Feedback
Table Of Contents
Restart Services Does Not Work
Event Notification E-Mail Not Received
Remote Administrator Cannot Access Browser
Remote Administrators Cannot Log In
Remote Administrator Receives Logon Failed... Message
Remote Administrator Cannot Access ACS
Authentication and Authorization
Windows Authentication Problems
RADIUS Extension DLL Rejected User Error
Request Does Not Appear in an External Database
TACACS+ Authentication is Failing
Cannot Access the Web Interface
Browser crash when trying to open ACS
Administrator Database Corruption (Netscape)
Remote Administrator Cannot Browse
Cisco Network Admission Control (NAC)
EAP Request Has Invalid Signature
Administrator Locked Out of Client
Nonresponsive Endpoint Limit Reached
RDBMS Synchronization Not Properly Operating
Database Replication Not Properly Operating
External User Database Not Available
Unknown Users Not Authenticated
Cannot Implement the RSA Token Server
ACE SDI Server Does Not See Incoming Request
External Databases Not Properly Operating (ACS Solution Engine)
Group Mapping (ACS Solution Engine)
Configuration of Active Directory
Cannot Connect to AAA Client (No Report)
Cannot Connect to the AAA Client (Windows External Database)
Cannot Connect to AAA Client (ACS Internal Database)
Cannot Connect to AAA Client (Telnet Connection Authenticated)
Cannot Connect to AAA Client (Telnet Connection Not Authenticated)
Authentication Fails When Using PAP
Expected Device-Type is Not Matched
Device-type Attribute is Not Returned by the Audit Server
Failure Returned by the Audit Server
rad_mon.dll and tac_mon.dll In Use Condition
During Upgrade the ACS Folder is Locked
During Uninstall the ACS Folder is Locked
After Restart ACS Cannot Start Services
Upgrade or Uninstall Cannot Complete
Upgrade Command Does Not Work (ACS Solution Engine)
On Solaris, autorun.sh Does Not Execute (ACS Solution Engine)
MAC Authentication Bypass Problems
The MAC Address Exists in LDAP but Always Maps to the Default User Group
The MAC Exists in the Internal Database but is Mapped to the Wrong User Group
Remote Agent (ACS Solution Engine)
Unknown User Information Missing
Two Entries Logged for One User Session
Logged in Users Report Works Only with Certain Devices
MaxSessions Not Working Over VPDN
MaxSessions Does Not Take Effect
TACACS+ and RADIUS Attributes Missing
Common Problems
Revised: June 24, 2011, OL-12555-02This chapter describes common problems associated with the Cisco Secure Access Control Server, hereafter referred to as ACS.
This chapter contains:
•
Authentication and Authorization
•
•
•
Administration
This section contains:
•
•
•
•
•
•
•
Note
Administrator Locked Out
Condition
ACS has locked out an administrator.
Action
•
–
–
CSUtil -s a unlock <Admin> <Password>
•
unlock-guiadmin <Admin> <Password>
Tip
Unauthorized Users Logging In
Condition
Unauthorized users can log in.
Action
List start and end IP addresses for the Reject listed IP addresses option. Choose Administrator Control > Access Policy, and specify the Start IP Address and End IP Address.
Restart Services Does Not Work
Condition
The Restart Services option in the web interface does not restart the services.
Action (ACS for Windows)
The system is not responding. To manually restart services:
1.
2.
If the services do not respond when manually restarted, reboot the server.
Action (ACS Solution Engine)
The system is not responding to the restart command on the System Configuration > Service Control page. Open a console and use the show command to determine server status. If necessary, use the CLI to stop the service. See Chapter 1, "The Remote Agent CLI (Solution Engine Only)."
To manually restart services, log in to the ACS console and enter the restart command, followed by a single space and the name of the ACS service that you want to restart.
Event Notification E-Mail Not Received
Condition
The administrator is configured for event notification but is not receiving event notification e-mails.
Action
Be certain that the SMTP server name is correct. If the name is correct, be certain that the computer that runs ACS can ping the SMTP server or can send e-mail using a third-party e-mail software package.
Be certain that the e-mail address does not contain underscores (_).
Remote Administrator Cannot Access Browser
Condition
A remote administrator cannot bring up the ACS web interface in a browser, or receives a warning that access is not permitted.
