User Authentication Issues - Cisco 2509 - Router - EN User Manual

User Authentication Issues

User Authentication Issues
Condition
After the administrator removes the Check NT
Callback setting from External User Databases:
Database Configuration: Windows NT/2000:
Configuration, Windows NT/2000 database users
can still dial in and apply the Callback string
configured under the Windows NT/2000 user
database.
Callback is not working.
User authentication fails when using PAP.
Unknown users are not authenticated.
User did not inherit settings from new group.
User Guide for Cisco Secure ACS for Windows Server
A-14
Appendix A Troubleshooting Information for Cisco Secure ACS
Recovery Action
Restart Cisco Secure ACS services. For steps, see
Stopping, Starting, or Restarting Services,
page 8-2.
Ensure that callback works on the AAA client
when using local authentication. Then add AAA
authentication.
Outbound PAP is not enabled. If the Failed
Attempts report shows that you are using
outbound PAP, go to Interface Configuration and
select the Per-User Advanced TACACS+
Features check box. Then, go to User Setup:
Advanced TACACS+ Settings. Click TACACS+
Enable Control and type and confirm the
password in the TACACS+ Outbound Password
box.
Go to External User Databases: Unknown User
Policy. Click Check the following external user
databases. From the External Databases list,
select the database(s) against which to
authenticate unknown users. Click —> (right
arrow button) to add the database to the Selected
Databases list. Click Up or Down to move the
database into the desired position in the
authentication hierarchy.
If you are using the Cisco Secure ACS Unknown
User feature, external databases can authenticate
using only PAP.
Users moved to a new group inherit new group
settings but they keep their existing user settings.
Manually change the settings in User Settings.
78-14696-01, Version 3.1