Questions tagged [aaa]
For questions about network Authentication, Authorization, and Accounting. These are methods which comprise a security framework for access control on the network, services, and/or devices.
53 questions
2
votes
0
answers
672
views
Cisco Access Switches: Monitoring AAA server dead via SNMP?
This is a new setup of Cisco access switches (2960S, 2960X IOS with 15.2(2)E9, but mostly C1000 with IOS 15.2(7)E*), with a Cisco ISE 3.0 as authentication server for 802.1X, config style is to be ...
- 8,876
4
votes
2
answers
430
views
TACACS+ AAA over L2L VPN
I have a practice network set up with the relevant topography shown in the below image:
I have TACACS+ running on HQ-AAA-Server (192.168.10.10) and AAA working using it on HQ (IOS) and HQ-FW1 (ASA). ...
- 171
2
votes
1
answer
395
views
AAA Authorization on IOS
Still working away on a project (not for real life deployment so don't worry about seeing passwords).
I have a Tacacs server set up for centralised AAA. I am trying to set up two users, "admin&...
- 171
1
vote
1
answer
2k
views
AAA authentication - Explanation of how each AAA command works
How asset authentication is handled for configuration sample presented below.
aaa new-model
aaa authentication login console local group TACACS+
aaa authentication login default group TACACS+ ...
1
vote
1
answer
197
views
Configure AAA on a router - Extended ACLs
How do I write a named extended ACL which will allow for traffic between a DNS from a LAN (IP address) to a DNS server at (IP address), ping from a host PC (IP address) to any destination and allow ...
0
votes
1
answer
359
views
What's the difference between DIAMETER and 802.1X Authentication?
I'm studying the 802.1.X authentication guidelines and the DIAMETER protcol as successor of RADIUS but i can't figure out what are the main difference between pure 802.1X Port-Based Authentication and ...
- 21
0
votes
1
answer
3k
views
Cisco 2960 radius configuration
I have multiple cisco switches like Nexus family and IOS family switches and now i am trying to configure centralized authentication so i have install Freeradius and freeIPA (ldap server)
I have ...
- 4,389
2
votes
1
answer
695
views
Cisco ISE and WLC 802.1x Non-Dynamic VLAN Placement
I am trying to migrate from Microsoft NPS using 802.1x PEAP to Cisco ISE 802.1x PEAP for our WLC wireless clients. I see a lot of articles regrading Dynamic VLAN assignment, which we are not trying to ...
- 813
1
vote
1
answer
332
views
Tacacs+ over VPN is not working
R3 is a Tacacs+ client and Server0 is configured as AAA server with Tacacs+ but R3 is not able to authenticate.
R3 Configuration:
!
version 15.4
no service timestamps log datetime msec
no service ...
- 78
1
vote
1
answer
38
views
Privileged Identity Management for switch users' account
Is it possible to create an account in the switch for managing switch users' accounts such like changing password but may not allow to change specific administrator user. Can it be set on lower ...
- 65
2
votes
1
answer
943
views
Cisco Mobility Express - supported authentication options
What are the supported authentication options for the ME APs? Do they support only login through local credentials or RADIUS/TACACS+ is also supported?
- 107
0
votes
1
answer
2k
views
Cisco 2960-S switch with MAB and Packetfence Web Authentication
I am trying to set up Packetfence In my corporate environment for guest users, with MAC access bypass. i have done everything like in the official Packetfence installation guide https://packetfence....
- 101
5
votes
2
answers
3k
views
AAA authentication for all users and a single user for local only?
Is it possible to have AAA for a switch or router, dealing with JunOS, IOS and NXOS. Where all users default to a radius/tacacs server but there is a single user that bypasses the remote auth and uses ...
- 215
1
vote
1
answer
198
views
Where did `private_sg-0` come from?
I'm configuring my first Cisco product (WS-C3560CX-12TC-S) and trying to get to grips with aaa. I'm used to *nix where the first thing you do with headless devices is enable and configure SSH access ...
- 125
1
vote
1
answer
3k
views
How to Multiple Radius server in ASA
We have two RADIUS server for SecureID token auth for VPN and i have configure 10.1.1.1 (primary) but don't know how to configure 10.1.1.2 (backup radius)
This is what i have currently
aaa-server ...
- 4,389
1
vote
1
answer
1k
views
AAA Radius Privilege levels
I've setup a Windows 2012 Server R2 Radius server to commmunicate with CISCO IOS devices.
There are two categories of users: with just read only rights(shell:priv-lvl=1), and read/write (shell:priv-...
- 47
1
vote
1
answer
2k
views
Lockout of console! Help required!
