Comments on: How to Import Vendor Specific Attributes into Cisco Secure ACS SE Applience http://www.linickx.com/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience Moments of Genius followed by Trash. Mon, 09 Apr 2012 16:18:09 +0000 hourly 1 http://wordpress.org/?v=3.3.2 By: Nick http://www.linickx.com/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience/comment-page-1#comment-15100 Nick Thu, 03 Mar 2011 11:02:48 +0000 http://www.linickx.com/archives/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience#comment-15100 This is quite a challenge to get your head round, but I would recommend you read mine and James examples a few times... I found importing the CSV texts into excel to help visualise it makes it clearer ... at a <b>guess</b> you need something like... Create motorola with a 350 command... <code> SequenceId,Priority,UserName,GroupName,Action,ValueName,Value1,Value2,Value3,DateTime,MessageNo,ComputerNames,AppId,Status 1,0,,,350, Motorola,AUTO_ASSIGN_SLOT,161,,,,,,0 2,0,,,355,,,,,,,,,0 </code> Note action 355, saves it to the DB....Then another to add the attributes... <code> SequenceId,Priority,UserName,GroupName,Action,ValueName,Value1,Value2,Value3,DateTime,MessageNo,ComputerNames,AppId,Status 1,0,,,352,Motorola-DVS-User-Access-Level,161,105,integer,,,,,0 2,0,,,352,Motorola-APEX1000-User-Access-Level,161,107, integer,,,,,0 3,0,,,355,,,,,,,,,0 </code> You probably need some <i>354</i> actions to associate the integer value 15 with Motorola-Administrator etc. HTH, Nick This is quite a challenge to get your head round, but I would recommend you read mine and James examples a few times… I found importing the CSV texts into excel to help visualise it makes it clearer … at a guess you need something like…

Create motorola with a 350 command…

SequenceId,Priority,UserName,GroupName,Action,ValueName,Value1,Value2,Value3,DateTime,MessageNo,ComputerNames,AppId,Status
1,0,,,350, Motorola,AUTO_ASSIGN_SLOT,161,,,,,,0
2,0,,,355,,,,,,,,,0

Note action 355, saves it to the DB….Then another to add the attributes…


SequenceId,Priority,UserName,GroupName,Action,ValueName,Value1,Value2,Value3,DateTime,MessageNo,ComputerNames,AppId,Status
1,0,,,352,Motorola-DVS-User-Access-Level,161,105,integer,,,,,0
2,0,,,352,Motorola-APEX1000-User-Access-Level,161,107, integer,,,,,0
3,0,,,355,,,,,,,,,0

You probably need some 354 actions to associate the integer value 15 with Motorola-Administrator etc.
HTH,
Nick

]]> By: anterov http://www.linickx.com/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience/comment-page-1#comment-15098 anterov Thu, 03 Mar 2011 10:33:09 +0000 http://www.linickx.com/archives/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience#comment-15098 hi. i have the same problem as you jeremy do you have knews on How to convert it to ACS? thanks hi.
i have the same problem as you jeremy

do you have knews on How to convert it to ACS?

thanks

]]> By: Jeremy Skarphol http://www.linickx.com/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience/comment-page-1#comment-11139 Jeremy Skarphol Thu, 08 Apr 2010 01:37:54 +0000 http://www.linickx.com/archives/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience#comment-11139 Below is a dictinary file from a Motorola APEX 1000 headend device. I'm new to ACS and wondering how I can format the CSV for ACS. Thanks for any help. <code> ############################################################################## # # Motorola DVS attributes. # # "$Id: dictionary.motorola,v 1.0.0.1 2009/09/03 12:15:00 sbattle Exp $" # ############################################################################## VENDOR Motorola 161 BEGIN-VENDOR Motorola ATTRIBUTE Motorola-DVS-User-Access-Level 105 integer VALUE Motorola-DVS-User-Access-Level Motorola-Administrator 15 VALUE Motorola-DVS-User-Access-Level Motorola-Operator 7 VALUE Motorola-DVS-User-Access-Level Motorola-Monitor 0 ATTRIBUTE Motorola-APEX1000-User-Access-Level 107 integer VALUE Motorola-APEX1000-User-Access-Level Motorola-Administrator 15 VALUE Motorola-APEX1000-User-Access-Level Motorola-Operator 7 VALUE Motorola-APEX1000-User-Access-Level Motorola-Monitor 0 END-VENDOR Motorola </code> Below is a dictinary file from a Motorola APEX 1000 headend device. I’m new to ACS and wondering how I can format the CSV for ACS. Thanks for any help.


