Questions tagged [aaa]

For questions about network Authentication, Authorization, and Accounting. These are methods which comprise a security framework for access control on the network, services, and/or devices.

Filter by
Sorted by
Tagged with
0
votes
1answer
39 views

What's the difference between DIAMETER and 802.1X Authentication?

I'm studying the 802.1.X authentication guidelines and the DIAMETER protcol as successor of RADIUS but i can't figure out what are the main difference between pure 802.1X Port-Based Authentication and ...
3
votes
3answers
2k views

Cisco ASA 5585 SSH LDAP Authentication

I am attempting to setup Microsoft LDAP authentication, for SSH only, for a specific security group on a Cisco ASA 5585 version 8.2(5) using the ASDM. The lookup and authentication is working, however ...
0
votes
1answer
315 views

Cisco 2960 radius configuration

I have multiple cisco switches like Nexus family and IOS family switches and now i am trying to configure centralized authentication so i have install Freeradius and freeIPA (ldap server) I have ...
2
votes
1answer
280 views

Cisco ISE and WLC 802.1x Non-Dynamic VLAN Placement

I am trying to migrate from Microsoft NPS using 802.1x PEAP to Cisco ISE 802.1x PEAP for our WLC wireless clients. I see a lot of articles regrading Dynamic VLAN assignment, which we are not trying to ...
2
votes
3answers
9k views

Reason of “aaa authorization exec default group tacacs+” command in Cisco IOS?

I have a following very minimalistic AAA configuration in ISR router with IOS 12.4(22)T: aaa new-model aaa authentication login default group tacacs+ enable aaa authentication enable default group ...
1
vote
1answer
117 views

Tacacs+ over VPN is not working

R3 is a Tacacs+ client and Server0 is configured as AAA server with Tacacs+ but R3 is not able to authenticate. R3 Configuration: ! version 15.4 no service timestamps log datetime msec no service ...
1
vote
0answers
2k views

TACACS with Juniper Devices

Can any one please help in configuring a TACACS+ server, along with configuration in Juniper devices? Ubuntu Server 14.04 Juniper QFX5100 switch Below are my configurations: For the TACACS+ server: ...
1
vote
1answer
34 views

Privileged Identity Management for switch users' account

Is it possible to create an account in the switch for managing switch users' accounts such like changing password but may not allow to change specific administrator user. Can it be set on lower ...
2
votes
1answer
453 views

Cisco Mobility Express - supported authentication options

What are the supported authentication options for the ME APs? Do they support only login through local credentials or RADIUS/TACACS+ is also supported?
0
votes
1answer
692 views

Cisco 2960-S switch with MAB and Packetfence Web Authentication

I am trying to set up Packetfence In my corporate environment for guest users, with MAC access bypass. i have done everything like in the official Packetfence installation guide https://packetfence....
5
votes
2answers
2k views

AAA authentication for all users and a single user for local only?

Is it possible to have AAA for a switch or router, dealing with JunOS, IOS and NXOS. Where all users default to a radius/tacacs server but there is a single user that bypasses the remote auth and uses ...
3
votes
3answers
981 views

Can I limit Cisco IOS login to specific users?

I have a Cisco IOS router that is used for WAN access. I have 2 additional users defined with less privilege to check status and to use ssh. I wonder if it is possible to restrict certain user to only ...
1
vote
1answer
67 views

Where did `private_sg-0` come from?

I'm configuring my first Cisco product (WS-C3560CX-12TC-S) and trying to get to grips with aaa. I'm used to *nix where the first thing you do with headless devices is enable and configure SSH access ...
1
vote
1answer
2k views

How to Multiple Radius server in ASA

We have two RADIUS server for SecureID token auth for VPN and i have configure 10.1.1.1 (primary) but don't know how to configure 10.1.1.2 (backup radius) This is what i have currently aaa-server ...
1
vote
1answer
1k views

AAA Radius Privilege levels

I've setup a Windows 2012 Server R2 Radius server to commmunicate with CISCO IOS devices. There are two categories of users: with just read only rights(shell:priv-lvl=1), and read/write (shell:priv-...
1
vote
3answers
1k views

cisco ssh key authorization level via radius

Related to Authenticate ssh key via Cisco ACS (TACACS+) Given a working ssh public key config: ip ssh pubkey-chain username admin key-string <ssh-pub-key> exit exit I have only been ...
6
votes
1answer
6k views

AAA Authorization Timeout

Log into a Cisco IOS device with TACACS Authorization enabled Do a command that causes the device to lose access to the TACACS server Enter a command that requires TACACS Authorization By default, ...
1
vote
1answer
989 views

Lockout of console! Help required!

