Network Security Blog

TACACS+ and ISE:2.x Recommended Configuration :-

ip http server

ip http access-class 61

ip http authentication aaa

ip http secure-server

CERTIFICATE HISTORY IN ACS
please note that the ACS will always send back the whole certificate chain.

The procedure for CA certificate install on ACS is documented here:
https://supportforums.cisco.com/servlet/JiveServlet/previewBody/13545-102-1-30993/IBNS%20Phased%20Implementation%20Configuration%20Guide.pdf

The procedure for CA certificate install on ISE is documented here from page 13 onwards:
http://www.cisco.com/en/US/docs/solutions/Enterprise/Security/TrustSec_2.0/trustsec_2.0_dig.pdf

The certificate errors occur when the client is not having the CA certificate in the client trusted certificate store.

For example with windows (same will apply to Android as well, but you can search the details on the Android forums via Google search, since this is client side issue):
If the ACS certificate is signed by an external CA server like verisign, then the windows client PC by default should have this CA server in the list, and you can select/check mark the CA server in the Trusted Root Certification authorities list on the windows client PC.

If the certificate issued to ACS is from unknown CA server which is not on client side, you can then export the CA server certificate by running the following command on your CA server:
certutil -ca.cert c:\temp\domain-SERVERNAME-CA.cer

On the Windows 7 client for example, you can use the Certificates MMC snap-in to import it into the user's Trusted Root CA Certificate Store
(run MMC.EXE, File -> Add/Remove Snap-in -> Certificates -> My User Account -> Trusted Root Certification Authorities -> Certificates -> right-click -> All Tasks -> Import).

On your Win 7 client PC, from the network properties settings, if you go to security tab, and click on the "settings" option next to Protected EAP (PEAP).
Under Trusted Root Certification authorities, you should then see and check mark your ACS local-certificate in the list.

Also refer to microsoft article:
http://support.microsoft.com/kb/2518158

For third party certs, you can export the certificate of the CA that issued the certificate to the authentication server to a file. Copy the file to the workgroup machine and then run the following command from an elevated Command Prompt:
certutil -enterprise -addstore NTAuth CA_CertFilename.cer
-----------------------------------------------------------------------------------------------------------------------------
1.go to localserver cert>create CSR with
Field Field Name Min. Length Max. Length Required?
CN commonName 1 64 Yes
OU organizationalUnitName — — No
O organizationName — — No
S stateOrProvinceName — — No
C countryName 2 2 No
E emailAddress 0 40 No
L localityName — — No
2.bind this ce

ACS TO AD

1. First it looks to see if it can reach DNS using both UDP and TCP

2. Next it does a reverse DNS lookup of its IP to find the name

associate with that IP in DNS. If ACS is behind NAT, the local (not

natted) IP address should resolve to the hostname of the ACS.

3. Next it does a _ldap._tcp. DNS query for the domain to find the DC

4. It then checks to see if it can reach the DC on the following ports:

ldap: 389/tcp

ldap: 389/udp

smb: 445/tcp

kdc: 88/tcp

kpasswd: 464/tcp

ntp: 123/udp

5. It then binds (LDAP) anonymously to the DC to find the following:

DC name

DC OS

Domain name

GC Status

DC funtionality

Site name

6. Next it tries to find the GC using the _gc._tcp. DNS query.

7. Then it checks if GC is reachable on port 3268.

8. Next it connects to the DC again to verify the site name and subnet.

9. Finally it compares the clock with ACS and the DC

========================================================================


Database replication
TCP 2638

=====================================================================


ACS View Collector
UDP 20514

========================================================================

SNMP (for request)
UDP 161
SNMP (for notifications)
UDP 162


=======================================================================

http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-5/user/guide/acsuserguide/admin_operations.html#pgfId-1066095



AD:-


++Check that the clock between AD and the ACS matches there could be a

5 minute difference  but the time zone has to be the same.

+ +That the domain name that you configure on the AD 

configuration on the ACS can be resolved by the DNS server set up on the

ACS. To check this you can perform a ping < domain-name> or nslookup <domain

name>.

++That the user being used to make the bind has account 

operator rights since this account will be used to create a computer account

on AD. Also we recommend that this account isn't used by anyone and is set

to never expiries.

++Go to the ACS GUI and perform a test connection and 

send me the output. To do this go to Users and identity stores > External

Identity stores > Active directory.

ACS 5.x version was designed to retrieve the AD Attribute information only
when referring to the AD:External Groups.
1.Restarting the acs services
2.Delete the ACs machine account from the AD and disconnect/re-join it to the AD.

How to change kerberos encryption:
Security Settings \ Local Policies \ Security Options \ "Network security:

"Configure encryption types allowed for Kerberos"

While processing an AS request for target service krbtgt, the account smcwifiacs01$ did not have a suitable key for generating a Kerberos ticket (the missing key has an ID of 1). The requested etypes were 1. The accounts available etypes were 23  -133  -128  18  17  3  -140

http://support.microsoft.com/kb/978055 - KB Article:
FIX: User accounts that use DES encryption for Kerberos authentication types cannot be authenticated in a Windows Server 2003 domain after a Windows Server 2008 R2 domain controller joins the domain

http://technet.microsoft.com/en-us/library/cc734055.aspx- Event ID 26 — KDC Encryption Type Configuration


http://technet.microsoft.com/en-us/library/jj852180%28v=ws.10%29.aspx - Network security: Configure encryption types allowed for Kerberos

