Hello, Routers requires more work. If you still need assistance please let me know. Regards, ... View more

Hola, En algunos L3 switches es posible hacerlo. Cual es la version de switch y el IOS version? Si lo que quieres es restringir el telefono por que no haces ACL en la vlan de voice? Recuerda que los telefonos estan en una vlan diferente. Saludos, ... View more

Hello, In regards of the kerberos issue looks like the ASA and the AD server don't have the same time. Please make sure that the time is configure correctly. For the LDAP issue please send me a debug ldap 255 output. A 3rd option will be to enable IAS or NPS on your windows server and use radius. Regards, ... View more

Hola Luis, Hay que chequear que los formatos de los DACL esten correctos y que no sean demasiados para el ASA. Por favor mandar las DACL configuradas en el ACS y también debug radius output del ASA. Si estas tratando de hacerlo desde otro dispositivo que no sea un ASA no te va a funcionar. Saludos, Erick Delgado Cisco TAC Support Engineer, AAA Team Email: erdelgad@cisco.com Phone: 1-407-241-2965 ext 4831 ... View more

Hello, If you doing 802.1x authentication and if the computer don't have a supplicant the switch is the one who takes the decision to either leave it unauthenticated or use guest vlan everything depends on what you have configure. If you want to provide different vlans to different groups of users that is dynamic vlan assigment. Please let me know if this is what you want so I can share configuration. Regards, ... View more

you may want to see the following link http://m.mcisco.com/pocket.paper?url2=http%3a%2f%2fwww.cisco.com%2fen%2fUS%2fdocs%2fnet_mgmt%2fcisco_secure_access_control_system%2f5.1%2finstallation%2fguide%2fcsacs_vmware.html It is a step by step guide Sent from Cisco Technical Support iPhone App ... View more

Hello, This kind of issues are kind of complex. I suggest a TAC SR for this matter. Please feel free to call me or email me and I will help you with this issue. Regards, ... View more

Hello, This is a very simple setup. You may want to configure something like this Hostname (config)# tunnel-group xxx type xxxx Hostname (config)# tunnel-group xxx general-attributes Hostname (config-tunnel-general)# accounting-server-group aaa_server Please do not hesitate to contact me if you have any question. Erick Delgado AAA TEAM ... View more

Hello, NPS is a policy based server. It works with a set of conditions and then a result. Your question is really general and I will say yes you can do it. You can filter based on SSID if you have a  Cisco WLC. You can create as many policies do you want but you have to be very specific in terms of conditions. Please tell me exactly what you want to accomplish and I will do my best to help you with the policies. Erick Delgado AAA TEAM ... View more

Hello, Looks like you missing the root and intermediate certificate. Try installing those before the ID certificate. Also I do want to mention that none of our ACS 4.x version supports windows 2008 R2 AD. Regards, ... View more

Hello Fernando, In ACS 5.2 things are a litle bit different. Please see attchment with a configuration that may help you. If you have any question feel free to contact me. Erick Delgado Cisco CSE ... View more

Hello, I guest that what you want to configure is double authentication. If this is the case this can be only done using anyconnect and not IPSEC. Please see link below that will help you with this matter. If you have any question feel free to contact me. Erick Delgado Cisco CSE ... View more