EasyManua.ls Logo

Cisco 3.3 User Manual

Cisco 3.3
860 pages
To Next Page IconTo Next Page
To Next Page IconTo Next Page
Page #1 background imageLoading...
Page #1 background image
Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: 408 526-4000
800 553-NETS (6387)
Fax: 408 526-4100
User Guide for Cisco Secure ACS for
Windows Server
Version 3.3
May 2004
Customer Order Number: DOC-7816592=
Text Part Number: 78-16592-01

Table of Contents

Questions and Answers:

Cisco 3.3 Specifications

General IconGeneral
BrandCisco
Model3.3
CategorySoftware
LanguageEnglish

Summary

Overview

The Cisco Secure ACS Paradigm

An overview of Cisco Secure ACS and its features, network diagrams, and system requirements.

Cisco Secure ACS Specifications

Details on hardware, operating system, and network requirements for Cisco Secure ACS.

AAA Server Functions and Concepts

Explains AAA server functions, concepts, protocols like TACACS+ and RADIUS, authentication, authorization, accounting, administration, and posture validation.

Cisco Secure ACS HTML Interface

Discusses the Cisco Secure ACS HTML interface, its layout, URLs, and administrative sessions.

Deployment Considerations

Basic Deployment Requirements for Cisco Secure ACS

Details the minimum hardware, operating system, third-party software, and network/port requirements for deploying Cisco Secure ACS.

Basic Deployment Factors for Cisco Secure ACS

Discusses key factors like network topology, remote access policy, security, administrative access, database, and network latency.

Suggested Deployment Sequence

Provides a recommended sequence of tasks for deploying Cisco Secure ACS, covering administrators, interface, system, network, and user databases.

Interface Configuration

Interface Design Concepts

Explains basic precepts of system operation and effective interface configuration, including user-to-group relationships and per-user/per-group features.

User Data Configuration Options

Details how to add or edit fields for recording user information and defining new user data fields.

Advanced Options

Allows configuration of which advanced features Cisco Secure ACS displays, simplifying the interface by hiding unused features.

Protocol Configuration Options for TACACS+

Details the configuration of the Cisco Secure ACS HTML interface for TACACS+ settings, enabling display or hiding of options.

Protocol Configuration Options for RADIUS

Explains how to customize displayed attributes for RADIUS and provides details on IETF, Cisco IOS/PIX, and other vendor-specific settings.

Network Configuration

About Network Configuration

Describes the appearance of the Network Configuration page and the tables that may appear, such as AAA Clients, AAA Servers, and Network Device Groups.

About Distributed Systems

Explains how Cisco Secure ACS can be used in a distributed system with multiple ACSes communicating with each other.

Proxy in Distributed Systems

Details the proxy feature, enabling Cisco Secure ACS for authentication in networks with multiple AAA servers and character string matching.

Fallback on Failed Connection

Explains how to configure the order in which Cisco Secure ACS checks remote AAA servers when a connection fails.

Network Device Searches

Describes how to search for any network device configured in the Network Configuration section.

AAA Client Configuration

Provides procedures for configuring AAA clients, including options for hostname, IP address, key, network device group, and authentication method.

AAA Server Configuration

Details procedures for configuring AAA servers, including name, IP address, key, network device group, log options, and server type.

Network Device Group Configuration

Explains the advanced feature of grouping network devices as a single logical unit for easier administration.

Proxy Distribution Table Configuration

Describes the Proxy Distribution Table and procedures for working with it, including adding, sorting, editing, and deleting entries.

Shared Profile Components

About Shared Profile Components

Explains the Shared Profile Components section for developing reusable authorization components like NAFs, ACLs, NARs, and command sets.

Network Access Filters

Describes Network Access Filters (NAFs) and provides instructions for creating and managing them.

Downloadable IP ACLs

Describes downloadable ACLs and provides instructions for configuring and managing them, allowing creation of ACL definitions for many users or groups.

Network Access Restrictions

Describes network access restrictions (NARs) and provides instructions for configuring and managing shared NARs.

Command Authorization Sets

Describes command authorization sets and pattern matching, providing detailed instructions for configuring and managing them.

User Group Management

About User Group Setup Features and Functions

Explains the Group Setup section as a centralized location for user group configuration and administration.

Basic User Group Settings

Presents basic activities for configuring a new user group, including group disablement, VoIP support, time-of-day access, callback options, and restrictions.

Configuration-specific User Group Settings

Details configuration procedures applicable to specific network security setups, such as token card settings, privilege options, and password aging.

Group Setting Management

Describes how to use the Group Setup section to perform various managerial tasks like listing users, resetting quotas, renaming, and saving settings.

User Management

About User Setup Features and Functions

Describes the User Setup section as a centralized location for user account configuration and administration.

