Cisco Wireless Networks, ACS, Syslog-Senders, and AD Groups !

IanJohnston — Fri, 31 Jul 2015 19:40:23 GMT

Hi,

I've worked out how to recover the User ID, or UID, from a wireless network logon by sending syslog messages from the Cisco Access Control Server, or ACS, to a syslog-sender configured on my firewall.

For wired connections I can recover UID and AD group membership through the PAN UID Agent and Group Mapping Settings.

But I still can't figure out how to get an AD group membership/mapping for my wireless users.

Wireless users connect via a Cisco wireless controller and their logins are controlled by a Cisco Access Control Server, which uses Windows AD as an external identity store. I have tested a couple of rules and can control access by UID for users connected to the wireless network but I can not use AD User Groups; however, I can use AD User Groups for users connected by wired settings, using standard windows logins, a couple of PAN UID Agents running on VMs, and Device | User Identification | Group Mapping Settings tab | <mapping object | Server Profile & Group Include List >

I'd really appreciate any pointers on how I might get this working; thanks,

Ian

Re: Cisco Wireless Networks, ACS, Syslog-Senders, and AD Groups !

pulukas — Sat, 01 Aug 2015 10:43:47 GMT

Do you get the domain information from the ACS logs or just the user name?

topic Re: Cisco Wireless Networks, ACS, Syslog-Senders, and AD Groups ! in General Topics

Cisco Wireless Networks, ACS, Syslog-Senders, and AD Groups !

Re: Cisco Wireless Networks, ACS, Syslog-Senders, and AD Groups !