Cisco 3.3 User Manual

User guide for cisco secure acs for windows server

Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: 408

526-4000

800 553-NETS (6387)

Fax: 408

526-4100

User Guide for Cisco Secure ACS for
Windows Server

Version 3.3

May 2004

Customer Order Number: DOC-7816592=
Text Part Number: 78-16592-01

Table of contents

Document Outline

Contents
Preface
- Audience
- Organization
- Conventions
- Product Documentation
- Related Documentation
- Obtaining Documentation
  - Cisco.com
  - Ordering Documentation
- Documentation Feedback
- Obtaining Technical Assistance
- Obtaining Additional Publications and Information
Overview
- The CiscoSecure ACS Paradigm
- CiscoSecure ACS Specifications
  - System Performance Specifications
  - CiscoSecure ACS Windows Services
- AAA Server Functions and Concepts
- CiscoSecure ACS HTML Interface
Deployment Considerations
- Basic Deployment Requirements for CiscoSecure ACS
  - System Requirements
  - Network and Port Requirements
- Basic Deployment Factors for CiscoSecure ACS
- Suggested Deployment Sequence
Interface Configuration
- Interface Design Concepts
  - User-to-Group Relationship
  - Per-User or Per-Group Features
- User Data Configuration Options
  - Defining New User Data Fields
- Advanced Options
  - Setting Advanced Options for the CiscoSecure ACS User Interface
- Protocol Configuration Options for TACACS+
  - Setting Options for TACACS+
- Protocol Configuration Options for RADIUS
  - Setting Protocol Configuration Options for IETF RADIUS Attributes
  - Setting Protocol Configuration Options for Non-IETF RADIUS Attributes
Network Configuration
- About Network Configuration
- About Distributed Systems
  - AAA Servers in Distributed Systems
  - Default Distributed System Settings
- Proxy in Distributed Systems
- Network Device Searches
  - Network Device Search Criteria
  - Searching for Network Devices
- AAA Client Configuration
- AAA Server Configuration
- Network Device Group Configuration
- Proxy Distribution Table Configuration
Shared Profile Components
- About Shared Profile Components
- Network Access Filters
- Downloadable IP ACLs
- Network Access Restrictions
- Command Authorization Sets
User Group Management
- About User Group Setup Features and Functions
  - Default Group
  - Group TACACS+ Settings
- Basic User Group Settings
- Configuration-specific User Group Settings
- Group Setting Management
User Management
- About User Setup Features and Functions
- About User Databases
- Basic User Setup Options
- Advanced User Authentication Settings
- User Management
System Configuration: Basic
- Service Control
  - Determining the Status of CiscoSecure ACS Services
  - Stopping, Starting, or Restarting Services
- Logging
- Date Format Control
  - Setting the Date Format
- Local Password Management
  - Configuring Local Password Management
- CiscoSecure ACS Backup
- CiscoSecure ACS System Restore
- CiscoSecure ACS Active Service Management
  - System Monitoring
    - System Monitoring Options
    - Setting Up System Monitoring
  - Event Logging
    - Setting Up Event Logging
- VoIP Accounting Configuration
  - Configuring VoIP Accounting
System Configuration: Advanced
- CiscoSecure Database Replication
- RDBMS Synchronization
- IP Pools Server
- IP Pools Address Recovery
  - Enabling IP Pool Address Recovery
System Configuration: Authentication and Certificates
- About Certification and EAP Protocols
- Global Authentication Setup
  - Authentication Configuration Options
  - Configuring Authentication Options
- CiscoSecure ACS Certificate Setup
Logs and Reports
- Logging Formats
- Special Logging Attributes
- NAC Attributes in Logs
- Update Packets in Accounting Logs
- About CiscoSecure ACS Logs and Reports
- Working with CSV Logs