Action
To recover from this condition:
1.
2.
3.
4.
5.
Remote Administrators Cannot Log In
Condition
Remote administrators cannot log in.
Action
List no start or end IP addresses for the Allow only listed IP addresses to connect option. Choose Administrator Control > Access Policy, and specify the Start IP Address and End IP Address.
Remote Administrator Receives Logon Failed... Message
Condition
When browsing, a remote administrator receives the
Logon failed . . . protocol errormessage.Action (ACS for Windows)
Restart the CSAdmin service. To restart the CSAdmin service:
1.
2.
If necessary, restart the server.
Action (ACS Solution Engine)
Restart the CSAdmin service. To restart the CSAdmin service, from the CLI enter the restart command with CSAdmin as the argument. If necessary, reboot the appliance.
Remote Administrator Cannot Access ACS
Condition
A remote administrator cannot bring up ACS from the browser, or receives a warning that access is not permitted.
Action
If Network Address Translation (NAT) is enabled on the Project Information Exchange (PIX) Firewall, administration through the firewall cannot work. To administer ACS through a firewall, you must configure an HTTP port range. Choose Administrator Control > Access Policy. You must configure the PIX Firewall to permit HTTP traffic over all ports in the range specified in ACS.
Authentication and Authorization
This section contains:
•
•
•
Windows Authentication Problems
Condition
Problems diagnosing Windows authentications.
Action
Log in to the ACS server (by using the normal interactive Login field) with the same user credentials that you want ACS to validate. If the logon does not work, then ACS cannot authenticate. This condition indicates and Active Directory (AD) configuration issue.
If the login works, but ACS does not authenticate, this condition indicates permission problems. Check Auth.log for the username, and look for errors. Review the permission requirements and be certain that ACS is running with proper privileges.
Dial-in Not Disabled
Condition
After the administrator disables the Dialin Permission setting, Windows database users can still dial in and apply the Callback string that is configured under the Windows user database. (To locate the Dialin Permission check box, choose External User Databases > Database Configuration > Windows Database > Configure.)
Action
Restart the ACS services.
Settings Not Inherited
Condition
Users moved to a new group inherit new group settings, but they keep their existing user settings. Users did not inherit settings from the new group.
Action
Manually change the settings in the User Setup section.
Retry Interval Too Short
Condition
The retry interval is too short, and authentication fails.
Action
Check the Failed Attempts report.
The retry interval may be too short. (The default is 5 seconds.) Increase the retry interval (
tacacs-server timeout 20) on the AAA client to 20 or greater.AAA Client Times Out
Condition
The AAA client times out when authenticating against a Windows user database.
Action
Increase the TACACS+ or RADIUS timeout interval from the default (5) to 20 by entering these Cisco IOS commands:
tacacs-server timeout 20
radius-server timeout 20Unknown NAS Error
Condition
Authentication fails; the error
Unknown NASappears in the Failed Attempts log.Action
To be certain that the NAS is recognized:
Step 1
Step 2
Key Mismatch Error
Condition
Authentication fails; the error
Key mismatchappears in the Failed Attempts log.Action
To be certain that the keys match:
Step 1
Step 2
Unexpected Authorizations
Condition
The user can authenticate, but authorizations do not match expectations.
Action
Different vendors use different AV pairs. One vendor protocol may ignore the AV pairs used in another protocol, for example. Be certain that the user settings reflect the correct vendor protocol; for example, RADIUS (Cisco IOS/PIX).
RADIUS Extension DLL Rejected User Error
Condition
LEAP authentication fails. The error
Radius extension DLL rejected userappears in the Failed Attempts log.Action
To verify configured authentication type:
Step 1
Step 2
Request Does Not Appear in an External Database
Condition
An authentication request does appear in an external database.
Action
To verify that the authentication request is being forwarded:
Step 1
Step 2
TACACS+ Authentication is Failing
Condition
TACACS+ authentication is failing.
Action
Examine the Failed Attempts log. If you observe unusual strings in place of the username, then check for configuration error in the TACACS+ client NAS, and correct the configuration of the device.
Browser
This section contains:
•
•
•
•
Cannot Access the Web Interface
Condition
The browser cannot display the ACS web interface.