##############################################################################
#
# Motorola DVS attributes.
#
# "$Id: dictionary.motorola,v 1.0.0.1 2009/09/03 12:15:00 sbattle Exp $"
#
##############################################################################

VENDOR Motorola 161

BEGIN-VENDOR Motorola

ATTRIBUTE Motorola-DVS-User-Access-Level 105 integer
VALUE Motorola-DVS-User-Access-Level Motorola-Administrator 15
VALUE Motorola-DVS-User-Access-Level Motorola-Operator 7
VALUE Motorola-DVS-User-Access-Level Motorola-Monitor 0

ATTRIBUTE Motorola-APEX1000-User-Access-Level 107 integer
VALUE Motorola-APEX1000-User-Access-Level Motorola-Administrator 15
VALUE Motorola-APEX1000-User-Access-Level Motorola-Operator 7
VALUE Motorola-APEX1000-User-Access-Level Motorola-Monitor 0

END-VENDOR Motorola

]]> By: James http://www.linickx.com/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience/comment-page-1#comment-10883 James Mon, 23 Nov 2009 05:57:16 +0000 http://www.linickx.com/archives/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience#comment-10883 Cheers Mark - Adding action 356 & 357 also resolved my problem with no need to break the file down or restart the services. Cheers Mark – Adding action 356 & 357 also resolved my problem with no need to break the file down or restart the services.

]]> By: Mark Oldham http://www.linickx.com/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience/comment-page-1#comment-10843 Mark Oldham Tue, 27 Oct 2009 13:52:12 +0000 http://www.linickx.com/archives/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience#comment-10843 you need to add actions 356 and 357 before action 355 in your accountactions.csv file. you need to add actions 356 and 357 before action 355 in your accountactions.csv file.

]]> By: Steve http://www.linickx.com/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience/comment-page-1#comment-10785 Steve Wed, 05 Aug 2009 07:33:31 +0000 http://www.linickx.com/archives/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience#comment-10785 Hi Nick, thanks for your perfekt guide. It works for me very well with ACS SE 4.2 and here are two more hints. You have to create the vendor id first as you recommended and then restart the service. After that wait for about 2 minutes after the services restarted - else the next import failed in my enviroment. Then import the new vendor attributes. You should see two info messages in the RDBMS log that the imports were successfull. After that a restart service only wouldn't help. I didn't see the new radius vendor when i tried to add a new AAA client. But after i restart the whole appliance the new vendor ist there and i can set the attributes without any problem. Best regards Steve Hi Nick,

thanks for your perfekt guide. It works for me very well with ACS SE 4.2 and here are two more hints.

You have to create the vendor id first as you recommended and then restart the service. After that wait for about 2 minutes after the services restarted – else the next import failed in my enviroment.
Then import the new vendor attributes. You should see two info messages in the RDBMS log that the imports were successfull. After that a restart service only wouldn’t help. I didn’t see the new radius vendor when i tried to add a new AAA client. But after i restart the whole appliance the new vendor ist there and i can set the attributes without any problem.

Best regards
Steve

]]> By: don http://www.linickx.com/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience/comment-page-1#comment-10679 don Fri, 13 Mar 2009 14:59:57 +0000 http://www.linickx.com/archives/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience#comment-10679 I am having the exact same problem (even to trying to use a Netscreen appliance) I do not see the NS-Admin-Priv attribute returned. . . have you made any progress? I am having the exact same problem (even to trying to use a Netscreen appliance) I do not see the NS-Admin-Priv attribute returned. . . have you made any progress?