While processing an AS request for target service krbtgt/SOMERSET-HEALTHCARE.COM, the account smcwifiacs02$ did not have a suitable key for generating a Kerberos ticket (the missing key has an ID of 3). The requested etypes : 17. The accounts available etypes : 23  -133  -128. Changing or resetting the password of krbtgt will generate a proper key.

http://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xml



While processing an AS request for target service krbtgt, the account smcwifiacs01$ did not have a suitable key for generating a Kerberos ticket (the missing key has an ID of 1). The requested etypes were 1. The accounts available etypes were 23  -133  -128  18  17  3  -140


http://support.microsoft.com/kb/978055 - KB Article:
FIX: User accounts that use DES encryption for Kerberos authentication types cannot be authenticated in a Windows Server 2003 domain after a Windows Server 2008 R2 domain controller joins the domain

http://technet.microsoft.com/en-us/library/cc734055.aspx- Event ID 26 — KDC Encryption Type Configuration


http://technet.microsoft.com/en-us/library/jj852180%28v=ws.10%29.aspx - Network security: Configure encryption types allowed for Kerberos

ACS was sending DES which is disabled by default on 2008 R2

http://tools.ietf.org/html/rfc3961#section-8

================================================================================

Below are the Use commands performed under Root Mode after installing Root Patch provided by cisco TAC

To stop the adclient:
./ACS_AD_Runner.sh adclient -x

To start the adclient:
./ACS_AD_Runner.sh adclient

To leave a domain:
./ACS_AD_Runner.sh adleave –u <username> -r

To join a domain:
 ./ACS_AD_Runner.sh adjoin –u <username> -z null –V <domain>


To flush the client cache:
./ACS_AD_Runner.sh adflush


/opt/CSCOacs/runtime/adagent/etc
# acs stop adclient
# vi centrifydc.conf
 dns.dc.<domain.name>: <hostname>
dns.gc.<domain.name>: <hostname>
# Example:
# dns.dc.acme.com: anvil.acme.com cayote.acme.com 
# dns.gc.acme.com: roadrunner.acme.com
Press 'a' on your keyboard to enter write mode
Press Esc to exit write mode
9) Enter :wq

========================================================================

acstest/rsriramo# acs troubleshoot adcheck MCS55.com

acs/admin# acs troubleshoot adcheck -v   (centrify DC)

acstest/rsriramo# acs troubleshoot adinfo -a   (connected or not connected)

acstest/rsriramo# acs troubleshoot adinfo -r (shows joined domain controller)

Here basically snmp below 5.2 patch 9 there was an issue
where always snmp will stop responding
so this is a bug.
the work around for that is
we need to go into the linux mode and restart snmp services.
but every time we cannot restart the services

but questions comes after 5.2p9 i.e we are running in 5.5
in this there was a new term called cron

cron is a new feature introduced in 5.4 p1 above
where for every 1min it will check whether my snmp running or not
for ex if it is not running cron will automatically restart snmp process
will send coldstrap alert to solor winds(snmp server)
coldstrap is =restart of snmp=device reboot
now this nsg is sent to snmp server,we think it device reboot
now you can ask me another question
like what if my device really reboots services restarts
yes, there also another trap which sent to snmp server when services restarts

#5411 EAP session timed out ->
this means the client did not respond to the ACS within certain timeout hence failed the authentication.

This usually happens when a client starts the authentication process,
however for some reason this never ends and ACS is still waiting for
information coming from the client machine,
but if there is not a response in the next 120 seconds then the ACS finish
the process and shows the error 5411 EAP session timed out

Workaround:
I assume that the WLC is the one sending the authentication request to the
ACS server, right? If so, go to the RADIUS server configuration in the WLC
and increase the time out value to 20 seconds.
Please give it a try and let me know the results.
If The error message that we are getting "
5411 EAP session time out" is more of cosmetic issue rather than
authentication related issue.


We can actually ignore the error message if all your users are able to
authenticate fine .

"This may be due to EAP mis-configuration on ACS or Network Device."

So you want to know if there is a problem with the ACS or network client
configuration that you need to take care here, please correct me if I am
wrong.

This is a very common request ___ and the message the ACS provides makes
anyone think that could be a problem with the EAP setting in your server,
most of the times when we receive similar cases the error message comes
along with this other alarm "5411 EAP session timed out", first of all ___
there is nothing to worry or change in the ACS server.

The new ACS 5.x now provides way more information about the authentication
requests (pass or fail), this is a generic message, and may be generated for
multiple reasons for example when there is no response for first EAP packet
from client, the client dis-associating from WLC, the end user didn't type
the username or password in the proper time, client closed the
authentication prompt without entering the credentials, etc.

When this occurs the ACS displays the error "EAP session timeout" or "This
may be due to EAP misconfiguration on ACS or Network Device" because its
expecting an EAP response from the client, but does not receive the response
in a timely manner.

This doesn't represent a problem in the authentication unit or similar is
just an informational message that the ACS provides in the reports.

switch<---------------------------------->radius server

switch<----------$%$%$%%%---------------->radius server
                    no responce from server
                 
                 
default value is 0>>never modify this command
because  retransmission to the server is goo parctice

http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/TrustSec_1-99/Dot1X_Deployment/Dot1x_Dep_Guide.html#wp387334

Using cisco ACs server you can authenticate Windows Machine whether it has joined to Domain or not. You can use below config in ACS server with Machine Access restriction enabled.