- Working with ODBC Logs
- Remote Logging
- Service Logs
  - Services Logged
  - Configuring Service Logs
Administrators and Administrative Policy
- Administrator Accounts
- Access Policy
  - Access Policy Options
  - Setting Up Access Policy
- Session Policy
  - Session Policy Options
  - Setting Up Session Policy
- Audit Policy
User Databases
- CiscoSecure User Database
  - About the CiscoSecure User Database
  - User Import and Creation
- About External User Databases
  - Authenticating with External User Databases
  - External User Database Authentication Process
- Windows User Database
- Generic LDAP
- Novell NDS Database
- ODBC Database
- LEAP Proxy RADIUS Server Database
  - Configuring a LEAP Proxy RADIUS Server External User Database
- Token Server User Databases
- Deleting an External User Database Configuration
Network Admission Control
- About Network Admission Control
- Implementing Network Admission Control
- NAC Databases
- NAC Policies
Unknown User Policy
- Known, Unknown, and Discovered Users
- Authentication and Unknown Users
- Posture Validation and the Unknown User Policy
- Authorization of Unknown Users
- Unknown User Policy Options
- Database Search Order
- Configuring the Unknown User Policy
- Disabling Unknown User Authentication
User Group Mapping and Specification
- About User Group Mapping and Specification
- Group Mapping by External User Database
  - Creating a CiscoSecure ACS Group Mapping for a Token Server, ODBC Database, or LEAP Proxy RADIUS...
- Group Mapping by Group Set Membership
- NAC Group Mapping
  - Configuring NAC Group Mapping
- RADIUS-Based Group Specification
Troubleshooting
- Administration Issues
- Browser Issues
- Cisco IOS Issues
- Database Issues
- Dial-in Connection Issues
- Debug Issues
- Proxy Issues
- Installation and Upgrade Issues
- MaxSessions Issues
- Report Issues
- Third-Party Server Issues
- User Authentication Issues
- TACACS+ and RADIUS Attribute Issues
TACACS+ Attribute-Value Pairs
- Cisco IOS AV Pair Dictionary
  - TACACS+ AV Pairs
  - TACACS+ Accounting AV Pairs
RADIUS Attributes
- CiscoIOS Dictionary of RADIUS AV Pairs
- CiscoIOS/PIX Dictionary of RADIUS VSAs
- About the cisco-av-pair RADUIS Attribute
- CiscoVPN 3000 Concentrator Dictionary of RADIUS VSAs
- Cisco VPN 5000 Concentrator Dictionary of RADIUS VSAs
- Cisco Building Broadband Service Manager Dictionary of RADIUS VSA
- IETF Dictionary of RADIUS AV Pairs
- Microsoft MPPE Dictionary of RADIUS VSAs
- Ascend Dictionary of RADIUS AV Pairs
- Nortel Dictionary of RADIUS VSAs
- Juniper Dictionary of RADIUS VSAs
CSUtil Database Utility
- Location of CSUtil.exe and Related Files
- CSUtil.exe Syntax
- CSUtil.exe Options
- Displaying Command-Line Syntax
- Backing Up CiscoSecure ACS with CSUtil.exe
- Restoring CiscoSecure ACS with CSUtil.exe
- Creating a CiscoSecure User Database
- Creating a CiscoSecure ACS Database Dump File
- Loading the CiscoSecure ACS Database from a Dump File
- Compacting the CiscoSecure User Database
- User and AAA Client Import Option
  - Importing User and AAA Client Information
  - User and AAA Client Import File Format
- Exporting User List to a Text File
- Exporting Group Information to a Text File
- Exporting Registry Information to a Text File
- Decoding Error Numbers
- Recalculating CRC Values
- User-Defined RADIUS Vendors and VSA Sets
- PAC File Generation
  - PAC File Options and Examples
  - Generating PAC Files
- Posture Validation Attributes
VPDN Processing
- VPDN Process
RDBMS Synchronization Import Definitions
- accountActions Specification
- Action Codes
- CiscoSecure ACS Attributes and Action Codes
- An Example of accountActions
Internal Architecture
- Windows Services
- Windows Registry
- CSAdmin
- CSAuth
- CSDBSync
- CSLog
- CSMon
- CSTacacs and CSRadius
Index