Action
To fix the display:
Step 1
Step 2
Pages Do Not Appear Properly
Condition
Parts of pages do not appear properly, parts of the page are missing, or the page is corrupted.
Action
Perform these steps:
Step 1
Step 2
Browser crash when trying to open ACS
Condition
When opening ACS, the browser crashes.
Action
If you are using the JRE 1.5.0_00, upgrade to the current version of the JRE at the Java website.
Session Connection Lost
Condition
1.
2.
Action
Check the Session idle timeout value for remote administrators. Choose Administration Control Session Policy Setup, and increase the timeout value as needed.
Administrator Database Corruption (Netscape)
Condition
The administrator database appears to be corrupted when using Netscape.
Action
The remote Netscape client is caching the password. If you specify an incorrect password, it is still cached. When you attempt to reauthenticate with the correct password, Netscape sends the incorrect password. Clear the cache before attempting to re-authenticate, or close the browser and open a new session.
Remote Administrator Cannot Browse
Condition
Remote administrator intermittently cannot browse in the ACS web interface.
Action
Confirm that the client browser does not contain a proxy server configuration. ACS does not support the HTTP proxy for remote administrative sessions. Disable the proxy server settings.
Cisco Network Admission Control (NAC)
This section contains:
•
•
•
•
Posture Problems
Condition
The results of
show eou allorshow eou ipaddress include postures that do not match the actual result of posture validation or display a line of hyphens (-------) instead of a posture.Action
If you see a line of hyphens (-------), the AAA client is not receiving the posture-token attribute-value (AV) pair within a Cisco IOS/PIX RADIUS
cisco-av-pairvendor-specific attribute (VSA). If the posture that appears does not correspond to the actual result of posture validation, the AAA client is receiving an incorrect value in the posture-token AV pair.Check group mappings for Network Admission Control (NAC) databases to verify that the correct user groups are associated with each system posture token (SPT). In the user groups that are configured for use with NAC, be certain that the Cisco IOS/PIX
cisco-av-pairVSA is correctly configured. For example, in a group configured to authorize NAC clients receiving a healthy System Posture Token (SPT), be certain that the[009\001] cisco-av-paircheck box is checked and that the SPT string appears in the[009\001] cisco-av-pairtext box:posture-token=Healthy
Caution
Note
For more information about the Cisco IOS/PIX
cisco-av-pairVSA, see the User Guide for Cisco Secure Access Control Server.Cisco IOS Commands Not Denied
Condition
Under EXEC Commands, ACS is not denying Cisco IOS commands when checked.
Action
Examine the Cisco IOS configuration at the AAA client. If necessary, enter this Cisco IOS command into the AAA client configuration:
aaa authorization command <0-15> default group TACACS+The correct syntax for the arguments in the text box is permit argument or deny argument.
EAP Request Has Invalid Signature
Condition
ACS receives traffic from an EAP-enabled device that has the wrong shared secret, and ACS logs the error.
Action
Check for these conditions:
•
•
•
Check the EAP-enabled device and make changes, if necessary.
Administrator Locked Out of Client
Condition
An administrator has been locked out of the AAA client because of an incorrect configuration setup in the AAA client.
Action
Perform these steps:
Step 1
Step 2
Step 3
Cannot Enter Enable Mode
Condition
Unable to enter Enable Mode after performing
aaa authentication enable default tacacs+. The system returns the error message:Error in authentication on the router.Action
Check the Failed Attempts log. If the log reads
CS password invalid, it may be that the user has no enable password set up. If you do not see the Advanced TACACS+ Settings section among the user setup options:
Step 1
Step 2
Step 3
Step 4
Nonresponsive Endpoint Limit Reached
Condition
The system reaches the NAC Nonresponsive Endpoint (NRE) Guest Access Limit of 100 Endpoints.
Action
A feature in the EAPoUDP state table prevents denial of service (DoS) attacks on the ACS server by limiting RADIUS requests.
When the system reaches the maximum limit of 100 unauthorized nonresponsive endpoints per Network Access Device (NAD), a warning message appears on the router console:
*Jan 19 09:51:04.855: %AP-4-POSTURE_EXCEED_MAX_INIT: Exceeded maximum limit (100).The router stops processing RADIUS requests for NAC. This mechanism will leave legitimate users, with or without the Cisco Trust Agent, with default network access. The default access is whatever the router interface Access Control List (ACL) allows.
