10

I got response from Cisco Tech support and there are a few things not correctly described in the manual. First, ASR router supports key size 1024 bit or smaller contrary to its manual(supporting up to 2048 bit key). Second, only the key part of SSH public key must be 'de'coded w/ base64 en/decoding program. SSH Key Generation ssh-keygen -b 1024 -t rsa -f ...


10

If your access points are independent, then yes, each time you connect to an access point, you need to authenticate. This happens automatically in the background but incurs some delay and the communication will be briefly cut. This is one of the major issues with stand-alone APs. To solve this, you can use access points managed centrally by a controller. In ...


9

UPDATE 01/10/2018: Added missing library to enable Perl regular expression support (libpcre3-dev) UPDATE 11/07/2017: There is a bug in MAVIS. If you are having trouble using LDAPS on port 636 or 3269, completely remove the USE_TLS configuration variable from your tac_plus.cfg. This will fix the problem. I've emailed the author with my findings. This guide ...


8

It seems that this line is missing from the c2600... aaa authorization exec default group radius local Exec authorization is what gives a login session the ability to pay attention to priv information from the RADIUS server.


8

It depends on how your access points are set up. If your access points are centrally managed by a wireless controller, then the wireless controller will synchronize authentication traffic from radius servers. The access points can reach the wireless controller for authentication every time it is required. The user won't experience an interruption when they ...


7

I am aware of MAC address filtering available on most WiFi routers, but this is about access control on a device by device basis. One user may have many devices. Is there any way to control WiFi network access on a user by user basis? Use 802.1X with PEAP/MSCHAPv2. This authentication scheme will permit you to authenticate your users against a RADIUS ...


6

Your SSH client is saying "we can't agree on the cipher: server wants X but I'm configured not to speak X". This is a completely general SSH problem, not specifically related to this model of switch, which is that the SSH clients are regularly changed, usually to disallow older, weaker, ciphers. This isn't about key length, it's about cipher algorithms. ...


5

Well I managed to figure this out. The bottom line is: Using authentication-key-chains uses the "TCP Enhanced Authentication Option" Using authentication-key uses the "TCP MD5 Signature Option" From https://tools.ietf.org/html/draft-bonica-tcp-auth-06 12.4. Backwards Compatibility On any particular TCP connection, use of the TCP Enhanced ...


5

802.1x is port based. So, in simplest form, the port is either authorized or not; once authorized -- MAC limits aside -- traffic from anything will be allowed. Modern 802.1x systems are much smarter ("more complicated") and can independently police multiple hosts on a single port. This is where multi-auth and multi-domain come in. (consult Cisco here) As ...


5

According to my experience the two most common issues when dealing with AAA and Radius are: Misspelled/Absent pre-shared key on the RADIUS server or on the NAC (Radius client) The Radius server misses the configuration to allow requests from a client. Doing troubleshooting with comments it turned out that the pre-shared key was missing on the router. To ...


5

Here's a generic example of a Cisco device. The localadmin user can only use the console port, unless tacacs is not available, in which case the user can login remotely. username localadmin password xyz priv 15 aaa authentication login CONSOLE local aaa authentication login VTY group tacacs+ local aaa authorization exec VTY if-authenticated aaa ...


5

The 2910al supports 802.1X port security as authenticator, using RADIUS over EAP or PEAP. Depending on your exact goals, an additional router is not required but you do need a RADIUS server. Check the 2910's "Access and Security Guide" chapter 13. If you've got nothing local to use as a RADIUS server you'll need a router to connect elsewhere - however, you ...


4

Putting aside the question of how one would define a "safe network," web authentication is typically used to restrict access by wireless users to a resource, such as a corporate network, or Internet access. Without using some form of encryption, anyone within range can sniff traffic and eavesdrop on the data being sent. In other words, using web ...


4

You would need to configure MAB (Mac Auth Bypass) authentication for the ip phone in the multi-vlan interface. You also need multi-auth so the switch knows to look for more than one MAC address. -authentication host-mode multi-auth -authentication order mab dot1x


4

802.1X does perform either a computer or a user authentication to allow the network access. NAC is a generic term designing any form of Network Access Control. Then 802.1X is one kind of NAC. I consider 802.1X to be the standard of NAC. Beware here of the abbreviation collision around NAC which stands for Network Access Control and Network Admission ...


4

I can sympathize, IOS authentication mechanisms are not simple to understand. The closest command that does what you want is show aaa method-lists authentication. However, this command is not really bullet-proof for the purposes of auditing system login authentication methods. Example usage: For example, let's suppose we have a switch with the following ...


4

Before 2 hosts start using AH with each other, they need to agree on a common set of parameters, a security association or SA. This is typically achieved using the IKE protocol (IKEv1 or IKEv2). As part of this negotiation they also derive a session key or "secret", i.e. a random value that only these 2 hosts know. This secret is then also fed into the ...


4

You can try to disable dot1x port-control on a specific interface under interface configuration mode using no form command of no dot1x port-control ...


4

There are many variables to consider when configuring LAN Authentication, but here is a page from the HP manual on configuring 802.1x, and here is one from the Freeradius Wiki. These two links should get you started.


4

This line: aaa authorization exec default local Doesn't allow you to start a shell (Exec) with Radius credentials. You should change it to: aaa authorization exec default group radius local


3

There's a standard to achieve this: 802.1X. Basically the switch request authentication from the computer, then contact an authentication server to validate the credentials and depending on the answer the switch will deny or allow access. There's further possible options, like placing the host in a guest vlan if not authenticated or placing the host in a ...


3

I upgraded to Anyconnect 3.1.04063 and this has resolved my problem.


3

First of all I don't think that static MAC-IP bindings have anything to do with security. MAC addresses can be easily faked and guessing a valid but unused IP for your network and manually assigning that to an interface is not rocket science. What you are looking for is most probably 802.1x. With 802.1x each client gets a certificate and only those clients ...


3

Taccas server will always be in sync with organization LDAP server. Let assume cisco switch is login from taccas server TACCAS ip address Configuration need to configure on cisco switch when user is entering login credentials, authentication request traffic will forwarded towards TACCAS server . TACCAS server will validate credentials of user . Because ...


3

This works on 2960x software 152-7.E4: ip ssh version 2 no ip ssh server algorithm authentication password no ip ssh server algorithm authentication keyboard line vty 0 15 transport input ssh This should remove telnet login also


3

You are misunderstanding what that is telling you. Simply for the purposes of the calculation, you use zero for those fields; you don't actually change those fields to zero for the packet.


3

In short, you can't. One option is to create a separate WLAN (with a separate SSID) that has a static password. You should also apply strong filtering on that WLAN, so that the devices can reach only the necessary destinations. As @ronmaupin points out, IoT devices tend to have all sorts of vulnerabilities. So putting them on a general production WLAN ...


3

802.1X provides client-side/front-end port-level authentication (between suplicant and authenticator). RADIUS and Diameter provide back-end authentication (between authenticator and authentication server). Essentially, they are different things. 802.1X is an application while RADIUS/Diameter can potentially provide authentication for various applications. ...


2

I don't know of any switches that are 802.1x supplicants, so Option A is probably out. So between Options B and C, the primary difference is cost. I imagine rewiring your office is both expensive and disruptive, vs the cost and the hassle of managing all those new switches. The real question you should be asking is, what threat am I defending against, ...


2

The most common way is to segregate access based on group membership. Within ACS there is/should be an "Access Policies" menu - I won't go into every detail of configuring ACS here, because that's why there's a manual, but you can essentially define your policies of which groups members can log in (and which group members have access to run which commands) ...


Only top voted, non community-wiki answers of a minimum length are eligible