Cisco Systems 4.2 Create One or More Ldap Database Configurations in ACS, Click Generic Ldap

Page 99

Chapter 6 Agentless Host Support Configuration Scenario

Basic Configuration Steps for Agentless Host Support

 

Table 6-1describes the attributes of the sample LDAP groups.

Table 6-1

Attributes in LDAP User Groups for Agentless Host Support

 

 

 

Attribute Name

 

Description

 

 

 

objectClass

 

The value in the example indicates that this is a “group of unique names.” The value that you

 

 

specify here must match the name that you specify in the Group Object Class text box when

 

 

you specify the Common LDAP configuration during ACS LDAP configuration.

 

 

For information on configuring LDAP, see Configure an External LDAP Database for MAB

 

 

Support, page 6-10.

 

 

 

uniqueMember

 

The value in the example is uniqueMember. One or more uniqueMember entries are used to

 

 

specify one or more device type records that have been set up in the LDAP schema to define

 

 

agentless hosts with specified MAC addresses. The objectClass field in the LDAP user group

 

 

shown in the previous code sample includes user00, user77a, and user88.

 

 

The name that you give to this field in your LDAP schema must match the value that you

 

 

enter in the Group Attribute Name text box when you specify the common LDAP

 

 

configuration during ACS LD configuration.

 

 

For information on configuring LDAP, see Configure an External LDAP Database for MAB

 

 

Support, page 6-10.

 

 

 

Create One or More LDAP Database Configurations in ACS

After you have configured one or more LDAP databases to support MAB, configure ACS to query the LDAP databases.

The settings in the following procedure are based on the LDAP schema described in the previous section, Configure an External LDAP Database for MAB Support, page 6-10. For your ACS installation, configure ACS based on the schema that you set up for your network.

To create a LDAP configuration in ACS:

Step 1 In the navigation bar, click External User Databases.

The External User Databases page opens.

Step 2 Click Database Configuration.

The External User Database Configuration page opens.

Step 3 Click Generic LDAP.

The Database Configuration Creation table appears. If an LDAP configuration exists, the External User Database Configuration table also appears.

Step 4 Do one of the following. If:

There are no existing LDAP database configurations, click Create New Configuration.

The External User Database table appears, click Configure.

Step 5 If you are creating a new LDAP configuration, enter the name of the new configuration for generic LDAP and then click Submit.

Step 6 Click Configure.

The Generic LDAP Configuration page appears and contains four sections:

Domain Filtering—Use to configure domain filtering, which is an optional configuration setting.

 

 

Configuration Guide for Cisco Secure ACS 4.2

 

 

 

 

 

 

OL-14390-02

 

 

6-13

 

 

 

 

 

