07-02-2010 02:15 AM - edited 03-10-2019 05:13 PM
Hi,
I have setup RADIUS authentication for Management AND network users, on my NM-WLC (running 5.2) against ACS 5.1
My Question is :-
For Admin users to login, I need to return "Service-Type=Administrative-User" in order for it to work.
Since the ACS sees all requests coming in from the same device (WLC) for Admin as well as Network users,
the way I am currently handling this is by creating a filter based on user-name
So, users that contain "admin" in their user-id, use one set of
Network Access Authorization Policy, which has an associated Authorization Profile, with RADIUS attributes.
Normal users, have a different "Network Access Authorization Policy Rule", with another Profile.
While this DOES WORK fine, I am still left wondering if there is a better way to do this, rather than create a rule,
based on user-name.
I could use TACACS+ for Management, but I dont think ACS allows the same AAA client (WLC) to use both protocols.
Thanks
Solved! Go to Solution.
07-05-2010 11:29 PM
I think this is a very common way for things to be done
You may notice that out of the box ACS 5 comes preinstalled with a service selection policy that differentiates requests based on the protocol and directs either to a "Default Network Access" or "Default Device Admin" service
If you only want to do RADIUS can either disable or delete the rule for TACACS+ requests or not select TACACS+ in device definitions
07-05-2010 08:30 AM
Hi,
You can use RADIUS and TACACS at the same time, without any problems (I have done it my self several times), you can then use different service selection rules based on whether the request came via RADIUS or TACACS. The limitation of only supporting RADIUS OR TACACS on applies to v4.2 and earlier.
Rgds,
Richard
07-05-2010 08:36 AM
Thanks. Earlier I was trying to add the same client twice with different protocols.
Just tried checking both checkboxes (radius & tacacs+), for a single aaa client, and it let me do that.
So I guess I *CAN* use TACACS+ for Management and RADIUS for Network users....
But is that the way its normally done ?
What if I only wanted to use RADIUS only ?
Is there a better way to distinguish between Management and network users ??
Thanks
07-05-2010 11:29 PM
I think this is a very common way for things to be done
You may notice that out of the box ACS 5 comes preinstalled with a service selection policy that differentiates requests based on the protocol and directs either to a "Default Network Access" or "Default Device Admin" service
If you only want to do RADIUS can either disable or delete the rule for TACACS+ requests or not select TACACS+ in device definitions
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide