Cisco Systems 4.2 manual ACS SE Only, Ldap Server Configuration Sections

Page 102

Chapter 6 Agentless Host Support Configuration Scenario

Basic Configuration Steps for Agentless Host Support

Figure 6-7 LDAP Server Configuration Sections

a.For the primary LDAP server specify:

Hostname—The name or IP address of the server that is running the LDAP software. If you are using DNS on your network, you can type the hostname instead of the IP address.

Port—The TCP/IP port number on which the LDAP server is listening. The default is 389, as stated in the LDAP specification. If you do not know the port number, you can find this information by viewing those properties on the LDAP server. If you want to use secure authentication, port 636 is the default.

LDAP Version—ACS uses LDAP version 3 or version 2 to communicate with your LDAP database. If you check this check box, ACS uses LDAP version 3. If it is unchecked, ACS uses LDAP version 2.

SecurityACS uses SSL to encrypt communication between ACS and the LDAP server. If you do not enable SSL, user credentials are passed to the LDAP server in clear text. If you select this option, then you must select Trusted Root CA or Certificate Database Path. ACS supports only server-side authentication for SSL communication with the LDAP server.

ACS SE Only:

You must ensure that the Port box contains the port number used for SSL on the LDAP server.

Trusted Root CALDAP over SSL includes the option to authenticate by using the certificate database files other than the Netscape cert7.db file. This option uses the same mechanism as other SSL installations in the ACS environment. Select the certification authority that issued the server certificate that is installed on the LDAP server.

Certificate DB Path: For ACS for Windows, this is the path to the Netscape cert7.db file For the ACS SE, this option provides a link to the Download Certificate Database page.

 

