Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Can't create VSA Attributes in ACS 5.1

I have upgraded to ACS 5.1 inorder to use the RADIUS VSA feature that was added. I'm able to create the VSA Vendor object but get an error when creating the actual attributes. Therror states: This System Failure occured: {0}. Your changes have not been saved. Click OK to return to the list page. Does anyone else get this error?

Everyone's tags (5)
2 ACCEPTED SOLUTIONS

Accepted Solutions
Cisco Employee

Re: Can't create VSA Attributes in ACS 5.1

I went through an upgrade process on my system and am able to recreate your problem.

Problem occurs if you have the "Include attribute in log" check box selected.

As a work around can continue without the checkbox selected and should be able to add the attribute.

Impact of not selecting this is that the attribute will not appear in monitoring and troubleshooting logs but will not impact what is sent in RADIUS reponses.

I will sync up with the development team to see what can be done to resolve this

Cisco Employee

Re: Can't create VSA Attributes in ACS 5.1

The fix for this will be in patch 3 for ACS 5.1 scheduled to be available at the end of March

In addition there is a "pointed patch" that is available if you go through the support channels. Pointed patch is a temporary patch purely to fix this specific issue until such time when the formal patch is available and the pointed patch can be removed.

14 REPLIES
Cisco Employee

Re: Can't create VSA Attributes in ACS 5.1

I can take a look at this. Can you please add some specifics of

name and ID of vendor you are trying to add, some

of the attributes and the browser you are using

New Member

Re: Can't create VSA Attributes in ACS 5.1

Thank you. I'm running IE 8.0.7100.0 on Windows 7 and also got the error on Windows 2003 Server running IE 6.0.3790.3959. The VSA's I'm trying to create are for Aruba Wireless Networks with Vendor ID: 14823. Details below on the attributes I can't create:

  • Aruba-User-Role
    • ID: 1
    • Type: String
    • Direction: Out
    • Multiples: False
  • Aruba-Admin-Role
    • ID: 4
    • Type: String
    • Direction: Out
    • Multiples: False

Here's the error message...

Thank you for your assistance

Cisco Employee

Re: Can't create VSA Attributes in ACS 5.1

ACS 5.1 does not support Internet Explorer 8; only 6 and 7 as well as Firefox 3.

I successfully created VSA for the vendor/attribue you gave on IE6 and Firefiox 3.

Can you try with a different browser

New Member

Re: Can't create VSA Attributes in ACS 5.1

I tried with IE 6 earlier and just tried with FireFox 3: unfortunately, same error msg. Seems like it may be specific to my installation. Is your instance an upgrade from 5.0 or a new 5.1 installation? BTW... thanks for the assistance.

Cisco Employee

Re: Can't create VSA Attributes in ACS 5.1

Mine is a clean installation. Version is 5.1.0.44 (

Internal Build ID : B.2347)

Although I can't recreate, I do have a couple more suggestions to try:

- Enter a Vendor name as a single word (no spaces or other characters)

- There are two ways to navigate to the attributes page

1) System Administration > ... > Configuration > Dictionaries > Protocols > RADIUS > RADIUS VSA and then select "Show Vendor Attributes"

2) Clicking on name of vendor in left nav and then pressing "Create"

Suggest to try both ways of adding an attribute

New Member

Re: Can't create VSA Attributes in ACS 5.1

I have the same version but mine was an upgrade. I tried using just Aruba as the vendor  name and it is a no go. I have been all over looking for the "Show Vendor Attributes" selection but can't find it. The only way I have to create the attributes is to left click on the Vendor I created (on left pane) and then click Create on the bottom of the right pane. I'm I missing something?

******************************************************************

Cisco Application Deployment Engine OS Release: 1.2
ADE-OS Build Version: 1.2.0.146
ADE-OS System Architecture: i386

Cisco ACS VERSION INFORMATION
-----------------------------
Version : 5.1.0.44
Internal Build ID : B.2347

******************************************************************

Cisco Employee

Re: Can't create VSA Attributes in ACS 5.1

You can get to "Show Vendor Attributes" as follows:

Go to 'System Administration > ... > Configuration > Dictionaries > Protocols > RADIUS > RADIUS VSA'

select the vendor you wish and the "Show Vendor Attributes" button

Based on what you have said so far I don't think this will help so maybe more for completeness

You can get more details on the system error by issuing the following command at the CLI:

show acs-logs filename ACSManagement.log | last 80

Cisco Employee

Re: Can't create VSA Attributes in ACS 5.1

I went through an upgrade process on my system and am able to recreate your problem.

Problem occurs if you have the "Include attribute in log" check box selected.

As a work around can continue without the checkbox selected and should be able to add the attribute.

Impact of not selecting this is that the attribute will not appear in monitoring and troubleshooting logs but will not impact what is sent in RADIUS reponses.

I will sync up with the development team to see what can be done to resolve this

New Member

Re: Can't create VSA Attributes in ACS 5.1

I guess that is both bad and good news. Thank you for all the assistance in getting this problem addressed. I was able to generate the attributes as you suggested. As an FYI... I mis-typed one of the attributes and I'm not able to edit or delete the attribute. I was able to create a new attribute with the correct name but can't get rid of the incorrect entries. Please let me know when you get a response from the development team.

Thank for everything. This support experience as been more benefitial then I expected it to be. Great job to you and Cisco!

Cisco Employee

Re: Can't create VSA Attributes in ACS 5.1

Fix for this is targetted for 2nd patch for ACS 5.1. Traget date is around end of January

New Member

Re: Can't create VSA Attributes in ACS 5.1

I dont see this patch and the problem is even worse. I put in an attribute for a VSA and accidentally selected string i

nstead of integer. I've tried changing it, deleting, with/without logging, etc. and no luck. I nee

d this fixed ASAP. Log output attached.

Cisco Employee

Re: Can't create VSA Attributes in ACS 5.1

The fix for this will be in patch 3 for ACS 5.1 scheduled to be available at the end of March

In addition there is a "pointed patch" that is available if you go through the support channels. Pointed patch is a temporary patch purely to fix this specific issue until such time when the formal patch is available and the pointed patch can be removed.

New Member

Re: Can't create VSA Attributes in ACS 5.1

Point patch was retrieved from TAC and installed. VSA attributes can now be modified and deleted. Thank you very much jrabinow!

Cisco Employee

Re: Can't create VSA Attributes in ACS 5.1

Fix for this issue is ready and available on CCO and included in patch 5.1.0.44.3

The patch is included in all cumulative patches from version 5.1.0.44.3 and later.

We recommend that you download the latest cumulative patch.

Download from: CCO / Support / Download Software http://www.cisco.com/public/sw-center/index.shtml

Select: Security / Identity Management / Cisco Secure Access Control System / Cisco Secure Access Control System 5.1 / 5.1.0.44

Patch filename: 5-1-0-44-.tar.gpg

Readme and installaion instructions: Acs-5-1-0-44--Readme.html

2708
Views
0
Helpful
14
Replies