# Cisco ACS 5.X and Radius using AD



## bobby4hire (Oct 31, 2011)

Hello All - I am currently useing ACS 5.2 and have no problem using Tacacs+ with AD access. 

But with Radius it seems I can only get the Local identity store to work, does anyone know if you need to do something special to get Radius to work with active directory with Cisco ACS?


----------



## epshatto (Dec 23, 2010)

Have you got UDP 1812 and 1813 opened?

TACACS+ and RADIUS run on different port numbers, it's possible the correct ports aren't available for RADIUS to use but they are for TACACS+.


----------



## bobby4hire (Oct 31, 2011)

I'm seeing RADIUS requests come in, my error message is

Failure Reason : 22056 Subject not found in the applicable identity store(s).


----------



## epshatto (Dec 23, 2010)

Hmm...is Active Directory listed in your Identity Store Sequence as the first store?


----------



## bobby4hire (Oct 31, 2011)

Well, I can't really change the order that the stores are used can I? I don't see that option.


----------



## epshatto (Dec 23, 2010)

Looking over screenshots, I don't either. I read something on Cisco's site about that error message occuring because it didn't find the user in the first store.

As I am not a Cisco guy I think I can be only limited help here.


----------



## svansia (Feb 4, 2015)

bobby4hire said:


> Hello All - I am currently useing ACS 5.2 and have no problem using Tacacs+ with AD access.
> 
> But with Radius it seems I can only get the Local identity store to work, does anyone know if you need to do something special to get Radius to work with active directory with Cisco ACS?



check this out for basic understanding of ACS configuration which will help you to troubleshoot. http://www.youtube.com/watch?v=WcYXEsrc810


----------