This message appears because 100 (or more) EAPoUDP sessions are in the INIT state. Normally, when receiving a RADIUS Accept-Accept from the ACS, the session will transition out of this state. However, the EAPoUDP session will stay in this state if the:
•
•
•
Based on this behavior, your options are:
•
•
•
•
NAC Posture Problem
In ACS Release 4.1, the SPT is no longer configured in Group Mapping for NAC Databases. The posture result automatically sends the in the
cisco-av-pair.Authorization Policy
When you configure an authorization policy and select any in the user group or the posture token, you may want to configure none. For a group, any refers to cases of posture only (no authentication). For a posture token, any refers to cases of authentication only (no posture).
Databases
This section contains:
•
•
•
•
•
•
•
•
•
RDBMS Synchronization Not Properly Operating
Condition
RDBMS synchronization is not properly operating.
Action
Be certain that the correct server appears in the Partners list.
Database Replication Not Properly Operating
Condition
Database replication is not properly operating.
Action
•
•
•
•
•
•
External User Database Not Available
Condition
The external user database is not available in the Group Mapping section.
Action
The external database has not been configured in the External User Databases section; or, the username and password have been incorrectly typed. Click the applicable external database. Be certain that the username and password are correct.
Unknown Users Not Authenticated
Condition
Unknown users are not authenticated.
Action
Note
To authenticate unknown users:
Step 1
Step 2
Step 3
Step 4
Step 5
User Problems
Condition
The same user appears in multiple groups or duplicate users exist in the ACS internal database. You cannot delete the user from the database.
Action
To clean up the database, you use CSUtil.exe from the command line:
CSUtil -q -d -n -l dump.txt
This command causes the database to be unloaded and reloaded to clear the counters.
Tip
C:\Program Files\CiscoSecure ACS vX.X\bin.For more information on using the CSUtil.exe command, see the User Guide for Cisco Secure Access Control Server.
Cannot Implement the RSA Token Server
Condition
You cannot successfully implement the RSA token server.
Action
To recover from this problem:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
ACE SDI Server Does Not See Incoming Request
Condition
On the Active Collaboration Engine (ACE) Systems Development and Integration (SDI) server, no incoming request is seen from ACS, although the RSA agent authentication works.
Action (ACS for Windows, ACS Solution Engine)
For dial-up users, be certain that you are using PAP and not MS-CHAP or CHAP. RSA SDI does not support CHAP and ACS does not send the request to the RSA server; rather, ACS will log an error for external database failure.
External Databases Not Properly Operating (ACS Solution Engine)
Condition
External databases are not properly operating.
Action
Run cssupport.exe to generate a package.cab file in order to collect logging information for the SE.
Be certain that the Remote Agent is properly installed and configured. See the Installation and Configuration Guide for Cisco Secure Remote Agents 4.1.
Be certain that a two-way trust (for dial-in check) is established between the ACS domain and the other domains. Check CSAuth.log for any debug messages beginning with [
External DB].Group Mapping (ACS Solution Engine)
Note
Condition
During configuration of group mapping, the user sees a failure message in a popup window:
Failed to enumerate Windows groups. If you are using AD consult the installation guide for informationAction
This problem may occur if:
•
•
•
•
–
–
–
–
•
•
•
•
•
Configuration of Active Directory
Note
Condition
You must configure Active Directory for ACS.
Action
On the domain controller serving the ACS server:
Step 1
Step 2
Step 3
Step 4
a.
b.
c.
d.
e.
f.
Step 5
a.
b.
c.
d.
e.
f.
g.
h.
i.
Step 6
a.
b.
c.
d.
e.
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
NTLMv2 Does Not Work
Condition
NTLMv2 does not work.
Action
You must have the appropriate version of Windows installed (or a certain service pack) and configure the domain controllers registry to request NTLMv2. For additional information, see Microsoft article #239869.
Dial-In Connections
This section contains:
•
•
•
•
•
•
Cannot Connect to AAA Client (No Report)
Condition
A dial-in user cannot connect to the AAA client.
