Field Description Usage tips
AD domain This must be the fully qualified domain name
(FQDN) of the AD domain that the VCS will
join. It must be entered in upper case, such as,
EXAMPLE.COM.
Typically the domain is the same as the DNS
name of the Kerberos server.
Upper case entry is enforced due to case
sensitivity issues with Active Directory.
Short
domain
name
The short domain name used by the VCS
when it joins the AD domain.
It is also known as the NetBIOS domain name.
NetBIOS
machine
name
(override)
By default the system uses the System host
name as the NetBIOS machine name when
joining the AD domain. If required, you can
enter a different name here to override the
default name.
An override must be specified if the System
host name exceeds 15 characters.
Secure
channel
mode
Indicates if data transmitted from the VCS to
an AD Domain Controller is sent over a
secure channel.
Auto: automatically adapts to the domain
controller's settings.
Enabled: always attempts to use a secure
channel.
Disabled: does not use a secure channel.
The default is Auto.
You are recommended to use Auto.
Encryption Sets the encryption to use for the LDAP
connection to the Active Directory Service.
Off: no encryption is used.
TLS: TLS encryption is used.
The default is TLS.
If encryption is set to TLS, a valid CA
certificate, private key and server certificate
must be uploaded to the VCS.
Click Upload a CA certificate file for TLS (in
the Related tasks section) to go to the
Managing the trusted CA certificate list [p.285]
page.
Clockskew The maximum allowed clockskew (in
seconds) between the VCS and the KDC
before the Kerberos message is assumed to
be invalid.
The default is 300 seconds.
It should be kept in step with the clock skew
setting on the KDC.
Ensure that VCS and KDC are synchronized
to time servers.
Use DNS
SRV lookup
to obtain
Domain
Controller
addresses
Yes is the recommended setting. This means
that VCS will use a DNS SRV lookup of the
AD domain to obtain the address details of
the AD domain controllers.
If the lookup cannot provide the addresses
then set this field to No and enter the IP
address of the primary Domain Controller into
the Address 1 field that will be displayed.
Cisco VCS Administrator Guide (X8.1.1) Page 125 of 507
Device authentication
About device authentication
To Next Page
Loading...