]]> By: Nick http://www.linickx.com/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience/comment-page-1#comment-10659 Nick Fri, 20 Feb 2009 11:37:29 +0000 http://www.linickx.com/archives/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience#comment-10659 <p>Hi James, The only suggestion I have is to try breaking your .csv's into two files.</p> <p>Create the Vendor ID , then import the attributes... in your example, have one file to "create Vendor 3224, NetScreen" then import the NetScreen attributes.....</p> <p><strong>File1.csv</strong> <code> SequenceId,Priority,UserName,GroupName,Action,ValueName,Value1,Value2,Value3,DateTime,MessageNo,ComputerNames,AppId,Status 1,0,,,350,Netscreen,AUTO_ASSIGN_SLOT,3224,,,,,,0 2,0,,,355,,,,,,,,,0 </code></p> <p><strong>File2.csv</strong> <code> SequenceId,Priority,UserName,GroupName,Action,ValueName,Value1,Value2,Value3,DateTime,MessageNo,ComputerNames,AppId,Status 1,0,,,352,NS-Admin-Privilege,3224,1,integer,,,,,0 2,0,,,352,NS-Admin-Vsys-Name,3224,2,string,,,,,0 3,0,,,352,NS-User-Group,3224,3,string,,,,,0 4,0,,,352,NS-Primary-DNS-Server,3224,4,ipaddr,,,,,0 5,0,,,352,NS-Secondary-DNS-Server,3224,5,ipaddr,,,,,0 6,0,,,352,NS-Primary-WINS-Server,3224,6,ipaddr,,,,,0 7,0,,,352,NS-Secondary-WINS-Server,3224,7,ipaddr,,,,,0 8,0,,,352,NS-Version,3224,8,string,,,,,0 9,0,,,354,READ_WRITE,3224,1,2,,,,,0 10,0,,,354,VSYS_ADMIN,3224,1,3,,,,,0 11,0,,,354,READ_ONLY,3224,1,4,,,,,0 12,0,,,354,VSYS_READ_ONLY,3224,1,5,,,,,0 13,0,,,355,,,,,,,,,0 </code></p> <p>I hope that helps, Nick</p> Hi James,
The only suggestion I have is to try breaking your .csv’s into two files.

Create the Vendor ID , then import the attributes… in your example, have one file to “create Vendor 3224, NetScreen” then import the NetScreen attributes…..

File1.csv

SequenceId,Priority,UserName,GroupName,Action,ValueName,Value1,Value2,Value3,DateTime,MessageNo,ComputerNames,AppId,Status
1,0,,,350,Netscreen,AUTO_ASSIGN_SLOT,3224,,,,,,0
2,0,,,355,,,,,,,,,0

File2.csv

SequenceId,Priority,UserName,GroupName,Action,ValueName,Value1,Value2,Value3,DateTime,MessageNo,ComputerNames,AppId,Status
1,0,,,352,NS-Admin-Privilege,3224,1,integer,,,,,0
2,0,,,352,NS-Admin-Vsys-Name,3224,2,string,,,,,0
3,0,,,352,NS-User-Group,3224,3,string,,,,,0
4,0,,,352,NS-Primary-DNS-Server,3224,4,ipaddr,,,,,0
5,0,,,352,NS-Secondary-DNS-Server,3224,5,ipaddr,,,,,0
6,0,,,352,NS-Primary-WINS-Server,3224,6,ipaddr,,,,,0
7,0,,,352,NS-Secondary-WINS-Server,3224,7,ipaddr,,,,,0
8,0,,,352,NS-Version,3224,8,string,,,,,0
9,0,,,354,READ_WRITE,3224,1,2,,,,,0
10,0,,,354,VSYS_ADMIN,3224,1,3,,,,,0
11,0,,,354,READ_ONLY,3224,1,4,,,,,0
12,0,,,354,VSYS_READ_ONLY,3224,1,5,,,,,0
13,0,,,355,,,,,,,,,0