No record of the attempt appears in the TACACS+ or RADIUS Accounting Report. From the navigation bar, choose Reports and Activity, then choose TACACS+ Accounting or RADIUS Accounting or Failed Attempts to check for the record.
Action
Examine the ACS Reports or AAA client Debug output to narrow the problem to a system error or a user error. Confirm that the:
•
•
•
•
•
•
•
•
Program Files\CiscoSecure ACS vx.x\TacConfig.txt
Program Files\CiscoSecure ACS vx.x\RadConfig.txt•
Cannot Connect to the AAA Client (Windows External Database)
Condition
A dial-in user cannot connect to the AAA client, and you configured the Windows user database for authentication.
ACS creates a record of a failed attempt in the Failed Attempts Report in the Reports and Activity section.
Action
Create a local user in the ACS internal database and test whether authentication is successful. If it is successful, the issue is user information that is not correctly configured for authentication in Windows or ACS.
From Windows User Manager or Active Directory Users and Computers, confirm that the:
•
•
•
•
•
From within ACS confirm that:
•
•
•
Then:
•
•
•
Cannot Connect to AAA Client (ACS Internal Database)
Condition
A dial-in user cannot connect to the AAA client, and the ACS internal database is being used for authentication.
A record of a failed attempt appears in the Failed Attempts Report (choose Reports and Activity, then click Failed Attempts).
Action
From within ACS confirm that the:
•
•
•
•
Cannot Connect to AAA Client (Telnet Connection Authenticated)
Condition
A dial-in user cannot connect to the AAA client; however, a Telnet connection can be authenticated across the LAN.
Action
Isolate the problem area. The possibilities are:
•
•
•
Additionally, you can verify ACS connectivity by attempting to Telnet to the access server from a workstation connected to the LAN. A successful authentication for Telnet confirms that ACS is working with the AAA client.
Cannot Connect to AAA Client (Telnet Connection Not Authenticated)
Condition
A dial-in user cannot connect to the AAA client, and a Telnet connection cannot be authenticated across the LAN.
Action
Determine whether the ACS is receiving the request by viewing the ACS reports. Based on what does not appear in the reports and which database is being used, look for:
•
•
•
Callback Not Working
Condition
Callback is not working.
Action
Be certain that callback works on the AAA client when using local authentication; then, add AAA authentication.
Authentication Fails When Using PAP
Condition
User authentication fails when using PAP.
Action
Outbound PAP is not enabled. If the Failed Attempts report shows that you are using outbound PAP:
Step 1
Step 2
Step 3
EAP Protocols
Condition
Problems with EAP protocols.
Action
The general troubleshooting strategy is the same for all EAP methods:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Note
GAME Protocol
This section contains:
•
•
•
GAME Configuration Problem
Condition
The Generic Authorization Message Exchange (GAME) configuration is incorrect.
Action
To check the configuration, choose:
•
•
•
–
–
–
GAME Troubleshooting Setup
Condition
You need to troubleshoot the GAME feature.
Action
Assign policies and groups:
Step 1
Step 2
Step 3
a.
b.
c.
Configure these logs:
•
•
Expected Device-Type is Not Matched
Condition
ACS cannot match a device-type.
Action
Check these configuration items:
•
•
•
•
Device-type as seen by ACS is also reported in the CSAuth log and the output from the debugging mode of CSAuth: DZAuth -p -z -v.
[PDE]: PdeAttributeSet::addAttribute: Unix:Audit:Device-Type=IP Phone[PDE]: AuditAction::Received device-type=IP Phone[PDE]: PdeAttributeSet::addAttribute: PDE-Audit-Req-Device-Type-34=TRUEDevice-type Attribute is Not Returned by the Audit Server
Condition
The audit server does not return a device-type attribute.
Auth.log indicates Audit Server did not Return Device Type.
[PDE]: PdeAttributeSet::addAttribute: PDE-Audit-Req-Device-Type-34=TRUE[PDE]: Device type requested but Audit Server did not return device type[PDE]: AuditAction::Invoking GAMEGroupMappingPolicyAction
Verify configuration items and logging:
•
•
...(empty) in Pass Authen Report.•
•
Failure Returned by the Audit Server
Condition
The audit server returns a failure.
