All Questions
24 questions
2
votes
0
answers
672
views
Cisco Access Switches: Monitoring AAA server dead via SNMP?
This is a new setup of Cisco access switches (2960S, 2960X IOS with 15.2(2)E9, but mostly C1000 with IOS 15.2(7)E*), with a Cisco ISE 3.0 as authentication server for 802.1X, config style is to be ...
- 8,876
2
votes
1
answer
395
views
AAA Authorization on IOS
Still working away on a project (not for real life deployment so don't worry about seeing passwords).
I have a Tacacs server set up for centralised AAA. I am trying to set up two users, "admin&...
- 171
0
votes
1
answer
3k
views
Cisco 2960 radius configuration
I have multiple cisco switches like Nexus family and IOS family switches and now i am trying to configure centralized authentication so i have install Freeradius and freeIPA (ldap server)
I have ...
- 4,389
1
vote
1
answer
38
views
Privileged Identity Management for switch users' account
Is it possible to create an account in the switch for managing switch users' accounts such like changing password but may not allow to change specific administrator user. Can it be set on lower ...
- 65
0
votes
1
answer
2k
views
Cisco 2960-S switch with MAB and Packetfence Web Authentication
I am trying to set up Packetfence In my corporate environment for guest users, with MAC access bypass. i have done everything like in the official Packetfence installation guide https://packetfence....
- 101
1
vote
1
answer
198
views
Where did `private_sg-0` come from?
I'm configuring my first Cisco product (WS-C3560CX-12TC-S) and trying to get to grips with aaa. I'm used to *nix where the first thing you do with headless devices is enable and configure SSH access ...
- 125
1
vote
1
answer
3k
views
How to Multiple Radius server in ASA
We have two RADIUS server for SecureID token auth for VPN and i have configure 10.1.1.1 (primary) but don't know how to configure 10.1.1.2 (backup radius)
This is what i have currently
aaa-server ...
- 4,389
1
vote
1
answer
2k
views
Lockout of console! Help required!
I'm locked out of the console after applying two AAA authorization statements
aaa new-model
aaa authorization console
aaa authorization exec default group tacacs+ none
Now my customer requires me ...
- 13
1
vote
1
answer
4k
views
Cisco 3750 switch not communicating with RADIUS server
I have a Cisco 3750 switch and I want to make it work with PacketFence NAC. I have configured the switch according to their network configuration document here, but the switch is still not ...
- 121
0
votes
1
answer
595
views
Cisco 3750 AAA configuration troubleshooting [closed]
I am currently setting up PacketFence and trying to make it work with the Cisco 3750 switch. I have followed the instructions from this PacketFence network configuration (except using a different VLAN ...
- 121
-2
votes
1
answer
243
views
What does aaa mean?
In the below configuration, what does aaa mean?
aaa authentication login CON local
aaa authentication login VTY group VTY local
aaa authentication dot1x default group DOT1x
aaa authorization exec ...
3
votes
1
answer
707
views
AAA & NAC: Use last authorized vlan of a port, if AAA-Server is dead?
I'd like to know if there is any way to configure the switch so, that in case the radius-server is dead and devices try to (re)-authenticate the port gets the latest vlan which was authorized on this ...
- 33
1
vote
2
answers
6k
views
How can I get a list of users and last login dates from a Cisco ACS running v5.2?
I'm trying to get a list of the users that have logged into a Cisco ACS, and the date of their last login. Ideally, I'd like it to include the identity store that was the source of the authentication ...
- 153
4
votes
1
answer
2k
views
What was the AAA "old-model"?
Any AAA configuration on a Cisco router begins with the command aaa new-model. Per the context help:
R1(config)#aaa ?
new-model Enable NEW access control commands and functions.(Disables OLD ...
- 15.2k
4
votes
1
answer
215
views
Default authentication/authorization/accounting list on all lines?
Am I correct that if one has not specified a named authentication list(login authentication ... under line configuration), authorization list(authorization .. under line configuration) or accounting ...
- 1,121
6
votes
1
answer
4k
views
How to view default authentication method for different lines(cty, vty, aux, tty) in IOS?
For example if I enable AAA(aaa new-model) in IOS router with default configuration and try to log in over console line(cty), then there is no authentication. However, if I try to log in over telnet(...
- 1,121
2
votes
2
answers
2k
views
Privileged EXEC mode not accessible after the upgrade
I hope you are well.
I did the upgrade of SF300-48P to the latest version 1.4.0.88 using my TACACS acc. After that I could ssh to the switch, but it wouldn't allow me access Privileged EXEC mode - "...
- 72
6
votes
1
answer
3k
views
Cisco + FreeRADIUS: Exec 15 level privilege mode
I have two routers: Cisco ISR 2921 with IOS version 15.0(1r)M9 and a Cisco C2600 which is an old guy with IOS 12.0(7)XK1.
I have this set up on a FreeRADIUS server:
router-admin MD5-Password := "&...
- 837
8
votes
1
answer
1k
views
FQDN's in crypto maps and AAA servers possible with dynamic DNS resolution? Cisco ASA
Can I use FQDN's in crypto maps when setting a peer (where I'd normally use an IP), and can I use FQDN's when defining an LDAP Server or any other AAA Server in a server group? In both cases the FQDN'...
- 3,310
6
votes
2
answers
27k
views
What are the different modes in Cisco routers, and why these modes?
I want to know on what basis Cisco designed the different modes in their routers.
For example:
config mode
execution mode
Can any one give the perfect reasons behind the different modes?
What ...
- 1,621
8
votes
3
answers
4k
views
Cisco WLC: Per user authentication, many Vlans, few SSIDs
We have a simple problem. We want to restrict our wireless users to certain business websites based on their username when they login. We have many kinds of wireless devices: voip phones, cell phone,...
- 81
6
votes
2
answers
1k
views
Cisco AAA authorization with no user group
Can anyone help me with understanding one thing about AAA authorization on Cisco IOS. Here is a config fragment:
aaa authorization config-commands
aaa authorization exec default group tacacs+ local
...
- 61
7
votes
2
answers
3k
views
Tacacs VRF authentication
We just got a new Supervisor7 with os 3.4.1. I'm trying to configure authentication with tacacs, and I can't understand how to make it work. This configuration works on our other switches, but it ...
- 267
9
votes
3
answers
27k
views
AAA/TACACS+ password on Cisco switch always fails at second password prompt
Whenever logging into a network device using AAA/TACACS+, if I fat-finger the password prompt after the username prompt, the second password prompt always fails even when the password is correct. I ...
- 7,134