About User Databases

Details the various databases used for user authentication, including CiscoSecure and external databases like Windows, LDAP, Novell NDS, ODBC, and Token Servers.

Basic User Setup Options

Presents basic activities for configuring a new user, including specifying name, external database/password, and submitting information.

Advanced User Authentication Settings

Covers user-level TACACS+ and RADIUS enable parameters, including privilege options, enable password options, and outbound passwords.

User Management

Describes how to use the User Setup section to perform user account managerial tasks like listing, finding, disabling, and deleting users.

System Configuration: Basic

Service Control

Provides basic status information about services and enables stopping, starting, or restarting them.

Logging

Explains how to configure Cisco Secure ACS to generate logs for administrative and accounting events.

Date Format Control

Allows selection between two date formats (month/day/year or day/month/year) for logs, reports, and the administrative interface.

Local Password Management

Configures settings for managing passwords stored in the CiscoSecure user database, including validation and remote change options.

Cisco Secure ACS Backup

Provides information about the Cisco Secure ACS Backup feature, including manual and scheduled backups, options, and file locations.

Cisco Secure ACS System Restore

Details the Cisco Secure ACS System Restore feature, including procedures for restoring from backup files.

Cisco Secure ACS Active Service Management

Describes ACS Active Service Management, a service monitoring tool with features for system monitoring and event logging.

System Configuration: Advanced

CiscoSecure Database Replication

Covers CiscoSecure Database Replication, including process, frequency, implementation, configuration of secondary ACS, replication options, and event errors.

RDBMS Synchronization

Provides information on implementing RDBMS Synchronization, including components, considerations, CSV-based sync, data source name, and options.

IP Pools Server

Explains the IP Pools feature, including creating, maintaining, allowing overlapping pools, refreshing tables, and recovering addresses.

IP Pools Address Recovery

Details the IP Pools Address Recovery feature, enabling recovery of assigned IP addresses not used for a specified period.

System Configuration: Authentication and Certificates

About Certification and EAP Protocols

Addresses authentication and certification features, discussing digital certificates, EAP-TLS, PEAP, and machine authentication.

Global Authentication Setup

Provides a means to enable or disable authentication protocols and configure options for PEAP, EAP-TLS, and EAP-FAST.

Cisco Secure ACS Certificate Setup

Covers installing server certificates, adding CA certificates, editing the trust list, managing CRLs, and generating CSRs.

Logs and Reports

Logging Formats

Describes the two formats for logging data: CSV files and ODBC-compliant database tables.

Special Logging Attributes

Explains special logging attributes like User Attributes, ExtDB Info, Access Device, Network Device Group, Filter Information, Device Command Set, and Remote Logging Result.

NAC Attributes in Logs

Discusses posture validation attributes used by NAC that can be logged, including Application-Posture-Token and System-Posture-Token.

Update Packets in Accounting Logs

Explains how to configure Cisco Secure ACS to record update packets (watchdog packets) in accounting logs.

About Cisco Secure ACS Logs and Reports

Divides logs into four types: Accounting logs, Dynamic Admin reports, System logs, and Service logs.

Working with CSV Logs

Provides instructions on configuring CSV logs, including file names, locations, enabling/disabling, viewing reports, and log content.

Working with ODBC Logs

Details how to prepare for ODBC logging, configure system data source names, and configure individual ODBC logs.

Remote Logging

Discusses remote logging capabilities, including implementing centralized logging, options, and enabling/disabling remote logging.

Service Logs

Explains service logs as diagnostic tools for troubleshooting and debugging, containing records of all service actions and activities.

Administrators and Administrative Policy

Administrator Accounts

Provides details about Cisco Secure ACS administrators, including accounts, privileges, adding, editing, unlocking, and deleting accounts.

Access Policy

Affects access to the Cisco Secure ACS HTML interface, allowing limits by IP address, TCP port range, and SSL enablement.

Session Policy

Controls administrative sessions, including idle timeout, automatic local login, response to invalid IP, and administrator lockout.

Audit Policy

Controls the generation of the Administrative Audit log.

User Databases

CiscoSecure User Database

Describes the internal Cisco Secure ACS database, supporting various authentication methods and crucial for the authorization process.

About External User Databases

Explains how to configure Cisco Secure ACS to forward authentication to external databases, leveraging existing user data.

Windows User Database

Details support for Windows external user databases, including user authentication, machine authentication, group mapping, and password aging.

Generic LDAP

Covers support for generic LDAP authentication, including instances, organizational units, groups, domain filtering, and failover.

Novell NDS Database

Explains support for Novell NetWare Directory Services (NDS) servers for user authentication and group mapping.

ODBC Database

Details support for ODBC-compliant relational databases, including authentication, group specification, and stored procedures.