I'm locked out of the console after applying two AAA authorization statements
aaa new-model
aaa authorization console
aaa authorization exec default group tacacs+ none
Now my customer requires me ...
- 13
1
vote
1
answer
4k
views
Cisco 3750 switch not communicating with RADIUS server
I have a Cisco 3750 switch and I want to make it work with PacketFence NAC. I have configured the switch according to their network configuration document here, but the switch is still not ...
- 121
0
votes
1
answer
595
views
Cisco 3750 AAA configuration troubleshooting [closed]
I am currently setting up PacketFence and trying to make it work with the Cisco 3750 switch. I have followed the instructions from this PacketFence network configuration (except using a different VLAN ...
- 121
-2
votes
1
answer
243
views
What does aaa mean?
In the below configuration, what does aaa mean?
aaa authentication login CON local
aaa authentication login VTY group VTY local
aaa authentication dot1x default group DOT1x
aaa authorization exec ...
1
vote
2
answers
254
views
Is every Switch capable of Network Access Server?
i am learning about Radius Server and particularly freeRadius. NAS devices are responsible for sending Authentication requests to the Radius Server. NAS devices include like Switch, wireless access ...
- 125
3
votes
1
answer
707
views
AAA & NAC: Use last authorized vlan of a port, if AAA-Server is dead?
I'd like to know if there is any way to configure the switch so, that in case the radius-server is dead and devices try to (re)-authenticate the port gets the latest vlan which was authorized on this ...
- 33
4
votes
3
answers
2k
views
Can I limit Cisco IOS login to specific users?
I have a Cisco IOS router that is used for WAN access. I have 2 additional users defined with less privilege to check status and to use ssh. I wonder if it is possible to restrict certain user to only ...
- 252
4
votes
1
answer
2k
views
Authentication error
I have set the username **** privilege 5 secret **** & applied aaa via console. now unable to access switch through console.
After entering enable showing authentication error.
can someone help ...
- 61
1
vote
3
answers
3k
views
cisco ssh key authorization level via radius
Related to Authenticate ssh key via Cisco ACS (TACACS+)
Given a working ssh public key config:
ip ssh pubkey-chain
username admin
key-string
<ssh-pub-key>
exit
exit
I have only been ...
- 163
2
votes
2
answers
189
views
Limit Access to a Specific VRF?
I may be barking up a tree that doesn't exist but I am trying to find out if there is a way to limit a user or group's access to only a specific VRF. This is a 6500 series switch.
Note, I am not ...
- 210
1
vote
2
answers
6k
views
How can I get a list of users and last login dates from a Cisco ACS running v5.2?
I'm trying to get a list of the users that have logged into a Cisco ACS, and the date of their last login. Ideally, I'd like it to include the identity store that was the source of the authentication ...
- 153
4
votes
1
answer
2k
views
What was the AAA "old-model"?
Any AAA configuration on a Cisco router begins with the command aaa new-model. Per the context help:
R1(config)#aaa ?
new-model Enable NEW access control commands and functions.(Disables OLD ...
- 15.2k
1
vote
1
answer
442
views
AAA Authorization
I have a 3750x with TACACS AAA configured. If I login using TACACS, CLI commands run fine, no wait between commands. However, if I disconnect from network, taking away the ability to hit the tacacs ...
- 11
1
vote
1
answer
225
views
802.1X for Wi-FI
I have a hidden SSID network. I know that although the SSID is hidden, someone can sniff the Wi-Fi channels to get my SSID, and with that SSID he can use some OpenWRT-ish things to spoof my Wi-Fi ...
- 157
1
vote
0
answers
347
views
Able to test AAA to Radius Server from router but unable to log into Router with A.D
I am having issue with setting up my Radius server to authenticate before going to the router. I am able to do a test from the router successfully but once I exit the router and log in with my Windows ...
- 51
1
vote
0
answers
2k
views
TACACS with Juniper Devices
Can any one please help in configuring a TACACS+ server, along with configuration in Juniper devices?
Ubuntu Server 14.04
Juniper QFX5100 switch
Below are my configurations:
For the TACACS+ server:
...
- 121
1
vote
3
answers
2k
views
After configuring tacacs cannot access to cli
After configuring Tacacs+ cannot access throught tacacs or telnet:
aaa new-model
!
!
aaa group server tacacs+ TACACS+CG
server [server ip address]
server [server ip address]
!
aaa authentication ...
- 327
1
vote
2
answers
76
views
enable additional commands centrally for IOS privilege levels other than 15
Privilege level 15 in IOS has all the possible commands for particular IOS release enabled. However, for example privilege level 1 has only few dozens of commands available. Now if I want to allow ...