Configuration Guide for Cisco Secure ACS 4.2

6-16

OL-14390-02

Image 102
Contents Configuration Guide for Cisco Secure ACS Americas HeadquartersPage N T E N T S Deploying ACS in a NAC/NAP Environment Error Messages Overview Profile Setup Profile Setup Audience OrganizationConvention ConventionsProduct Documentation Boldface fontAvailable Formats ACSTroubleshooting.html Related DocumentationLicense Issues OpenSSL/Open SSL ProjectOpenSSL License Original SSLeay License Overview of ACS Configuration Summary of Configuration StepsClick Interface Configuration Click System ConfigurationPeap EAP-FAST EAP-TLS Leap EAP-MD5 Overview of ACS Configuration Summary of Configuration Steps Configuration Flowchart EAP-TLS, SSLOL-14390-02 Deploy the Access Control Servers Determining the Deployment ArchitectureAccess Types Wired LAN AccessSize Users Small LAN Environment Campus LANGeographically Dispersed Wired LAN ACS in a Campus LANWireless Access Topology Simple WlanCampus Wlan Regional Wlan Setting Large Enterprise Wlan Setting 6shows a regional WlanDial-up Access Topology Small Dial-Up Network AccessLarge Dial-Up Network Access Small Dial-up NetworkPlacement of the Radius Server Determining How Many ACSs to Deploy ScalabilityNumber of Users Number of Network Access Servers LAN Versus WAN Deployment Number of LANs in the NetworkWAN Latency and Dependability Load Balancing and Failover Configuration components for replication-What is replicatedDeploying ACS Servers to Support Server Failover Database Replication ConsiderationsDatabase Synchronization Considerations Replication DesignACS Deploying ACS in a NAC/NAP EnvironmentComponent Description Cisco AAA server productRemote Access Policy Additional TopicsAdministrative Access Policy Security PolicySeparation of Administrative and General Users Number of Users Database ConsiderationsNetwork Latency and Reliability Type of DatabaseOL-14390-02 Configuring New Features in ACS New Global EAP-FAST Configuration OptionsOption Description PACUse PAC and Do Not Use PAC Options Disabling NetBIOS 2shows the new options on the NAP ProtocolsRight-clickMy Network Places and choose Properties Configuring ACS 4.2 Enhanced Logging FeaturesTo disable NetBIOS over TCP/ IP in Windows 2000, XP, or Click Internet Protocol TCP/IP and choose PropertiesConfiguring Group Filtering at the NAP Level Click SubmitOption to Not Log or Store Dynamic Users Configuring Syslog Time Format in ACSCheck the Disable Dynamic users check box Active Directory Multi-Forest SupportClick Database Configuration RSA Support on the ACS SEClick Submit and Restart Click RSA SecureID Token Server Click Create New ConfigurationClick Configure Click Upload scconf.recPurging the RSA Node Secret File FTP Server Login Password DirectoryExternal User Databases Configuration page opens FieldClick Purge Node Secret Configuring RSA SecurID Token and Ldap Group MappingClick Configure Ldap Click RSA SecurID Token and Ldap Group MappingRSA SecurID Token and Ldap Group Mapping Configuration Choose Process all usernamesConfiguring New Features in ACS RSA Support on the ACS SE Configuring New Features in ACS RSA Support on the ACS SE Uid=joesmith,ou=members,ou=administrators,o=cisco Turning Ping On and Off New Rdbms Synchronization Features in ACS Release ACS 4.2 provides enhanced support for Rdbms SynchronizationCreate a Text File to Define the dACLs Using Rdbms Synchronization to Configure dACLsEnable dACLs Check the Rdbms Synchronization check boxExample 4-1shows a sample text file Code the information in the file as described in TableKeyword Value Sample accountActions CSV File Example 4-2shows a sample accountActions CSV fileConfigure Rdbms Synchronization to Use a Local CSV File Action Code Name Required DescriptionClick Rdbms Synchronization Rdbms Synchronization Setup Page ACS for Windows Configuration Guide for Cisco Secure ACS OL-14390-02 Running CSDBSync Manually to Create the dACLs Perform Rdbms SynchronizationRunning Rdbms Synchronization from the ACS GUI ACS for WindowsPerforming Rdbm Synchronization Using a Script View the dACLsEntry for the Sample dACL Error Messages ExplanationNAF Enabled correctly in the ACS GUI User has write access to the ACSOn the ACS is configured correctly Reading, Updating, and Deleting dACLsDaclreplace UpdatedaclReaddacl DeletedaclUpdateuserdacl UNGN, VN Deleteuserdacl UngnUpdatenas Creating, Reading, Updating and Deleting AAA clientsReadnas OL-14390-02 Password Policy Configuration Scenario Add and Edit a New Administrator Account Administration Control To specify password restrictions Configure Password PolicyServer 4.2, Administrators and Administrative Policy Privileges that you want to grantAdministrator Password Policy Setup Password Lifetime Options Specify Password Validation OptionsSpecify Password Lifetime Options Password Inactivity OptionsSpecify Incorrect Password Attempt Options Configure Session PolicySpecify Password Inactivity Options Incorrect Password Attempt Options section, configureSession Policy Setup Access Policy Setup page appears, as shown in Figure Configure Access PolicyClick Access Policy Before You BeginAccess Policy Setup Click the appropriate IP Address Filtering optionRange includes the Start and End IP addresses IP Address Ranges table contains ten rows for configuringIP address ranges. The ranges are always inclusive that is, Must differ only in the last octet Class C formatInstallation process. With SSL enabled, ACS begins using Viewing Administrator Entitlement ReportsConfiguration ACS Certificate Setup to access Displays an errorView Privilege Reports Click Entitlement ReportsOL-14390-02 Agentless Host Support Configuration Scenario Overview of Agentless Host SupportUsing Audit Servers and Game Group Feedback 1shows the flow of MAB informationConfigure a Radius AAA client See Configure a Radius AAA Client, page 6-5for detailsBasic Configuration Steps for Agentless Host Support Install ACSConfigure a Radius AAA Client Install and Set Up an ACS Security Certificate Click Submit + ApplyObtain Certificates and Copy Them to the ACS Host Go to selecteddrive\CertsClick ACS Certificate Setup Click Install ACS Certificate Enable Security Certificates on the ACS InstallationSelect Install Certificate Click SubmitInstall the CA Certificate To install the CA CertificateAdd a Trusted Certificate Configure Ldap Support for MAB Configure an External Ldap Database for MAB SupportCreate one or more Ldap database configurations in ACS Description of the Settings in the Sample Ldap Schema 802.1x device n 802.1x device n+1How the Subtrees Work How the Ldap User Groups WorkCreate One or More Ldap Database Configurations in ACS 1describes the attributes of the sample Ldap groupsClick Generic Ldap Specify the common Ldap configuration 6shows the Common Ldap Configuration sectionOL-14390-02 Ldap Server Configuration Sections ACS SE OnlyConfigure User Groups for MAB Segments Enable Agentless Request Processing Create a New NAPClick Add Profile Profile Setup page opens, shown in Figure Profile SetupEnable Agentless Request Processing for a NAP You are now ready to enable agentless request processingCheck the check box for Allow Agentless Request Processing Configure MAB You are now