AUTH.log indicates
Audit Server return zero lengthdevice type or an error parsing GAME response.[PDE]: PdeAttributeSet::addAttribute:Unix:Audit:Device-Type=[PDE]: Audit Server return zero length device type ...[PDE]: PolicyMgr::Process: last action result=-2147 Audit policy failed (-2147), attempting fail open[PDE]: Error parsing GAME response: Could not find element AttributeValue under element saml:Attribute[PDE]: PolicyMgr::Process: last action result=-2165 Audit policy failed (-2165), attempting fail openAction
Verify these configuration items:
•
•
...(empty) in the Pass Authen Report.•
•
Installations and Upgrades
This section contains:
•
•
•
•
•
•
•
System Requirements
Be certain that you have installed your release according to the requirements in the Installation Guide and Release Notes that accompany the release.
rad_mon.dll and tac_mon.dll In Use Condition
Condition
The rad_mon.dll and tac_mon.dll files remain in use after uninstall and clean.exe. The in-use condition then prevents a new installation of ACS.
Action
Restart the computer in order to clear the in-use condition, or stop any service that is using the .dll files, such as AgentSrv.exe. You can use third-party tools, such as the Process Explorer, to find the processes that are using the .dlls.
During Upgrade the ACS Folder is Locked
Condition
When upgrading ACS, setup.exe hangs and displays an error message:
The CiscoSecure ACS folder appears to be locked by another application... . Please close any applications that are using any files or directories and re-run Uninstall.Action
Remove excess log files. ACS stores log files in \CiscoSecure ACS v.x.x\Logs. If any log file folder gets too large, and you cannot upgrade, you must first delete all but the last three log files from the folder. When ACS starts up, choose System Configuration > Service Control. In the Services Log File Configuration, check Manage Directory, and choose Keep only the last <n> files. Set <n> to 3.
If PNLogAgent is running, stop that service to release any locks that it might have on the folder.
During Uninstall the ACS Folder is Locked
Condition
When uninstalling, the ACS folder is locked.
Action
Check for these conditions:
•
•
•
After Restart ACS Cannot Start Services
Condition
When the Windows Firewall Internet Connection Sharing (ICS) service has started on Windows 2003, SP1, ACS cannot start these services:
•
•
•
•
Action
Manually start the services, or disable the ICS service.
To disable the ICS service:
Step 1
Step 2
Step 3
Upgrade or Uninstall Cannot Complete
Condition
Upgrade or uninstall cannot complete.
Action
Close:
Step 1
Step 2
Step 3
Step 4
Step 5
Invalid File or Data
Condition
An error message appears when you try to upgrade or uninstall ACS: The following file is invalid or the data is corrupted "DelsL1.isu".
Action
From the Windows Registry, delete the following Registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CiscoSecureAccounting Logs Missing
Condition
All previous accounting logs are missing.
Action
When reinstalling or upgrading the ACS software, these files are deleted; unless they have been moved to an alternative directory location.
Upgrade Command Does Not Work (ACS Solution Engine)
Condition
From the serial console, the upgrade command has no effect.
Action
You must first obtain an appliance upgrade. Choose System Configuration > Appliance Upgrade.
On Solaris, autorun.sh Does Not Execute (ACS Solution Engine)
Condition
While performing an upgrade when using a Solaris distribution server, autorun.sh cannot be executed.
Action
Use the command chmod +x autorun.sh to grant execution permissions to autorun.sh.
Interoperability
This section contains:
•
Interoperation Between Builds
Condition
Interoperation between different builds of ACS does not work.
Action
Interoperation between different builds is not supported. The builds must match.
Proxy Requests Fail
Condition
Proxy requests to another server fail.
Action
Be certain that the:
•
•
•
If the previous conditions are met, one or more servers is probably down; or, no fallback server is configured. Click Network Configuration from the navigation bar and configure a fallback server. Fallback servers are used only when:
•
•
•
•
Logging
This section describes troubleshooting procedures for log files. For related information, see Reports.
Too Many Log Files
Condition
When upgrading ACS, setup.exe hangs and displays an error message:
The CiscoSecure ACS folder appears to be locked by another application ... . Please close any applications that are using any files or directories and re-run Uninstall.Action
If the problem still exists after closing applications and r-eruning the uninstall program, it could be that the folder is locked because of large number of log files.
