Centralized (IAS/Radius) Authentication under IDS/IPS 4260

Answered Question
Jun 17th, 2010
User Badges:

All,


I have been tasked with the configuring centralized authentication via IAS for all the IPS/IDS devices in the enterprise.  After much invest I'm almost sure that due to limitations inherent to the device my goal is not obtainable.  However, I am still not 100% sure.  My questions are:


1. Can anyone provide a link or any documentation showing definitively whether or not the IPS 4260 supports IAS/Radius authentication?

     a. If not, what would be a suitable alternative? CSM, etc.?

Correct Answer by Scott Fringer about 7 years 1 week ago

Cisco's IPS sensors do not currently support externally authenticated access.  They will only support

local username/password authentication and role assignment.


Scott

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
Correct Answer
Scott Fringer Thu, 06/17/2010 - 09:28
User Badges:
  • Cisco Employee,

Cisco's IPS sensors do not currently support externally authenticated access.  They will only support

local username/password authentication and role assignment.


Scott

trippi Fri, 07/30/2010 - 13:47
User Badges:

This is available with the latest release.

bestsoftware Wed, 11/16/2011 - 15:56
User Badges:

Hi All,


I have several IPS ASA-SSM-10 and IPS 4260, I spent several hours trying to get them to authenticate through MS IAS 2003 R2, I was able to get them authenticated thru SSH but not in ASDM. I really appreciate if anyone have any information how to get these working in ASDM.


Thanks


Si

Farrukh Haroon Wed, 11/16/2011 - 19:25
User Badges:
  • Red, 2250 points or more

Hello


What version are you running on the IPS?


Login to the CLI and keep running the show events command, then login with HTTPS (IDM) and post the exact error in the event log


Regards

Farrukh

bestsoftware Thu, 11/17/2011 - 09:08
User Badges:

Hi Farrukh,


All IPS/IDS are running version 7.0.4. I did what you recommended and below are the logs I captured:


evStatus: eventId=1306479664548993105 vendor=Cisco


  originator:


    hostId: NACAIRVIDLAB1


    appName: cidwebserver


    appInstanceId: 349


  time: 2011/11/17 16:57:45 2011/11/17 16:57:45 UTC


  loginAction: action=loginFailed


    description: User failed to authenticate with the HTTP server


    userName: best\xsxtran


    userAddress: port=64368 10.90.204.17





evStatus: eventId=1306479664548993106 vendor=Cisco


  originator:


    hostId: NACAIRVIDLAB1


    appName: cidwebserver


    appInstanceId: 349


  time: 2011/11/17 16:57:58 2011/11/17 16:57:58 UTC


  loginAction: action=loginFailed


    description: User failed to authenticate with the HTTP server


    userName: best\xsxtran


    userAddress: port=64369 10.90.204.17


Thanks for all your help


Si

Farrukh Haroon Fri, 11/18/2011 - 23:24
User Badges:
  • Red, 2250 points or more

Hello,


I think I saw the same issue before, in your AAA config on the sensor(s) please change the default user role to administrator.


On the CLI:


service aaa

default-user-role administrator


This can also be done through the GUI (IDM).


Regards

Farrukh

bestsoftware Mon, 11/21/2011 - 08:28
User Badges:

Hi Farrukh,


Thanks for helping. I figured out the problem. It was the IOS bug. It worked as soon as I upgraded to version 7.0.6. All my IPS/IDS authenticated through Microsoft Radius now.


Si

Farrukh Haroon Mon, 11/21/2011 - 09:51
User Badges:
  • Red, 2250 points or more

I'm glad you have it working now and thanks for sharing with everybody


Regards


Farrukh

Actions

This Discussion

Related Content