LEAP Proxy RADIUS Server Database

Describes support for LEAP Proxy RADIUS server authentication, including group specification and mapping.

Token Server User Databases

Explains support for token servers for one-time password (OTP) authentication, including RADIUS-enabled and RSA SecurID servers.

Network Admission Control

About Network Admission Control

Explains NAC, its components, posture validation process, posture tokens, and non-responsive NAC-client computers.

NAC AAA Components

Defines the components of the NAC AAA paradigm: NAC-client computer, AAA client, Cisco Secure ACS, NAC server, and Remediation server.

Posture Validation

Describes how Cisco Secure ACS determines computer posture using credentials, steps involved, and how it derives application posture tokens.

Posture Tokens

Explains posture tokens representing computer state, including system and application posture tokens, and predefined non-configurable tokens.

Non-Responsive NAC-Client Computers

Details how NAC-compliant AAA clients handle computers that do not respond to posture validation sessions.

Implementing Network Admission Control

Provides steps for implementing NAC support in Cisco Secure ACS, including server certificates, external policies, and logs.

NAC Databases

Covers NAC databases, including their purpose, components, configuration options, and policy selection.

NAC Policies

Explains how Cisco Secure ACS applies policies to validation requests based on selected NAC database policies.

Unknown User Policy

Known, Unknown, and Discovered Users

Defines user types for authentication/posture validation: Known Users, Unknown Users, and Discovered Users.

Authentication and Unknown Users

Provides information about using the Unknown User Policy with authentication and NAC.

About Unknown User Authentication

Explains the Unknown User Policy as a form of authentication forwarding to external databases.

General Authentication of Unknown Users

Describes how Cisco Secure ACS attempts to authenticate unknown users by checking internal and external databases.

Windows Authentication of Unknown Users

Details how Cisco Secure ACS handles authentication for users with identical usernames across trusted Windows domains.

Posture Validation and the Unknown User Policy

Explains how the Unknown User Policy automates user association with NAC databases for posture validation requests.

Authorization of Unknown Users

Discusses how Cisco Secure ACS is responsible for all authorizations sent to AAA clients and end-user clients.

Unknown User Policy Options

Specifies what Cisco Secure ACS does for posture validation and unknown user authentication.

Database Search Order

Explains how to configure the order Cisco Secure ACS checks selected databases for posture validation and unknown authentication.

Configuring the Unknown User Policy

Provides steps to configure the Unknown User Policy for processing unknown users and external databases.

User Group Mapping and Specification

About User Group Mapping and Specification

Provides information about group mapping and specification for assigning users to Cisco Secure ACS groups.

Group Mapping by External User Database

Explains how to map an external database to a Cisco Secure ACS group for automatic authorization inheritance.

Group Mapping by Group Set Membership

Describes creating group mappings based on combinations of external user database groups.

NAC Group Mapping

Provides means to connect a system posture token (SPT) to a user group for NAC authorization.

RADIUS-Based Group Specification

Supports assignment of users to Cisco Secure ACS groups based on RADIUS authentication responses, overriding group mapping.

APPENDIX A Troubleshooting

Administration Issues

Lists common conditions related to remote administrator access to the HTML interface and their recovery actions.

Browser Issues

Details common browser issues that affect the Cisco Secure ACS HTML interface, such as Java messages and proxy configurations.

Cisco IOS Issues

Addresses issues related to Cisco IOS commands, RADIUS attributes not supported, and enable mode errors.

Database Issues

Covers problems with RDBMS Synchronization, Database Replication, and external user databases not being available.

Dial-in Connection Issues

Addresses issues preventing dial-in users from connecting to AAA clients, including configuration and database problems.

Debug Issues

Explains recovery actions for failure messages when running debug aaa authentication on AAA clients.

Proxy Issues

Covers recovery actions when proxying requests to another server fails, including shared secret and character string matching.

Installation and Upgrade Issues

Addresses issues that may occur during Cisco Secure ACS installation or upgrade, such as invalid or corrupted files.

MaxSessions Issues

Covers problems with MaxSessions over VPN or unreliable user MaxSessions values and provides recovery actions.

Report Issues

Addresses issues with reports being blank, missing unknown user information, or duplicate entries for user sessions.

Third-Party Server Issues

Covers issues with implementing RSA token servers and authentication requests not hitting external databases.

User Authentication Issues

Addresses problems with user authentication, including failure messages, incorrect configurations, and timeout issues.

TACACS+ and RADIUS Attribute Issues

Covers issues where TACACS+ and RADIUS attributes do not appear on the Group Setup page.

TACACS+ Attribute-Value Pairs

Cisco IOS AV Pair Dictionary

Lists supported Cisco IOS RADIUS AV pairs and provides information on requirements and considerations.