I'm locked out of the console after applying two AAA authorization statements aaa new-model aaa authorization console aaa authorization exec default group tacacs+ none Now my customer requires me ...
1
vote
1answer
2k views

Cisco 3750 switch not communicating with RADIUS server

I have a Cisco 3750 switch and I want to make it work with PacketFence NAC. I have configured the switch according to their network configuration document here, but the switch is still not ...
0
votes
1answer
348 views

Cisco 3750 AAA configuration troubleshooting [closed]

I am currently setting up PacketFence and trying to make it work with the Cisco 3750 switch. I have followed the instructions from this PacketFence network configuration (except using a different VLAN ...
1
vote
1answer
154 views

802.1X for Wi-FI

I have a hidden SSID network. I know that although the SSID is hidden, someone can sniff the Wi-Fi channels to get my SSID, and with that SSID he can use some OpenWRT-ish things to spoof my Wi-Fi ...
-2
votes
1answer
232 views

What does aaa mean?

In the below configuration, what does aaa mean? aaa authentication login CON local aaa authentication login VTY group VTY local aaa authentication dot1x default group DOT1x aaa authorization exec ...
1
vote
2answers
125 views

Is every Switch capable of Network Access Server?

i am learning about Radius Server and particularly freeRadius. NAS devices are responsible for sending Authentication requests to the Radius Server. NAS devices include like Switch, wireless access ...
3
votes
1answer
335 views

AAA & NAC: Use last authorized vlan of a port, if AAA-Server is dead?

I'd like to know if there is any way to configure the switch so, that in case the radius-server is dead and devices try to (re)-authenticate the port gets the latest vlan which was authorized on this ...
4
votes
1answer
19k views

% Authorization failed. message appear when I try to connect to the switch using local DB user name

I configured aaa using Tacacs+ on a switch and a router but when I try to connect to the switch through SSH it just accept Tacacs+ users when I try to use local DB user I got "% Authorization ...
2
votes
2answers
1k views

Privileged EXEC mode not accessible after the upgrade

I hope you are well. I did the upgrade of SF300-48P to the latest version 1.4.0.88 using my TACACS acc. After that I could ssh to the switch, but it wouldn't allow me access Privileged EXEC mode - "...
1
vote
0answers
247 views

Able to test AAA to Radius Server from router but unable to log into Router with A.D

I am having issue with setting up my Radius server to authenticate before going to the router. I am able to do a test from the router successfully but once I exit the router and log in with my Windows ...
4
votes
1answer
218 views

Authentication error

I have set the username **** privilege 5 secret **** & applied aaa via console. now unable to access switch through console. After entering enable showing authentication error. can someone help ...
9
votes
3answers
25k views

AAA/TACACS+ password on Cisco switch always fails at second password prompt

Whenever logging into a network device using AAA/TACACS+, if I fat-finger the password prompt after the username prompt, the second password prompt always fails even when the password is correct. I ...
2
votes
2answers
106 views

Limit Access to a Specific VRF?

I may be barking up a tree that doesn't exist but I am trying to find out if there is a way to limit a user or group's access to only a specific VRF. This is a 6500 series switch. Note, I am not ...
1
vote
2answers
4k views

How can I get a list of users and last login dates from a Cisco ACS running v5.2?

I'm trying to get a list of the users that have logged into a Cisco ACS, and the date of their last login. Ideally, I'd like it to include the identity store that was the source of the authentication ...
4
votes
1answer
1k views

What was the AAA “old-model”?

