EasyManua.ls Logo

Cisco Servers User Manual

Cisco Servers
654 pages
To Next Page IconTo Next Page
To Next Page IconTo Next Page
To Previous Page IconTo Previous Page
To Previous Page IconTo Previous Page
Page #437 background imageLoading...
Page #437 background image
11-47
Cisco Secure ACS 3.0 for Windows 2000/NT Servers User Guide
78-13751-01, Version 3.0
Chapter 11 Working with User Databases
Token Server User Databases
RetriesThe number of authentication attempts Cisco Secure ACS makes
before failing over to the secondary proxy RADIUS server.
Failback Retry Delay (minutes)The number of minutes after which
Cisco Secure ACS attempts authentications using a failed primary proxy
RADIUS server.
Note If both the primary and the secondary servers fail,
Cisco Secure ACS alternates between both servers until one
responds.
Step 8 Click Submit.
Result: Cisco Secure ACS saves the proxy RADIUS token server database
configuration you created. You can add it to your Unknown User Policy or assign
specific user accounts to use this database for authentication. For more
information about the Unknown User Policy, see the Unknown User Processing
section on page 12-1. For more information about configuring user accounts to
authenticate using this database, see Chapter 7, Setting Up and Managing User
Accounts.
Token Server User Databases
Cisco Secure ACS supports the use of token servers for the increased security
provided by one-time passwords (OTPs). This section includes the following
topics:
About Token Servers and Cisco Secure ACS, page 11-48
About Token Servers and Cisco Secure ACS, page 11-48
RADIUS-Enabled Token Servers, page 11-49
Token Servers with Vendor-Proprietary Interfaces, page 11-53

Table of Contents

Question and Answer IconNeed help?

Do you have a question about the Cisco Servers and is the answer not in the manual?

Cisco Servers Specifications

General IconGeneral
BrandCisco
ModelServers
CategorySoftware
LanguageEnglish

Summary

Overview of Cisco Secure ACS

The Cisco Secure ACS Paradigm

Provides an overview of Cisco Secure ACS, its AAA services, and AAA client functionality.

Cisco Secure ACS Specifications

Details performance specifications and the Windows services composing Cisco Secure ACS.

AAA Server Functions and Concepts

Explains AAA server functions, authorization, accounting, and administration.

Cisco Secure ACS HTML Interface

Discusses the HTML interface and procedures for using it, including layout and access.

Deploying Cisco Secure ACS

Basic Deployment Requirements for Cisco Secure ACS

Details minimum hardware, software, and network requirements for successful Cisco Secure ACS deployment.

Basic Deployment Factors for Cisco Secure ACS

Covers essential factors to consider before implementing Cisco Secure ACS, including topology and policies.

Suggested Deployment Sequence

Provides a step-by-step guide for deploying Cisco Secure ACS, keyed to high-level functions.

Setting Up the Cisco Secure ACS HTML Interface

Interface Design Concepts

Explains basic precepts of the system's operation for effective interface configuration.

User Data Configuration Options

Details how to add or edit fields for recording information on each user.

Advanced Options

Enables determination of which advanced features Cisco Secure ACS displays.

Protocol Configuration Options for TACACS+

Details configuration of the HTML interface for TACACS+ settings.

Protocol Configuration Options for RADIUS

Details configuration of the HTML interface for RADIUS settings.

Setting Up and Managing Network Configuration

About Distributed Systems

Explains how Cisco Secure ACS can be used in a distributed system with multiple servers.

AAA Client Configuration

Provides procedures for working with AAA clients.

AAA Server Configuration

Details procedures for configuring AAA servers in Cisco Secure ACS.

Network Device Group Configuration

Explains the advanced feature for viewing and administering network devices as a single logical group.

Proxy Distribution Table Configuration

Describes the Proxy Distribution Table and its configuration procedures.

Setting Up and Managing Shared Profile Components

Downloadable PIX ACLs

Describes downloadable PIX ACLs and provides configuration instructions.

Network Access Restrictions

Describes NARs and provides instructions for shared NAR configuration and management.

Command Authorization Sets

Includes descriptions of command authorization sets and pattern matching.

Setting Up and Managing User Groups

User Group Setup Features and Functions

Provides an overview of features within the Group Setup section.

Common User Group Settings

Details basic activities performed when configuring a new user group.

Configuration-specific User Group Settings

Details procedures applicable to specific network security configurations.

Group Setting Management

Includes basic administrative procedures for managing users within groups.

Setting Up and Managing User Accounts

User Setup Features and Functions

Provides an overview of the User Setup section functionality.