ready to configure MAB settingsClick Internal ACS DB 13 MAC Address Input AreaConfigure Logging and Reports Configuring Reports for MAB ProcessingConfiguration Steps for Audit Server Support Configure Game Group FeedbackConfigure global authentication settings Configure Security CertificatesTo configure PEAP-TLS Configure security certificates Specify EAP-TLS optionsObtain Certificates and Copy Them to the ACS Host Enable Security Certificates on the ACS Installation Install the CA Certificate Add a Trusted CertificateConfigure Global Authentication Settings Click Global Authentication SetupGlobal Authentication Setup page opens, as shown in Figure Optional Configure Authentication Policy Specify EAP-TLS OptionsEAPMSCHAP2 EAP-GTC Click Logging Configuring Syslog LoggingOverview Logging page opens, shown in FigureLogging Configuration Enable Logging Format of Syslog Messages in ACS Reports Facility CodesMessage Length Restrictions OL-14390-02 NAC Configuration Scenario Install ACSPerform Network Configuration Tasks This section describesAdd AAA Client Configure the AAA Server Set Up System Configuration Click Submit and ApplyThis section describes the following tasks Set Up the ACS Certification Authority Click ACS Certificate SetupClick ACS Certification Authority Setup Choose ACS Certificate Setup Edit Certificate Trust List Edit the Certificate Trust ListInstall ACS Certificate page opens, as shown in Figure Set Up Global ConfigurationInstall the ACS Certificate Click the Read certificate from file radio buttonSet Up Global Authentication Global Authentication Setup Page appears, as shown in FigureGlobal Authentication Setup Allow Posture Validation Allow EAP-MSCHAPv2Allow EAP-GTC Click Submit + RestartSet Up EAP-FAST Configuration Click EAP-FAST ConfigurationEAP Fast Configuration page appears, as shown in Figure Check the Allow EAP-FASTcheck box -8, this is ACS NAC Server. However, this can be any stringProvisioning check boxes Configure the Logging Level Configure Logs and ReportsClick Service Control Check the Log to CSV Passed Authentications Report check box Check the Log to CSV Radius Accounting Report check box Click Add Administrator Set Up Administration ControlAdd Remote Administrator Access Add Administrator page opens, as shown in Figure10 Add Administrator Click Grant All Set Up Shared Profile Components Configure Network Access Filtering OptionalClick Network Access Filtering Configure Downloadable IP ACLs 11 Edit Network Access FilteringChoose Shared Profile Components Downloadable IP ACLs Adding an ACLTo add a new ACL List of dACLs appears, as shown in FigureAdding an ACE 13 Downloadable IP ACLs14 Downloadable IP ACL Content Configure Radius Authorization Components Saving the dACLNew ACL appears on the list of downloadable ACLs Click Radius Authorization Components 16 Radius Authorization Components17 RAC Attribute Add/Edit 18 Attribute Selection for the CiscoFullAccess RAC 19 Attribute Selection for the CiscoRestricted RAC Attribute Number Attribute Name DescriptionACL Configure an External Posture Validation Audit Server Add the Posture Attribute to the ACS DictionaryConfigure the External Posture Validation Audit Server Click Add Server20 External Posture Validation Audit Server Setup 21 Use These Audit Servers Section Configure Posture Validation for NAC Configure Internal Posture Validation PoliciesClick Internal Posture Validation Setup Click Add RuleClick Add Condition Set Add/Edit Condition page appears, as shown in FigureConfigure External Posture Validation Policies 26 Edit External Posture Validation Servers27 Add/Edit External Posture Validation Server Configure an External Posture Validation Audit Server 28 External Posture Validation Audit Server Setup 29 Use These Audit Servers Section Authorization Policy and NAC Audit 30 Audit Flow Settings and Game Group Feedback SectionsSample NAC Layer 3 Profile Template Set Up Templates to Create NAPsSample NAC Profile Templates EAP-FAST GTCProfile Setup 31 Create Profile From Template32 Profile Setup Page for Layer 3 NAC Template EAP Configuration section, Posture Validation is enabled Protocols Policy for the NAC Layer 3 TemplateAuthentication Policy 34 Authentication Page for Layer 3 NAC Profile TemplateSample NAC Layer 2 Template Sample Posture Validation RuleFrom the Template drop-down list, choose NAC L2 IP To enable the profile setup Go to Network Access Profiles36 Profile Setup Page for NAC Layer 2 Template Default ACLs ACS and Attribute-Value PairsProtocols Settings 37shows the Protocols settings for the NAC Layer 2 template38 Authentication Settings for NAC Layer 2 Template Sample NAC Layer 2 802.1x Template 39 Sample Posture Validation Policy for NAC Layer 2 Template40 Create Profile From Template 41 Profile Setup Page for NAC Layer 2 802.1x Template 42 Protocols Setting for NAC Layer 802.1x Template Protocols PolicyAuthorization Policy Sample Wireless NAC L2 802.1x Template 45 Create Profile From Template 46 Profile Setup Page for Wireless NAC L2 802.1xTemplate 47 Protocols Setting for Wireless NAC 802.1x Template Authorization Policy Using a Sample Agentless Host Template 50 Create Profile From Template Profile Setup 52 Protocols Setting for Agentless Host for Layer 3 Template Choose the relevant profile Posture Validation policy Choose Network Access ProfilesMap Posture Validation Components to Profiles Enter a Name for the ruleClick Back to return to the Posture Validation policy Click Apply + RestartCheck the Allow Agentless Request Processing check box Check the Do not reject when Audit failed check boxMap an Audit Server to a Profile Click Select AuditOptional Configure Game Group Feedback Configure an external audit serverClick Apply and Restart Import an Audit Vendor File by Using CSUtil Import a Device-Type Attribute File by Using CSUtilImport NAC Attribute-Value Pairs Configure an External Audit Server Configure Database Support for Agentless Host ProcessingEnable Posture Validation Restart ACS Navigation bar, click System Configuration\ACSInstallDir\bin\CSUtil -addAVP filename 56 External Posture Validation Audit Server Setup 57 Use These Audit Servers Section 58 Audit Flow Settings and Game Group Feedback Sections Enable Game Group Feedback ACS Solution EngineUnix Mac Integrated DevicePDA Resource usage Being authenticatedAuthentication agent installed, such as Cisco Trust Agent Posture-validation serverAuthenticate the device, instead of using an IP address GL-2GL-3 Network access Microsoft, and RSA Security submitted to the IetfRadius Attribute Component Updatenas Updateuserdacl AdduserACE Audit servers Configuring Configuring audit flow settings for 9-35,9-43,9-78CA certificate Installing Deleteuserdacl CreateuserdaclNAP Specifying Certificate Binary Comparison for Configuring new features in ACS 4.2ACS configuration for Layer 2 NAC 802.1x templateNAC/NAP NetbiosNAC NAC L2 IPReading dACLs Regional Wlan Related documentation ReliabilityReaddacl Readnas RSAPurging Node Secret file purging Sarbanes-Oxley Using Windows Certificate Import WizardInstalling the CA certificate Security policies Security protocolsSignificance Windows Certificate Import Wizard
Related manuals
Manual 94 pages 10.59 Kb Manual 34 pages 46.13 Kb

