We are using cisco ACS 4.2.1 on windows 2003 to authenticate with windows 2003 Actice Directory. We have update Active directory server windows 2008 version. We have checked the configuration of ACS on windows database and no problem but we can't see in ACS dynamic user. I have authentication problem ACS 4.2.1 to Windows 2008 R2 active directory.
Can someone help to answer this question? I have one customer who also asked me about this. One thing I found is ACS 5.3 can support AD on Windows 2008 R2 but my customer don't want to pay for upgrade.
This is a very common question "ACS 4.x supports authentication with 2008 R2", unfortunately the answer is no. The only ACS server that supports authentication against this specific DB is ACS 18.104.22.168 and later, not even ACS 22.214.171.124 supports this.
However there are workarounds, for example you can use LDAP, or you can use Radius proxy. Using LDAP should work unless you are using PEAP as this protocol doesn't support LDAP as the DB.
Radius proxy means that the authentication request will reach the ACS 4.x and this server will send the request to MS IAS or NPS for the authentication, the problem here is that you will need to use two Radius servers.
There is a section in the ACS 4.x where you can define if the ACS should show the dynamic users or not, make sure that this option is unchecked, for this go to External User Databases/Unknown User Policy/Configure Caching Unknown Users
Also if you are facing authentication issues with ACS 4.x and Windows 2008 R2, you may want ready my previous answer.
DocumentationCode download linksGoalRequirementLimitationsSupported ISR
and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationConfigure one of the connectivity
options to access the Cisco IMC from the n...
Firepower Threat Defense (NGFWv) on UCS E-series - Transparent Mode in
HA DocumentationCode download linksGoalRequirementLimitationsSupported
ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationCo...
Question I am currently unable to specify "crypto keyring" command when
configuring VPN connection on my cisco 2901 router. The following
licenses have been activated on my router :