Remove excess log files. ACS stores log files in \CiscoSecure ACS v.4.1\Logs. If a log file folder becomes too large, and you cannot upgrade, you must first delete all but a small number of files from the folder (for example, 3). When ACS starts up, choose System Configuration > Service Control. In the Services Log File Configuration, check Manage Directory, and check Keep only the last <n> files. Set <n> to a small number (for example, 3).
MAC Authentication Bypass Problems
This section contains:
•
•
The MAC Address Exists in LDAP but Always Maps to the Default User Group
Condition
MAC exists in LDAP but always maps to the default user-group.
Action
•
•
•
•
The MAC Exists in the Internal Database but is Mapped to the Wrong User Group
Condition
The MAC exists in the internal database but is mapped to the wrong user-group.
Action
Check that the MAC address or a prefix of the address does not exist in a previous mapping.
Request is Rejected
Condition
Request is rejected.
Action
•
•
•
Remote Agent (ACS Solution Engine)
This section describes troubleshooting for the Remote Agent.
RPC Timeouts
When the appliance sends requests to the Remote Agent, it will wait no more than 60 seconds for a reply.
Reports
This section contains:
•
•
•
For related information, see Logging.
Blank Reports
Condition
A report is blank.
Action
Be certain that you have selected Log to <reportname> Report under System Configuration > Logging > Log Target <reportname>. You must also set Network Configuration <servername> Access Server Type to ACS for Windows NT.
Condition
The lognameactive.csv report is blank.
Action
You changed protocol configurations recently.
Whenever protocol configurations change, the existing lognameactive.csv report file is renamed to lognameyyyy-mm-dd.csv, and a new, blank lognameactive.csv report is generated.
Unknown User Information Missing
Condition
No Unknown User information is included in reports.
Action
The Unknown User database was changed. Accounting reports will still contain unknown user information.
Two Entries Logged for One User Session
Condition
Two entries are logged for one user session.
Action
Be certain that the remote logging function is not configured to send accounting packets to the same location as the Send Accounting Information fields in the proxy distribution table.
Old Format Dates Persist
Condition
After you have changed the date format, the Logged-In User list and the CSAdmin log still display old format dates.
Action
To see the changes made, you must restart the CSAdmin services and log on again.
Logging Halted
Condition
Effect of logging unavailability on authentication functionality.
Action
When local or remote logging normal operation is halted, authentication functionality will stop after a very short time because all worker threads are busy with logging assignments. Fixing the logging functionality will restore authentication; thus, troubleshooting the logging service logs is necessary.
Logged in Users Report Works Only with Certain Devices
Condition
The Logged in Users report works with some devices, but not with others.
Action
For the Logged in Users report to work (and this also applies to most other features involving sessions), packets should include:
•
–
nas-ip-address–
nas-port•
–
nas-ip-address–
nas-port–
session-id–
framed-ip-address•
–
nas-ip-address–
nas-port–
session-id–
framed-ip-addressAlso, if a connection is so brief that there is limited time between the start and stop packets (for example, HTTP through the PIX Firewall), the
Logged inUsers report may fail.User Group Management
This section contains:
•
•
•
MaxSessions Not Working Over VPDN
Condition
MaxSessions over a Virtual Private Dialup Network (VPDN) is not working.
Action
The use of MaxSessions over VPDN is not supported.
MaxSessions Fluctuates
Condition
User MaxSessions fluctuates or is unreliable.
Action
Services were restarted, possibly because the connection between the ACS and the AAA client is unstable. Uncheck the Single Connect TACACS+ AAA Client check box.
MaxSessions Does Not Take Effect
Condition
User MaxSessions not taking effect.
Action
Be certain that you have accounting configured on the AAA client, and that you are receiving accounting start or stop records.
TACACS+ and RADIUS Attributes Missing
Condition
TACACS+ and RADIUS attributes do not appear on the Group Setup page.
Action
Be certain that you have configured at least one RADIUS or TACACS+ AAA client in the Network Configuration. Be certain that you have enabled the appropriate attributes in the Interface Configuration.
Note