About User Databases

Information regarding user databases supported by Cisco Secure ACS.

Basic User Setup Options

Step-by-step procedures for basic settings and options when configuring a user account.

Advanced User Authentication Settings

Configures user-level TACACS+ and RADIUS enable parameters.

User Management

Information about viewing, disabling, and resetting user accounts.

Establishing Cisco Secure ACS System Configuration

Service Control

Provides status information and control for Cisco Secure ACS services.

Logging

Details logging capabilities and configuration for administrative and accounting events.

Date Format Control

Allows selection of date formats for logs, reports, and the administrative interface.

Password Validation

Configures validation parameters for user passwords.

CiscoSecure Database Replication

Information on implementing and configuring database replication between Cisco Secure ACS servers.

RDBMS Synchronization

Details the RDBMS Synchronization feature for updating the CiscoSecure user database.

Cisco Secure ACS Backup

Provides information on the Cisco Secure ACS Backup feature and procedures.

Cisco Secure ACS System Restore

Information and procedures for restoring the Cisco Secure ACS server from a backup file.

Cisco Secure ACS Active Service Management

Details the ACS Active Service Management tool for service monitoring.

IP Pools Server

Enables assigning IP addresses to multiple users and managing IP pools.

IP Pools Address Recovery

Enables recovery of assigned IP addresses not used for a specified period.

VoIP Accounting Configuration

Specifies which accounting logs receive VoIP accounting data.

Cisco Secure ACS Certificate Setup

Provides EAP-TLS feature for user authentication using digital certificates.

Certification Authority Setup

Details preconfigured CAs and procedures for signifying trustworthiness.

Global Authentication Setup

Selects and configures extended authentication options like EAP-MD5/EAP-TLS and MS-CHAP.

Working with Logging and Reports

Logging Formats

Describes how Cisco Secure ACS logs user and system activities in CSV or ODBC formats.

About Cisco Secure ACS Logs and Reports

Categorizes Cisco Secure ACS logs into Accounting, System, and Service logs.

Working with CSV Logs

Provides procedures for enabling, disabling, viewing, and configuring CSV logs.

Working with ODBC Logs

Details procedures for preparing, configuring, and working with ODBC logs.

Remote Logging

Discusses remote logging capabilities and configuring a central logging server.

Service Logs

Describes service logs used for troubleshooting and debugging purposes only.

Setting Up and Managing Administrators and Policy

Administrator Accounts

Details managing Cisco Secure ACS administrator accounts for remote access.

Adding an Administrator Account

Procedure to add Cisco Secure ACS administrator accounts for remote access.

Editing an Administrator Account

Procedure to edit administrator account privileges and effectively disable accounts.

Access Policy

Affects access to remote Cisco Secure ACS administration sessions by IP address and TCP port.

Session Policy

Controls various aspects of Cisco Secure ACS administrative sessions.

Audit Policy

Controls the generation of the Administrative Audit log.

Working with User Databases

CiscoSecure User Database

Describes the internal Cisco Secure ACS database and its role in authentication.

About External User Databases

Explains configuring Cisco Secure ACS to forward authentication to one or more external user databases.

Windows NT/2000 User Database

Details PAP, MS-CHAP, and EAP-TLS authentication support with Windows NT/2000 databases.

Generic LDAP

Covers PAP and EAP-TLS authentication via generic LDAP databases like Netscape Directory Services.

Novell NDS Database

Details PAP authentication support with Novell NetWare Directory Services (NDS) servers.

ODBC Database

Explains PAP, CHAP, MS-CHAP, and ARAP authentication using relational databases via ODBC.

LEAP Proxy RADIUS Server Database

Details MS-CHAP and EAP-TLS authentication support with proxy RADIUS servers for Cisco Aironet devices.

Token Server User Databases

Discusses support for token servers for increased security via one-time passwords (OTPs).

Deleting an External User Database Configuration

Procedure to delete an external user database configuration from Cisco Secure ACS.

Administering External User Databases

Unknown User Processing

Handles authentication requests for users not listed in the Cisco Secure ACS database.

Database Group Mappings

Associates unknown users with Cisco Secure ACS groups for assigning authorization profiles.

Troubleshooting Information for Cisco Secure ACS

Administration Issues

Covers common problems related to remote administrator access and service notifications.

Browser Issues

Troubleshoots issues related to accessing the Cisco Secure ACS HTML interface via browser.

Cisco IOS Issues

Addresses problems with Cisco IOS commands and RADIUS attribute support.

