ACS 4.2 Appliance integration with LDAP

muhammadsafwan · ‎11-16-2008

Hi,

I would like to ask some question from the expert here.

1. I'm building 802.1x infra for my customer.

2. We are using ACS SE version 4.2

3. We have successfully integrate the ACS with AD using Remote Agent.

4. Using will authenticate using PEAP MS-CHAP v2.

5. However, my customer dont want to use Remote Agent (RA) because the want the ACS talk to the external database directly.

6. Their argument is, if they bought other Radius appliance for this project, the appliance should have the same function in order to authenticate the user.

7. What are needed to complete this requirement?

I saw in this table http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/Overvw.html#wp857274 the LDAP does not support PEAP MS-Chap v2.

Can any expert give opinion on this issue?

didyap · ‎11-21-2008

As you can see in the table LDAP doesn't support MS-Chap v2. There are many types of authentication; you can take a authentication types which is supported by LDAP. Here is the URL for the LDAP Integration with ACS Configuration Example it may help you

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00809a9d08.shtml#veri

hclisschennai · ‎05-23-2009

Hi,

I also encountering the same scenario.

My wireless clients (windows XP) are authenticating using MS-CHAPv2. Currently I am using username/password in ACS itself. We are planning to move this username/password to LDAP and remove the username database in ACS, so that ACS will contact LDAP for username authentication.

Whethter it will work out?

RBK

darpotter · ‎05-26-2009

Despite various efforts a few years back, LDAP vendors could not be persuaded to implement an MSCHAP interface - which is technically possible.

That said ACS also has its Windows External Authenticator that will do MSCHAP just fine to a Windows AD Server (via a different interface).

The old LEAP protocol was mschap inside EAP. EAP-FAST can also do mschap too.

The key is not use the LDAP authenticator in ACS. If you really must use it, you'll have to make sure you use EAP-GTC inside your PEAP/FAST tunnel

darpotter · ‎05-26-2009

The issue here is that the appliance sits outside the domain - mainly because its hardened.

If you had the s/w version of ACS, you'd install it on a member server of your AD... and it would just work.

One good reason why appliances arent great if youre using Windows for security (IMHO)