TACACS+ AV Pairs

Lists TACACS+ AV pairs supported by Cisco Secure ACS and refers to Cisco IOS documentation for descriptions.

TACACS+ Accounting AV Pairs

Lists TACACS+ accounting AV pairs supported by Cisco Secure ACS, referring to Cisco IOS documentation for descriptions.

RADIUS Attributes

Cisco IOS Dictionary of RADIUS AV Pairs

Lists Cisco IOS RADIUS AV pairs supported by Cisco Secure ACS, confirming AAA client compatibility.

Cisco IOS/PIX Dictionary of RADIUS VSAs

Lists supported Cisco IOS/PIX vendor-specific attributes (VSAs) for Cisco Secure ACS.

About the cisco-av-pair RADUIS Attribute

Explains the cisco-av-pair attribute format for Cisco IOS/PIX RADIUS implementation, supporting inclusion of many AV pairs.

Cisco VPN 3000 Concentrator Dictionary of RADIUS VSAs

Lists supported Cisco VPN 3000 RADIUS VSAs and provides control for Microsoft MPPE settings.

Cisco VPN 5000 Concentrator Dictionary of RADIUS VSAs

Lists supported Cisco VPN 5000 RADIUS VSAs and provides control for Microsoft MPPE settings.

IETF Dictionary of RADIUS AV Pairs

Lists supported RADIUS (IETF) attributes and details their formats.

Microsoft MPPE Dictionary of RADIUS VSAs

Supports Microsoft RADIUS VSAs used for Microsoft Point-to-Point Encryption (MPPE).

Ascend Dictionary of RADIUS AV Pairs

Lists Ascend RADIUS AV pairs, providing translations for parsing requests and generating responses.

Juniper Dictionary of RADIUS VSAs

Lists Juniper RADIUS VSAs supported by Cisco Secure ACS.

Nortel Dictionary of RADIUS VSAs

Lists Nortel RADIUS VSAs supported by Cisco Secure ACS.

CSUtil Database Utility

Location of CSUtil.exe and Related Files

Details the default installation directory for CSUtil.exe and related files.

CSUtil.exe Syntax

Provides the command-line syntax for the CSUtil.exe utility.

CSUtil.exe Options

Details various actions CSUtil.exe can perform, listed alphabetically.

Displaying Command-Line Syntax

Explains how to display command-line syntax for CSUtil.exe.

Backing Up Cisco Secure ACS with CSUtil.exe

Describes using the -b option to create a system backup of all Cisco Secure ACS internal data.

Restoring Cisco Secure ACS with CSUtil.exe

Details using the -r option to restore Cisco Secure ACS internal data from a backup file.

Creating a CiscoSecure User Database

Explains how to use the -n option to create a CiscoSecure user database.

Creating a Cisco Secure ACS Database Dump File

Describes using the -d option to dump all Cisco Secure ACS internal data into a text file.

Loading the Cisco Secure ACS Database from a Dump File

Details using the -l option to overwrite Cisco Secure ACS internal data from a dump text file.

Compacting the CiscoSecure User Database

Explains how to periodically compact the CiscoSecure user database to reduce its size.

User and AAA Client Import Option

Details the -i option to update Cisco Secure ACS with data from a colon-delimited text file for users and AAA clients.

RDBMS Synchronization Import Definitions

accountActions Specification

Details the accountActions specification for RDBMS Synchronization, outlining requirements and action codes.

Action Codes

Provides action codes for initializing, modifying, creating, and deleting users, groups, and network configurations.

Internal Architecture

Windows Services

Describes the modular service modules of Cisco Secure ACS, including CSAdmin, CSAuth, CSDBSync, CSLog, CSMon, CSTacacs, and CSRadius.

Windows Registry

Indicates the location of Cisco Secure ACS information in the Windows Registry and advises against modification.

CSAdmin

Explains CSAdmin as the service providing the web server for the Cisco Secure ACS HTML interface.

CSAuth

Describes CSAuth as the authentication and authorization service, managing user access and defining privileges.

CSDBSync

Explains CSDBSync as the service for synchronizing the Cisco Secure ACS database with third-party RDBMS systems.

CSLog

Details CSLog as the service for capturing and placing logging information into CSV files.

CSMon

Describes CSMon as a service for minimizing downtime by monitoring system parameters and application performance.

Monitoring

Explains how CSMon monitors overall system status and key system parameters like disk space and processor utilization.

Recording

Describes how CSMon records exception events in logs for diagnosing problems.

Notification

Details how CSMon can be configured to notify system administrators of exception events, responses, and outcomes.

Response

Explains how CSMon detects exception events and responds by logging, sending notifications, or taking actions.

CSTacacs and CSRadius

Describes how CSTacacs and CSRadius services communicate between CSAuth and access devices for authentication and authorization.

Related product manuals