Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [aaa]

For questions about network Authentication, Authorization, and Accounting. These are methods which comprise a security framework for access control on the network, services, and/or devices.

0
votes
1answer
96 views

Cisco 2960-S switch with MAB and Packetfence Web Authentication

I am trying to set up Packetfence In my corporate environment for guest users, with MAC access bypass. i have done everything like in the official Packetfence installation guide https://packetfence....
4
votes
2answers
440 views

AAA authentication for all users and a single user for local only?

Is it possible to have AAA for a switch or router, dealing with JunOS, IOS and NXOS. Where all users default to a radius/tacacs server but there is a single user that bypasses the remote auth and uses ...
1
vote
1answer
38 views

Where did `private_sg-0` come from?

I'm configuring my first Cisco product (WS-C3560CX-12TC-S) and trying to get to grips with aaa. I'm used to *nix where the first thing you do with headless devices is enable and configure SSH access ...
0
votes
1answer
982 views

How to Multiple Radius server in ASA

We have two RADIUS server for SecureID token auth for VPN and i have configure 10.1.1.1 (primary) but don't know how to configure 10.1.1.2 (backup radius) This is what i have currently aaa-server ...
1
vote
1answer
441 views

AAA Radius Privilege levels

I've setup a Windows 2012 Server R2 Radius server to commmunicate with CISCO IOS devices. There are two categories of users: with just read only rights(shell:priv-lvl=1), and read/write (shell:priv-...
1
vote
1answer
429 views

Lockout of console! Help required!

I'm locked out of the console after applying two AAA authorization statements aaa new-model aaa authorization console aaa authorization exec default group tacacs+ none Now my customer requires me ...
1
vote
1answer
979 views

Cisco 3750 switch not communicating with RADIUS server

I have a Cisco 3750 switch and I want to make it work with PacketFence NAC. I have configured the switch according to their network configuration document here, but the switch is still not ...
0
votes
1answer
138 views

Cisco 3750 AAA configuration troubleshooting [closed]

I am currently setting up PacketFence and trying to make it work with the Cisco 3750 switch. I have followed the instructions from this PacketFence network configuration (except using a different VLAN ...
-3
votes
1answer
158 views

What does aaa mean?

In the below configuration, what does aaa mean? aaa authentication login CON local aaa authentication login VTY group VTY local aaa authentication dot1x default group DOT1x aaa authorization exec ...
0
votes
2answers
89 views

Is every Switch capable of Network Access Server?

i am learning about Radius Server and particularly freeRadius. NAS devices are responsible for sending Authentication requests to the Radius Server. NAS devices include like Switch, wireless access ...
3
votes
1answer
231 views

AAA & NAC: Use last authorized vlan of a port, if AAA-Server is dead?

I'd like to know if there is any way to configure the switch so, that in case the radius-server is dead and devices try to (re)-authenticate the port gets the latest vlan which was authorized on this ...
1
vote
3answers
568 views

Can I limit Cisco IOS login to specific users?

I have a Cisco IOS router that is used for WAN access. I have 2 additional users defined with less privilege to check status and to use ssh. I wonder if it is possible to restrict certain user to only ...
2
votes
1answer
139 views

Authentication error

I have set the username **** privilege 5 secret **** & applied aaa via console. now unable to access switch through console. After entering enable showing authentication error. can someone help ...
0
votes
3answers
777 views

cisco ssh key authorization level via radius

Related to Authenticate ssh key via Cisco ACS (TACACS+) Given a working ssh public key config: ip ssh pubkey-chain username admin key-string <ssh-pub-key> exit exit I have only been ...
2
votes
2answers
73 views

Limit Access to a Specific VRF?

I may be barking up a tree that doesn't exist but I am trying to find out if there is a way to limit a user or group's access to only a specific VRF. This is a 6500 series switch. Note, I am not ...
0
votes
2answers
3k views

How can I get a list of users and last login dates from a Cisco ACS running v5.2?

I'm trying to get a list of the users that have logged into a Cisco ACS, and the date of their last login. Ideally, I'd like it to include the identity store that was the source of the authentication ...
3
votes
1answer
474 views

What was the AAA “old-model”?

Any AAA configuration on a Cisco router begins with the command aaa new-model. Per the context help: R1(config)#aaa ? new-model Enable NEW access control commands and functions.(Disables OLD ...
0
votes
1answer
212 views

AAA Authorization

I have a 3750x with TACACS AAA configured. If I login using TACACS, CLI commands run fine, no wait between commands. However, if I disconnect from network, taking away the ability to hit the tacacs ...
0
votes
1answer
123 views

802.1X for Wi-FI

I have a hidden SSID network. I know that although the SSID is hidden, someone can sniff the Wi-Fi channels to get my SSID, and with that SSID he can use some OpenWRT-ish things to spoof my Wi-Fi ...
1
vote
0answers
187 views

Able to test AAA to Radius Server from router but unable to log into Router with A.D

I am having issue with setting up my Radius server to authenticate before going to the router. I am able to do a test from the router successfully but once I exit the router and log in with my Windows ...
1
vote
0answers
1k views

TACACS with Juniper Devices

Can any one please help in configuring a TACACS+ server, along with configuration in Juniper devices? Ubuntu Server 14.04 Juniper QFX5100 switch Below are my configurations: For the TACACS+ server: ...
1
vote
3answers
1k views

After configuring tacacs cannot access to cli

After configuring Tacacs+ cannot access throught tacacs or telnet: aaa new-model ! ! aaa group server tacacs+ TACACS+CG server [server ip address] server [server ip address] ! aaa authentication ...
0
votes
2answers
53 views

enable additional commands centrally for IOS privilege levels other than 15

Privilege level 15 in IOS has all the possible commands for particular IOS release enabled. However, for example privilege level 1 has only few dozens of commands available. Now if I want to allow ...
3
votes
1answer
161 views

Default authentication/authorization/accounting list on all lines?

