Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ACS 4.2 Appliance integration with LDAP

Hi,

I would like to ask some question from the expert here.

1. I'm building 802.1x infra for my customer.

2. We are using ACS SE version 4.2

3. We have successfully integrate the ACS with AD using Remote Agent.

4. Using will authenticate using PEAP MS-CHAP v2.

5. However, my customer dont want to use Remote Agent (RA) because the want the ACS talk to the external database directly.

6. Their argument is, if they bought other Radius appliance for this project, the appliance should have the same function in order to authenticate the user.

7. What are needed to complete this requirement?

I saw in this table http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/Overvw.html#wp857274 the LDAP does not support PEAP MS-Chap v2.

Can any expert give opinion on this issue?

4 REPLIES
Silver

Re: ACS 4.2 Appliance integration with LDAP

As you can see in the table LDAP doesn't support MS-Chap v2. There are many types of authentication; you can take a authentication types which is supported by LDAP. Here is the URL for the LDAP Integration with ACS Configuration Example it may help you

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00809a9d08.shtml#veri

New Member

Re: ACS 4.2 Appliance integration with LDAP

Hi,

I also encountering the same scenario.

My wireless clients (windows XP) are authenticating using MS-CHAPv2. Currently I am using username/password in ACS itself. We are planning to move this username/password to LDAP and remove the username database in ACS, so that ACS will contact LDAP for username authentication.

Whethter it will work out?

RBK

Silver

Re: ACS 4.2 Appliance integration with LDAP

Despite various efforts a few years back, LDAP vendors could not be persuaded to implement an MSCHAP interface - which is technically possible.

That said ACS also has its Windows External Authenticator that will do MSCHAP just fine to a Windows AD Server (via a different interface).

The old LEAP protocol was mschap inside EAP. EAP-FAST can also do mschap too.

The key is not use the LDAP authenticator in ACS. If you really must use it, you'll have to make sure you use EAP-GTC inside your PEAP/FAST tunnel

Silver

Re: ACS 4.2 Appliance integration with LDAP

The issue here is that the appliance sits outside the domain - mainly because its hardened.

If you had the s/w version of ACS, you'd install it on a member server of your AD... and it would just work.

One good reason why appliances arent great if youre using Windows for security (IMHO)

802
Views
0
Helpful
4
Replies
CreatePlease login to create content