch have a priority value of 16384. The main
distro switch connected to ...
Created by
dynamitec1
in Policy and Access
03-30-2013
03-30-2013
Found the definitive answer for this question: 50,000 network devices,
300,000 internal
hosts...wow!...
Public Statistics
| Date Registered | 07-13-2012 08:35 AM |
| Date Last Visited | 08-18-2017 04:03 AM |
| Total Messages Posted | 38 |
| Total Helpful Votes Received | 10 |
Helpful Votes Given To
.jpg "Hall of Fame Community Legend"){kind=icon}