Am I correct that if one has not specified a named authentication list(login authentication ... under line configuration), authorization list(authorization .. under line configuration) or accounting ...
4
votes
1answer
3k views

How to view default authentication method for different lines(cty, vty, aux, tty) in IOS?

For example if I enable AAA(aaa new-model) in IOS router with default configuration and try to log in over console line(cty), then there is no authentication. However, if I try to log in over telnet(...
1
vote
2answers
6k views

Reason of “aaa authorization exec default group tacacs+” command in Cisco IOS?

I have a following very minimalistic AAA configuration in ISR router with IOS 12.4(22)T: aaa new-model aaa authentication login default group tacacs+ enable aaa authentication enable default group ...
2
votes
1answer
15k views

% Authorization failed. message appear when I try to connect to the switch using local DB user name

I configured aaa using Tacacs+ on a switch and a router but when I try to connect to the switch through SSH it just accept Tacacs+ users when I try to use local DB user I got "% Authorization failed." ...
2
votes
2answers
750 views

Fortigate user traffic quota

I'm trying to limit internet users by traffic quota in fortigate firewall.Is there a way to limit users traffic usage and set quota for them in fortigate? i think there is no built-in feature for ...
1
vote
2answers
682 views

Privileged EXEC mode not accessible after the upgrade

I hope you are well. I did the upgrade of SF300-48P to the latest version 1.4.0.88 using my TACACS acc. After that I could ssh to the switch, but it wouldn't allow me access Privileged EXEC mode - "...
3
votes
1answer
2k views

How do you block a specific computer from VPN on a Cisco ASA?

We want to be able to disable a computer in Active Directory and prevent that computer from accessing our VPN. I have an ASA VPN setup, with Cisco Security Desktop, and a Dynamic Access Policy to ...
4
votes
1answer
3k views

AAA Authorization Timeout

Log into a Cisco IOS device with TACACS Authorization enabled Do a command that causes the device to lose access to the TACACS server Enter a command that requires TACACS Authorization By default, ...
1
vote
1answer
109 views

SecureACS - and LDAP

I'm having problems understanding the concept of how ACS is supposed to work. Today, we have routers that use aaa (ACS) to authenticate users trying to telnet into the box. However, anyone w/ a ...
2
votes
2answers
1k views

Cisco ASA 5585 SSH LDAP Authentication

I am attempting to setup Microsoft LDAP authentication, for SSH only, for a specific security group on a Cisco ASA 5585 version 8.2(5) using the ASDM. The lookup and authentication is working, however ...
6
votes
1answer
3k views

Cisco + FreeRADIUS: Exec 15 level privilege mode

I have two routers: Cisco ISR 2921 with IOS version 15.0(1r)M9 and a Cisco C2600 which is an old guy with IOS 12.0(7)XK1. I have this set up on a FreeRADIUS server: router-admin MD5-Password := "&...
6
votes
1answer
845 views

FQDN's in crypto maps and AAA servers possible with dynamic DNS resolution? Cisco ASA

Can I use FQDN's in crypto maps when setting a peer (where I'd normally use an IP), and can I use FQDN's when defining an LDAP Server or any other AAA Server in a server group? In both cases the FQDN'...
5
votes
1answer
3k views

How does Cisco perform authentication server reachability on aaa?

Let's suppose we have a line like this: aaa authentication login default group radius group tacacs+ local According to the IOS 12.2 documentation: If R1 authenticates the user, it issues a PASS ...
2
votes
0answers
1k views

AAA - IP HTTP server: local authentication and authorization

We configure AAA on router for the Telnet/SSH access. We activate HTTP on our router to our provisioning tool. The provisioning tool needs to retrieve information and execute some command on the HTTP ...
5
votes
2answers
25k views

What are the different modes in Cisco routers, and why these modes?

I want to know on what basis Cisco designed the different modes in their routers. For example: config mode execution mode Can any one give the perfect reasons behind the different modes? What ...
7
votes
3answers
4k views

Cisco WLC: Per user authentication, many Vlans, few SSIDs

We have a simple problem. We want to restrict our wireless users to certain business websites based on their username when they login. We have many kinds of wireless devices: voip phones, cell phone,...
5
votes
2answers
1k views

Cisco AAA authorization with no user group

Can anyone help me with understanding one thing about AAA authorization on Cisco IOS. Here is a config fragment: aaa authorization config-commands aaa authorization exec default group tacacs+ local ...
5
votes
2answers
2k views

Tacacs VRF authentication

We just got a new Supervisor7 with os 3.4.1. I'm trying to configure authentication with tacacs, and I can't understand how to make it work. This configuration works on our other switches, but it ...
8
votes
3answers
23k views

AAA/TACACS+ password on Cisco switch always fails at second password prompt

Whenever logging into a network device using AAA/TACACS+, if I fat-finger the password prompt after the username prompt, the second password prompt always fails even when the password is correct. I ...