CiscoSecure ACS & CiscoWorks2000 login

[aspry]

I have configured CW2000 to use tacacs+ as the login module with CW2000 local login as the fallback.

Since configuring the above I have noticed that I have been getting 2 or 3 daily failed authentication reports for the admin profile in CiscoSecureACS, stating that the CS password was invalid.

The admin password in CW2000 was changed from the default in the modify profile section.

I should be grateful for any help on this problem.

[6tschraml]

The question is:

Do you also have 2 or 3 daily failed login attempts at the login prompt of CISCO Works? Or do these messages

appear without any problems using the admin account of CISCO Works?

Bye. Thomas.

[aspry]

Thomas,

Each user of ciscoworks has a their own username and password.

The failed login attempts shown in Cisco ACS are always at 2:00am and 1:00pm everyday.

Hope this is of help.

Thanks Andy

[6tschraml]

This is what I would do:

- Check if ACS had problems during that time.

- Are other logins possible during that time? Maybe during telnet to a router?

- Has ACS detected problems during that time at itself using it's

automatic login procedure?

- Increase the automatic login time period of ACS to up to 15 minutes or so.

- Disable automatic replication and automatic backup on ACS to be sure that your ACS is not busy due to it's own maintenance routines

- Reboot Cisco Works AND ACS (sounds stupid but can save time)

- What about a local CW account that is not stored on ACS. Is it possible to login at CW using this local account?

- If all this does not help then I would use a sniffer (installed on the ACS server) like ethereal to find out what's going over the line during the interesting time period.

By the way ... if user authentication fails: Is it possible to login after you retype your password or is access to the system blocked until 2pm? Do you see a "failed login" entry in ACS for every failed login attempt?

And what about a configured access restriction an ACS? Are there

users or groups that are allowed to login only from 2pm to 1am ?

Maybe your CW users are members of such a group and you have assigned them to this group without knowing that this group is *restricted* ?

Bye. Thomas

[pvanvuuren]

Why do you have an "admin" user account in ACS in the first place? I suggest you remove it. It has no purpose.

Use the Ciscoworks admin local account only for fallback and other admin purposes.

[aspry]

I was unaware that you could delete the "admin" user account.

I have set myself as a user with all systems and adminster priviliges, but that does not allow me to modify or delete the "admin" user.

Can you please help regarding the deletion of the "admin" user.

Thanks

Andy