ACS 5.1 is end of life and end of support 2015. https://www.cisco.com/c/en/us/products/collateral/security/secure-access-control-system/eol_c51-693439.html   Let me clarify this, CSV's with users/passwords can be imported initially. This is to help provision the users. A good practice is to ask users change the passwords. After this the user passwords becomes sensitive information. So you cant see the password when you export, it will be empty.   I would suggest looking at ISE which is the next generation ACS, do a mini pilot and try the services. You will find the user interface, policies much better. http://cs.co/acstoise   Thanks Krishnan     ... View more

This is a forum for Anyconnect, Segmentation for Trustsec and ISE.   Few things to think about is assigning tags to switchports for the users. Using SXP to transport tags to another switch that can consume it.   If you have Nexus 9k and planning to use ACI, suggest considering ISE since we have integration with ACI. SGT's can be mapped to ACI (EPGs) and viceversa and you can do enforcement at the Datacenter.   Here is the Trustsec compatibility matrix that will show the validated solution and support for Trustsec.   https://www.cisco.com/c/en/us/solutions/enterprise-networks/trustsec/solution-overview-listing.html   Thanks Krishnan   ... View more

Hi,   Think there is a mistake in your configuration. authentication event server dead should have an action 'authorize' and not reinitialize. Try this and it should work. autentication event server alive is correct it should be reinitialize. authentication event server dead action authorize Thanks krishnan ... View more

Please check out the community discussion on the same topic. https://community.cisco.com/t5/policy-and-access/acs-export-database-with-passwords/m-p/3758232   Thanks Krishnan ... View more

You are going through two step upgrade, it is not possible to downgrade.   ACS 5.4 is End of Sale and End of Support https://www.cisco.com/c/en/us/products/collateral/security/secure-access-control-system/eos-eol-notice-c51-732647.html   If it does not work, as an alternative you can export users/groups, network devices, network device groups to the new system.   That said, ACS 5.8 is End of Maintenance which means that there will be no patches or maintenance release to fix the defects. https://www.cisco.com/c/en/us/products/collateral/security/secure-access-control-system/eos-eol-c51-738197.html Only support is available till 2022 if you have a valid service contract.   ISE is the next gen ACS. Please look at http://cs.co/acstoise for more details.   Thanks Krishnan           ... View more

Please see the ACS 5.5 export users section https://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-5/user/guide/acsuserguide/my_wkspc.html#16570   Admin needs read permissions on the user objects to export. Other thing is to disable password hash and try it.   That said, ACS 5.5 is End of life and End of support product. Please migrate ACS to ISE as soon as possible. If you are on the process of doing it great.   One way to get around this is to create new passwords after migrating and ask users to change it as needed. You need to communicate to the IT managemet and user community to set the expectation and take it from there.   Thanks Krishnan   ... View more

I did not see the output of the acsview show db-size command. The bug was fixed in 5.5 and 5.6. The alarm should come up only with the size of disk is more than 1GB but it seemed to appear even before that. Alarm was changed to warning.   In any case it would be good to compress and truncate transactional logs. Do it in a maintenance window just to make sure it does not impact users. https://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-4/command/reference/cli/cli_app_a.html#98188   Finally ACS 5.4 is EOL and End of Support https://www.cisco.com/c/en/us/products/collateral/security/secure-access-control-system/eos-eol-notice-c51-732647.html   ISE is the next generation ACS. Please look at ACS to ISE migration for details how to migrate over to ISE https://community.cisco.com/t5/security-documents/acs-to-ise-migration/ta-p/3644038   Thanks Krishnan ... View more

Please check the how to guides for ISE and ASA in our ISE ecosystem section for details how to configure.   https://community.cisco.com/t5/security-documents/ise-security-ecosystem-integration-guides/ta-p/3621164#toc-hId-1962717380   -Krishnan ... View more

Do not use * operator for everything. It is 0 or more occurance. There are a few pointers in the community on regular expresssions. Please look at those https://community.cisco.com/t5/security-documents/acs-command-sets-arguments-regexp-interface-range/ta-p/3126213   https://community.cisco.com/t5/policy-and-access/need-help-in-creating-a-regex-in-acs-5-8/td-p/3221315 I have some examples of regular expression in the ISE device admin prescriptive guide. You can look at that as well.   https://community.cisco.com/t5/security-documents/cisco-ise-device-administration-prescriptive-deployment-guide/ta-p/3738365   -Krishnan     ... View more

1. Please make sure you have used the correct protocol (PAP/CHAP). 2. Look at the ISE server TACACS logs and see what is going on. If ISE does not receive packets or drops packets then it could be wrong shared secret. 3. Make sure your TACACS+ auth policy is configured correctly.  Use the correct username/password etc for authentication Here is the latest guide uploaded that can help you.   https://community.cisco.com/t5/security-documents/cisco-ise-device-administration-prescriptive-deployment-guide/ta-p/3738365   -Krishnan   ... View more

Please see a similar post in the community site. https://community.cisco.com/t5/policy-and-access/changing-ip-address-on-acs-5-6-vm/td-p/2712787   -Krishnan ... View more