Database Issues

Troubleshooting steps for RDBMS Synchronization and Database Replication problems.

Dial-in Connection Issues

Provides recovery actions for dial-in connection failures.

Debug Issues

Helps diagnose authentication and authorization issues.

Proxy Issues

Troubleshooting steps for when proxy functionality fails.

Installation and Upgrade Issues

Addresses common problems encountered during Cisco Secure ACS installation or upgrades.

User Authentication Issues

Troubleshoots problems related to user authentication and authorization.

TACACS+ and RADIUS Attribute Issues

Helps resolve issues where TACACS+ and RADIUS attributes do not appear correctly.

System Messages

Windows NT/2000 Event Log Service Startup Errors

Lists common startup errors for Windows NT/2000 Event Log services.

System Monitored Events

Details system monitored events and recommended actions.

Replication Messages

System messages related to database replication failures or issues.

Failed Attempts Messages

Lists error messages encountered during failed authentication attempts.

TACACS+ Attribute-Value Pairs

Cisco IOS Attribute-Value Pair Dictionary

Provides a dictionary of TACACS+ AV pairs supported by Cisco IOS.

TACACS+ AV Pairs

Lists supported TACACS+ AV pairs for Cisco Secure ACS.

TACACS+ Accounting AV Pairs

Lists supported TACACS+ accounting AV pairs for Cisco Secure ACS.

RADIUS Attributes

Cisco IOS Dictionary of RADIUS AV Pairs

Lists RADIUS attribute-value pairs supported by Cisco IOS.

Cisco IOS/PIX Dictionary of RADIUS VSAs

Details Cisco IOS/PIX vendor-specific attributes (VSAs).

Cisco VPN 3000 Concentrator Dictionary of RADIUS VSAs

Lists supported RADIUS VSAs for Cisco VPN 3000 Concentrators.

Cisco VPN 5000 Concentrator Dictionary of RADIUS VSAs

Lists supported RADIUS VSAs for Cisco VPN 5000 Concentrators.

Vendor-Proprietary IETF RADIUS AV Pairs

Lists supported vendor-proprietary RADIUS (IETF) attributes.

IETF Dictionary of RADIUS AV Pairs

Lists supported RADIUS (IETF) attributes.

RADIUS (IETF) Accounting AV Pairs

Lists supported RADIUS (IETF) accounting attributes.

Cisco Secure ACS Command-Line Database Utility

Location of CSUtil.exe and Related Files

Details the location of CSUtil.exe and related files.

CSUtil.exe Syntax

Provides the syntax for using the CSUtil.exe command.

CSUtil.exe Options

Details the various actions CSUtil.exe can perform.

Backing Up Cisco Secure ACS with CSUtil.exe

Procedure to create a system backup of all Cisco Secure ACS internal data using CSUtil.exe.

Restoring Cisco Secure ACS with CSUtil.exe

Procedure to restore Cisco Secure ACS internal data from a backup file using CSUtil.exe.

Creating a CiscoSecure User Database

Procedure to create a CiscoSecure user database using the -n option.

Creating a Cisco Secure ACS Database Dump File

Procedure to dump all Cisco Secure ACS internal data into a text file using the -d option.

Loading the Cisco Secure ACS Database from a Dump File

Procedure to overwrite Cisco Secure ACS internal data from a dump text file using the -l option.

Compacting the CiscoSecure User Database

Procedure to periodically compact the CiscoSecure user database to reduce its size.

User and AAA Client Import Option

Enables updating Cisco Secure ACS with data from a colon-delimited text file.

Cisco Secure ACS and Virtual Private Dial-up Networks

VPDN Process

Describes the steps for processing VPDN requests in a standard environment.

ODBC Import Definitions

accountActions Table Specification

Details the action codes allowable in an accountActions table for RDBMS Synchronization.

Action Codes

Provides the action codes valid for use in the Action field of the accountActions table.

Cisco Secure ACS Internal Architecture

Windows NT/2000 Environment Overview

Provides an overview of essential Windows NT/2000 concepts related to Cisco Secure ACS services.

Cisco Secure ACS Web Server

Details the built-in web server for the HTML interface.

CSAdmin

Describes the CSAdmin service for the internal web server.

CSAuth

Explains the authentication and authorization service.

CSDBSync

Describes the service used to synchronize the Cisco Secure ACS database with third-party RDBMS systems.

CSLog

Describes the service used to capture and place logging information.

CSMon

Explains the service that facilitates minimum downtime in remote access environments.

Related product manuals