Any AAA configuration on a Cisco router begins with the command aaa new-model. Per the context help: R1(config)#aaa ? new-model Enable NEW access control commands and functions.(Disables OLD ...
3
votes
0answers
1k views

AAA - IP HTTP server: local authentication and authorization

We configure AAA on router for the Telnet/SSH access. We activate HTTP on our router to our provisioning tool. The provisioning tool needs to retrieve information and execute some command on the HTTP ...
1
vote
1answer
296 views

AAA Authorization

I have a 3750x with TACACS AAA configured. If I login using TACACS, CLI commands run fine, no wait between commands. However, if I disconnect from network, taking away the ability to hit the tacacs ...
1
vote
3answers
2k views

After configuring tacacs cannot access to cli

After configuring Tacacs+ cannot access throught tacacs or telnet: aaa new-model ! ! aaa group server tacacs+ TACACS+CG server [server ip address] server [server ip address] ! aaa authentication ...
1
vote
2answers
57 views

enable additional commands centrally for IOS privilege levels other than 15

Privilege level 15 in IOS has all the possible commands for particular IOS release enabled. However, for example privilege level 1 has only few dozens of commands available. Now if I want to allow ...
4
votes
1answer
192 views

Default authentication/authorization/accounting list on all lines?

Am I correct that if one has not specified a named authentication list(login authentication ... under line configuration), authorization list(authorization .. under line configuration) or accounting ...
6
votes
1answer
4k views

How to view default authentication method for different lines(cty, vty, aux, tty) in IOS?

For example if I enable AAA(aaa new-model) in IOS router with default configuration and try to log in over console line(cty), then there is no authentication. However, if I try to log in over telnet(...
3
votes
2answers
836 views

Fortigate user traffic quota

I'm trying to limit internet users by traffic quota in fortigate firewall.Is there a way to limit users traffic usage and set quota for them in fortigate? i think there is no built-in feature for ...
4
votes
1answer
3k views

How do you block a specific computer from VPN on a Cisco ASA?

We want to be able to disable a computer in Active Directory and prevent that computer from accessing our VPN. I have an ASA VPN setup, with Cisco Security Desktop, and a Dynamic Access Policy to ...
8
votes
3answers
4k views

Cisco WLC: Per user authentication, many Vlans, few SSIDs

We have a simple problem. We want to restrict our wireless users to certain business websites based on their username when they login. We have many kinds of wireless devices: voip phones, cell phone,...
1
vote
1answer
113 views

SecureACS - and LDAP

I'm having problems understanding the concept of how ACS is supposed to work. Today, we have routers that use aaa (ACS) to authenticate users trying to telnet into the box. However, anyone w/ a ...
6
votes
1answer
3k views

Cisco + FreeRADIUS: Exec 15 level privilege mode

I have two routers: Cisco ISR 2921 with IOS version 15.0(1r)M9 and a Cisco C2600 which is an old guy with IOS 12.0(7)XK1. I have this set up on a FreeRADIUS server: router-admin MD5-Password := "&...
8
votes
1answer
1k views

FQDN's in crypto maps and AAA servers possible with dynamic DNS resolution? Cisco ASA

Can I use FQDN's in crypto maps when setting a peer (where I'd normally use an IP), and can I use FQDN's when defining an LDAP Server or any other AAA Server in a server group? In both cases the FQDN'...
6
votes
1answer
4k views

How does Cisco perform authentication server reachability on aaa?

Let's suppose we have a line like this: aaa authentication login default group radius group tacacs+ local According to the IOS 12.2 documentation: If R1 authenticates the user, it issues a PASS ...
6
votes
2answers
27k views

What are the different modes in Cisco routers, and why these modes?

I want to know on what basis Cisco designed the different modes in their routers. For example: config mode execution mode Can any one give the perfect reasons behind the different modes? What ...
6
votes
2answers
1k views

Cisco AAA authorization with no user group

Can anyone help me with understanding one thing about AAA authorization on Cisco IOS. Here is a config fragment: aaa authorization config-commands aaa authorization exec default group tacacs+ local ...
7
votes
2answers
3k views

Tacacs VRF authentication

We just got a new Supervisor7 with os 3.4.1. I'm trying to configure authentication with tacacs, and I can't understand how to make it work. This configuration works on our other switches, but it ...