For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Cory_50405's avatar
Cory_50405
Icon for Noctilucent rankNoctilucent
May 01, 2014

Is the name of your ACS group "adm"? It has to match verbatim what your remote role group name is.

 

  • judascow_106704's avatar
    judascow_106704
    Icon for Nimbostratus rankNimbostratus
    May 01, 2014
    Indeed it is. "cloned an existing ACS group... and renamed it 'adm'"
  • Cory_50405's avatar
    Cory_50405
    Icon for Noctilucent rankNoctilucent
    May 01, 2014
    Apologies for my reading comprehension fail. Did you remove any local usernames that may be conflicting with the remote user attempting to login?
  • judascow_106704's avatar
    judascow_106704
    Icon for Nimbostratus rankNimbostratus
    May 01, 2014
    Just confirmed that there is no local user with the same username.
  • Cory_50405's avatar
    Cory_50405
    Icon for Noctilucent rankNoctilucent
    May 01, 2014
    Your remote role configuration looks good. Do you see any helpful information in/var/log/audit or/var/log/secure that identifies a problem?
  • judascow_106704's avatar
    judascow_106704
    Icon for Nimbostratus rankNimbostratus
    May 02, 2014
    Success! I was editing the wrong custom attribute and enabling PPP in the wrong section of the TACACS group configuration. I had to add the PPP IP section to the Group config. In ACS 4.2, open Interface Configuration -> TACACS+ (Cisco IOS). Under Group, check the box for PPP IP, then Submit. In Group Config for 'adm' under TACACS+ Settings, check PPP IP and add the following in the first TACACS+ Settings Custom Attributes box: F5-LTM-User-Info-1=adm On the F5, my remoterole is remoterole { role info adm { attribute F5-LTM-User-Info-1=adm console enable line order 1 deny disable role administrator user partition all } } Thanks for all of your help, Cory!
  • Cory_50405's avatar
    Cory_50405
    Icon for Noctilucent rankNoctilucent
    May 05, 2014
    Glad to hear you got it working.
  • Dan_22262's avatar
    Dan_22262
    Icon for Nimbostratus rankNimbostratus
    Dec 12, 2014
    @Cory @judascow Great post guys. Using this, I got LTM BIGIP-11.6.0.0.0.401.ALL-scsi.ova + Cisco Secure ACS 4.2 up and running on basically the first shot. I made the same mistake above, I didn't originally put the custom attribute under PPP but under "shell". If anyone needs screenshots of the setup on both LTM and on ACS, I took them. Feel free to hit me up.
  • h_paredes_19017's avatar
    h_paredes_19017
    Icon for Nimbostratus rankNimbostratus
    Mar 02, 2015
    Dan, can you please share those screenshots?
  • gcave_213109's avatar
    gcave_213109
    Icon for Nimbostratus rankNimbostratus
    Sep 18, 2015
    Would it be possible for someone to share the screenshots with 4.1. I have setup: auth remote-role { role-info { /Common/adm { attribute F5-LTM-User-Info-1=adm console tmsh line-order 1 role administrator user-partition All } } } auth remote-user { default-role admin remote-console-access tmsh } auth source { type tacacs } auth tacacs /Common/system-auth { protocol ip secret $M$HO$rkzM7osX510D2HjVYcvnZw== servers { 165.249.239.32 } service ppp } I am getting a 'authorization failure, service ppp denied' on ACS 4.1