프ㅠ푸 ---------- Message transféré ----------M De : "Murat Kaipov" <mkkaipo [email protected]> Date : 23 juin 2014 10:11 Objet : [c-nsp] ACS 5.2 authorization issue À : <[email protected]>
Hello Guys. I have little issue with authorization on ACS 5.2 for network access. Radius status: Authentication failed : <https://172.24.25.6/avreports/servlet/GenericRedirector?command=submit&__re questtype=immediate&invokeSubmit=true&__executableName=%2Fhome%2Facsadmin%2F Failure_Reason%2FAuthentication_Failure_Code_Lookup.rptdesign&rptFailureReas on=15039+Selected+Authorization+Profile+is+DenyAccess&__locale=en_US&iportal ID=TKNENRBYE&__masterpage=false&__newWindow=false> 15039 Selected Authorization Profile is DenyAccess For some reason some peoples can authorize and get access to network, others can't. ACS have access to Active Directory host, this issue occur only with one group in AD. I have log from ACS. 11001 Received RADIUS Access-Request 11017 RADIUS created a new session Evaluating Service Selection Policy 15004 Matched rule 15012 Selected Access Service - Network Access 11507 Extracted EAP-Response/Identity 12700 Prepared EAP-Request proposing LEAP with challenge. 11006 Returned RADIUS Access-Challenge 11001 Received RADIUS Access-Request 11018 RADIUS is re-using an existing session 12702 Extracted EAP-Response containing LEAP challenge-response and accepting LEAP as negotiated. Evaluating Identity Policy 15006 Matched Default Rule 15013 Selected Identity Store - AD1 24430 Authenticating user against Active Directory 24416 User's Groups retrieval from Active Directory succeeded 24402 User authentication against Active Directory succeeded 22037 Authentication Passed Evaluating Group Mapping Policy Evaluating Exception Authorization Policy 15042 No rule was matched Evaluating Authorization Policy 15006 Matched Default Rule 15016 Selected Authorization Profile - DenyAccess 15039 Selected Authorization Profile is DenyAccess 12706 LEAP authentication failed; Finishing protocol. 11504 Prepared EAP-Failure 11003 Returned RADIUS Access-Reject __________________________________________________________________ B.R. Murat Kaipov e-mail: <mailto:[email protected]> [email protected] _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