4.2 specifications

Cisco Systems, a global leader in IT and networking solutions, has consistently evolved to meet the demands of modern enterprises. One of its noteworthy offerings is Cisco Systems 4.2, a version that embodies a significant leap in networking technology and capability. With its rich set of features, Cisco Systems 4.2 caters to a wide range of industries, facilitating enhanced performance and security.

One of the main features of Cisco Systems 4.2 is its improved scalability. The architecture has been designed to support an ever-increasing number of devices and users, making it ideal for growing enterprises. The enhanced scalability allows organizations to expand their network capacities without compromising performance, ensuring seamless integration of new technologies and devices.

Another critical aspect of Cisco Systems 4.2 is its advanced security protocols. With cyber threats constantly evolving, Cisco prioritizes security in this version by offering robust features such as end-to-end encryption, improved firewall capabilities, and enhanced intrusion detection systems. These security enhancements provide organizations with peace of mind, knowing that their sensitive data and networks are well-protected from unauthorized access and potential threats.

Cisco Systems 4.2 also introduces intelligent automation features, which significantly streamline network management. Through the use of artificial intelligence and machine learning, Cisco enables organizations to automate routine tasks, reduce human error, and optimize performance. This automation not only enhances efficiency but also allows IT teams to focus on strategic initiatives rather than day-to-day maintenance.

Moreover, Cisco Systems 4.2 emphasizes infrastructure flexibility. The new architecture supports various deployment models, including on-premises, cloud, and hybrid environments. This flexibility enables organizations to adapt their networking strategies according to their specific needs and operational requirements, facilitating a more tailored approach to IT infrastructure.

Collaboration tools have also been enhanced in this version. Cisco Systems 4.2 integrates advanced communication solutions that empower teams to collaborate in real time, regardless of their geographical location. Features such as high-definition video conferencing, secure messaging, and file sharing enhance productivity and foster innovation across teams.

In summary, Cisco Systems 4.2 stands out as a forward-thinking networking solution with key features such as scalability, advanced security, intelligent automation, flexible infrastructure, and enhanced collaboration tools. These characteristics position Cisco Systems 4.2 as an invaluable asset for enterprises striving for digital transformation in an increasingly interconnected world. The ongoing innovation reflects Cisco's commitment to delivering cutting-edge technology solutions that drive business success and resilience.