I hope that helps,
Nick

]]> By: James http://www.linickx.com/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience/comment-page-1#comment-10658 James Fri, 20 Feb 2009 07:01:59 +0000 http://www.linickx.com/archives/317/how-to-import-vendor-specific-attributes-into-cisco-secure-acs-se-applience#comment-10658 <p>Hi,</p> <p>I have been following the info you provided along with the Cisco docs but have not been successful. The VSA's import and are configurable, however the RADIUS client either does not receive them, or is refusing them.</p> <p>We are using ACS Solution Engine 4.2 and also ACS 4.2 for Windows. If I import using RDBMS on ACS for Windows the VSA's also do not work. If I use Csutil to import they work fine.</p> <p>I have included samples of my .csv's below</p> <p>Have you come across anything like this before?</p> <p>James</p> <code> SequenceId,Priority,UserName,GroupName,Action,ValueName,Value1,Value2,Value3,DateTime,MessageNo,ComputerNames,AppId,Status 1,0,,,350,APC,AUTO_ASSIGN_SLOT,318,,,,,,0 2,0,,,352,APC-Service-Type,318,1,integer,,,,,0 3,0,,,354,Admin,318,1,1,,,,,0 4,0,,,354,Device,318,1,2,,,,,0 5,0,,,354,Read Only,318,1,3,,,,,0 6,0,,,355,,,,,,,,,0 </code> <code> SequenceId,Priority,UserName,GroupName,Action,ValueName,Value1,Value2,Value3,DateTime,MessageNo,ComputerNames,AppId,Status 1,0,,,350,Netscreen,AUTO_ASSIGN_SLOT,3224,,,,,,0 2,0,,,352,NS-Admin-Privilege,3224,1,integer,,,,,0 3,0,,,352,NS-Admin-Vsys-Name,3224,2,string,,,,,0 4,0,,,352,NS-User-Group,3224,3,string,,,,,0 5,0,,,352,NS-Primary-DNS-Server,3224,4,ipaddr,,,,,0 6,0,,,352,NS-Secondary-DNS-Server,3224,5,ipaddr,,,,,0 7,0,,,352,NS-Primary-WINS-Server,3224,6,ipaddr,,,,,0 8,0,,,352,NS-Secondary-WINS-Server,3224,7,ipaddr,,,,,0 9,0,,,352,NS-Version,3224,8,string,,,,,0 10,0,,,354,READ_WRITE,3224,1,2,,,,,0 11,0,,,354,VSYS_ADMIN,3224,1,3,,,,,0 12,0,,,354,READ_ONLY,3224,1,4,,,,,0 13,0,,,354,VSYS_READ_ONLY,3224,1,5,,,,,0 14,0,,,355,,,,,,,,,0 </code> Hi,

I have been following the info you provided along with the Cisco docs but have not been successful. The VSA’s import and are configurable, however the RADIUS client either does not receive them, or is refusing them.

We are using ACS Solution Engine 4.2 and also ACS 4.2 for Windows. If I import using RDBMS on ACS for Windows the VSA’s also do not work. If I use Csutil to import they work fine.

I have included samples of my .csv’s below

Have you come across anything like this before?

James


SequenceId,Priority,UserName,GroupName,Action,ValueName,Value1,Value2,Value3,DateTime,MessageNo,ComputerNames,AppId,Status
1,0,,,350,APC,AUTO_ASSIGN_SLOT,318,,,,,,0
2,0,,,352,APC-Service-Type,318,1,integer,,,,,0
3,0,,,354,Admin,318,1,1,,,,,0
4,0,,,354,Device,318,1,2,,,,,0
5,0,,,354,Read Only,318,1,3,,,,,0
6,0,,,355,,,,,,,,,0


SequenceId,Priority,UserName,GroupName,Action,ValueName,Value1,Value2,Value3,DateTime,MessageNo,ComputerNames,AppId,Status
1,0,,,350,Netscreen,AUTO_ASSIGN_SLOT,3224,,,,,,0
2,0,,,352,NS-Admin-Privilege,3224,1,integer,,,,,0
3,0,,,352,NS-Admin-Vsys-Name,3224,2,string,,,,,0
4,0,,,352,NS-User-Group,3224,3,string,,,,,0
5,0,,,352,NS-Primary-DNS-Server,3224,4,ipaddr,,,,,0
6,0,,,352,NS-Secondary-DNS-Server,3224,5,ipaddr,,,,,0
7,0,,,352,NS-Primary-WINS-Server,3224,6,ipaddr,,,,,0
8,0,,,352,NS-Secondary-WINS-Server,3224,7,ipaddr,,,,,0
9,0,,,352,NS-Version,3224,8,string,,,,,0
10,0,,,354,READ_WRITE,3224,1,2,,,,,0
11,0,,,354,VSYS_ADMIN,3224,1,3,,,,,0
12,0,,,354,READ_ONLY,3224,1,4,,,,,0
13,0,,,354,VSYS_READ_ONLY,3224,1,5,,,,,0
14,0,,,355,,,,,,,,,0

]]>