Hi Folks, I have a dual appliance set up; with a distributed deployment. I am using my primary box as the log collector and I noticed today that if I point a networking device at my secondary instance for authentications nothing shows up in the logs anyway, despite the authentication being successful. I was under the impression that any authentication requests to either the primary or secondary instance should be forwarded to the designated log collector and be viewable in the monitoring & reports viewer, is this not the case? Regards Ciaran ... View more

Hi Folks, I have noticed something in the Tacacs and radius logs that I have a query about. It's not an issue, I'm just looking for some information. I notice that despite having our network devices being configured to use Tacacs+ or radius the 'authentication method' that is specified in the Tacacs and radius logs in ACS 5 is PAP ASCII. The reason this got my attention is because we use Tacacs+ or radius whch have their own varying levels of encryption this is why we use them but PAP, which is shown as the authentication method is unencrypted which is what we don't want. In order to see what was going on I ran a Wireshark trace and I can definitely see that the tacacs & radius authentications are being successfully encrypted. So why am I seeing PAP ASCII as the authentication method in the ACS logs? Is it a case where tacacs+ is just an encrypted payload in the PAP packet or something to that affect? Regards Ciaran ... View more

Hi folks, I have a query about restricting users in a specific user group. The restriction is to stop a user from connecting onwards to another device once that user is already logged on to a Cisco networking device. So essentially blocking the telnet and ssh commands. I had this working previously but I have been troubleshooting a CHAP authentication bug for the past few months with TAC so I cannot recall how I done it the first time. Initially I tried to build the restriction in 'Command Sets' but that doesn't work;I think I had built the restriction somewhere else the first time round but the memory escapes me. Any advice would be appreciated. I have attached a screenshot of the 'Command sets' and the 'Access policy' configuration that did not work as expected. I can see in the AAA  Tacacs authentication log file that the onward connection via ssh was matched and allowed P.S I even tried restricting all commands for the user profile in the command sets but telnet and ssh still work.                     Regards Ciaran ... View more

Hi folks, I am configuring some of my devices to use CHAP when their backup ISDN interface dials out to the 7200 concentrator node. I wan the CHAP requests to hit our ACS 5.2 appliances and be authenticated via this method. I have built a rule for 'Default netowrk access' which specifies these devices only however when I bring up the ISDN call the process fails. When I look at the logs it doesn't give an error reason but it does say that it failed on one of the rules in the 'default device admin' rule set. I even went to the bother of specifying a single IP address of one of the ISDN backup devices but the result is always the same. Does anyone ahve any guiance as to what I'm doing wrong here? Any help would be appreciated Kind Regards Ciaran ... View more