- 1,121
4
votes
1
answer
215
views
Default authentication/authorization/accounting list on all lines?
Am I correct that if one has not specified a named authentication list(login authentication ... under line configuration), authorization list(authorization .. under line configuration) or accounting ...
- 1,121
6
votes
1
answer
4k
views
How to view default authentication method for different lines(cty, vty, aux, tty) in IOS?
For example if I enable AAA(aaa new-model) in IOS router with default configuration and try to log in over console line(cty), then there is no authentication. However, if I try to log in over telnet(...
- 1,121
2
votes
3
answers
14k
views
Reason of "aaa authorization exec default group tacacs+" command in Cisco IOS?
I have a following very minimalistic AAA configuration in ISR router with IOS 12.4(22)T:
aaa new-model
aaa authentication login default group tacacs+ enable
aaa authentication enable default group ...
- 1,121
4
votes
1
answer
23k
views
% Authorization failed. message appear when I try to connect to the switch using local DB user name
I configured aaa using Tacacs+ on a switch and a router but when I try to connect to the switch through SSH it just accept Tacacs+ users when I try to use local DB user I got "% Authorization ...
- 103
3
votes
3
answers
1k
views
Fortigate user traffic quota
I'm trying to limit internet users by traffic quota in fortigate firewall.Is there a way to limit users traffic usage and set quota for them in fortigate?
i think there is no built-in feature for ...
- 31
2
votes
2
answers
2k
views
Privileged EXEC mode not accessible after the upgrade
I hope you are well.
I did the upgrade of SF300-48P to the latest version 1.4.0.88 using my TACACS acc. After that I could ssh to the switch, but it wouldn't allow me access Privileged EXEC mode - "...
- 72
4
votes
1
answer
4k
views
How do you block a specific computer from VPN on a Cisco ASA?
We want to be able to disable a computer in Active Directory and prevent that computer from accessing our VPN.
I have an ASA VPN setup, with Cisco Security Desktop, and a Dynamic Access Policy to ...
- 362
7
votes
1
answer
9k
views
AAA Authorization Timeout
Log into a Cisco IOS device with TACACS Authorization enabled
Do a command that causes the device to lose access to the TACACS server
Enter a command that requires TACACS Authorization
By default, ...
- 1,589
1
vote
1
answer
119
views
SecureACS - and LDAP
I'm having problems understanding the concept of how ACS is supposed to work. Today, we have routers that use aaa (ACS) to authenticate users trying to telnet into the box. However, anyone w/ a ...
- 11
3
votes
3
answers
2k
views
Cisco ASA 5585 SSH LDAP Authentication
I am attempting to setup Microsoft LDAP authentication, for SSH only, for a specific security group on a Cisco ASA 5585 version 8.2(5) using the ASDM. The lookup and authentication is working, however ...
- 41
6
votes
1
answer
3k
views
Cisco + FreeRADIUS: Exec 15 level privilege mode
I have two routers: Cisco ISR 2921 with IOS version 15.0(1r)M9 and a Cisco C2600 which is an old guy with IOS 12.0(7)XK1.
I have this set up on a FreeRADIUS server:
router-admin MD5-Password := "&...
- 837
8
votes
1
answer
1k
views
FQDN's in crypto maps and AAA servers possible with dynamic DNS resolution? Cisco ASA
Can I use FQDN's in crypto maps when setting a peer (where I'd normally use an IP), and can I use FQDN's when defining an LDAP Server or any other AAA Server in a server group? In both cases the FQDN'...
- 3,310
6
votes
1
answer
4k
views
How does Cisco perform authentication server reachability on aaa?
Let's suppose we have a line like this:
aaa authentication login default group radius group tacacs+ local
According to the IOS 12.2 documentation:
If R1 authenticates the user, it issues a PASS ...
- 1,099
2
votes
0
answers
2k
views
AAA - IP HTTP server: local authentication and authorization
We configure AAA on router for the Telnet/SSH access. We activate HTTP on our router to our provisioning tool. The provisioning tool needs to retrieve information and execute some command on the HTTP ...
- 2,008
6
votes
2
answers
27k
views
What are the different modes in Cisco routers, and why these modes?
I want to know on what basis Cisco designed the different modes in their routers.
For example:
config mode
execution mode
Can any one give the perfect reasons behind the different modes?
What ...
- 1,621
8
votes
3
answers
4k
views
Cisco WLC: Per user authentication, many Vlans, few SSIDs
We have a simple problem. We want to restrict our wireless users to certain business websites based on their username when they login. We have many kinds of wireless devices: voip phones, cell phone,...
- 81