Image 99
Contents Americas Headquarters Configuration Guide for Cisco Secure ACSPage N T E N T S Deploying ACS in a NAC/NAP Environment Error Messages Overview Profile Setup Profile Setup Organization AudienceBoldface font ConventionsProduct Documentation ConventionAvailable Formats Related Documentation ACSTroubleshooting.htmlLicense Issues OpenSSL/Open SSL ProjectOpenSSL License Original SSLeay License Summary of Configuration Steps Overview of ACS ConfigurationClick System Configuration Click Interface ConfigurationPeap EAP-FAST EAP-TLS Leap EAP-MD5 Overview of ACS Configuration Summary of Configuration Steps EAP-TLS, SSL Configuration FlowchartOL-14390-02 Determining the Deployment Architecture Deploy the Access Control ServersAccess Types Wired LAN AccessSize Users Campus LAN Small LAN EnvironmentACS in a Campus LAN Geographically Dispersed Wired LANSimple Wlan Wireless Access TopologyCampus Wlan Regional Wlan Setting 6shows a regional Wlan Large Enterprise Wlan SettingSmall Dial-Up Network Access Dial-up Access TopologySmall Dial-up Network Large Dial-Up Network AccessPlacement of the Radius Server Determining How Many ACSs to Deploy ScalabilityNumber of Users Number of Network Access Servers LAN Versus WAN Deployment Number of LANs in the NetworkWAN Latency and Dependability Database Replication Considerations Configuration components for replication-What is replicatedDeploying ACS Servers to Support Server Failover Load Balancing and FailoverReplication Design Database Synchronization ConsiderationsCisco AAA server product Deploying ACS in a NAC/NAP EnvironmentComponent Description ACSAdditional Topics Remote Access PolicySecurity Policy Administrative Access PolicySeparation of Administrative and General Users Type of Database Database ConsiderationsNetwork Latency and Reliability Number of UsersOL-14390-02 New Global EAP-FAST Configuration Options Configuring New Features in ACSPAC Option DescriptionUse PAC and Do Not Use PAC Options 2shows the new options on the NAP Protocols Disabling NetBIOSClick Internet Protocol TCP/IP and choose Properties Configuring ACS 4.2 Enhanced Logging FeaturesTo disable NetBIOS over TCP/ IP in Windows 2000, XP, or Right-clickMy Network Places and choose PropertiesClick Submit Configuring Group Filtering at the NAP LevelActive Directory Multi-Forest Support Configuring Syslog Time Format in ACSCheck the Disable Dynamic users check box Option to Not Log or Store Dynamic UsersClick Database Configuration RSA Support on the ACS SEClick Submit and Restart Click Upload scconf.rec Click Create New ConfigurationClick Configure Click RSA SecureID Token ServerField FTP Server Login Password DirectoryExternal User Databases Configuration page opens Purging the RSA Node Secret FileClick RSA SecurID Token and Ldap Group Mapping Configuring RSA SecurID Token and Ldap Group MappingClick Configure Ldap Click Purge Node SecretChoose Process all usernames RSA SecurID Token and Ldap Group Mapping ConfigurationConfiguring New Features in ACS RSA Support on the ACS SE Configuring New Features in ACS RSA Support on the ACS SE Uid=joesmith,ou=members,ou=administrators,o=cisco Turning Ping On and Off ACS 4.2 provides enhanced support for Rdbms Synchronization New Rdbms Synchronization Features in ACS ReleaseCheck the Rdbms Synchronization check box Using Rdbms Synchronization to Configure dACLsEnable dACLs Create a Text File to Define the dACLsExample 4-1shows a sample text file Code the information in the file as described in TableKeyword Value Example 4-2shows a sample accountActions CSV file Sample accountActions CSV FileConfigure Rdbms Synchronization to Use a Local CSV File Action Code Name Required DescriptionClick Rdbms Synchronization Rdbms Synchronization Setup Page ACS for Windows Configuration Guide for Cisco Secure ACS OL-14390-02 ACS for Windows Perform Rdbms SynchronizationRunning Rdbms Synchronization from the ACS GUI Running CSDBSync Manually to Create the dACLsView the dACLs Performing Rdbm Synchronization Using a ScriptEntry for the Sample dACL Error Messages ExplanationNAF Reading, Updating, and Deleting dACLs User has write access to the ACSOn the ACS is configured correctly Enabled correctly in the ACS GUIDeletedacl UpdatedaclReaddacl DaclreplaceDeleteuserdacl Ungn Updateuserdacl UNGN, VNUpdatenas Creating, Reading, Updating and Deleting AAA clientsReadnas OL-14390-02 Password Policy Configuration Scenario Add and Edit a New Administrator Account Administration Control Privileges that you want to grant Configure Password PolicyServer 4.2, Administrators and Administrative Policy To specify password restrictionsAdministrator Password Policy Setup Password Inactivity Options Specify Password Validation OptionsSpecify Password Lifetime Options Password Lifetime OptionsIncorrect Password Attempt Options section, configure Configure Session PolicySpecify Password Inactivity Options Specify Incorrect Password Attempt OptionsSession Policy Setup Before You Begin Configure Access PolicyClick Access Policy Access Policy Setup page appears, as shown in FigureClick the appropriate IP Address Filtering option Access Policy SetupMust differ only in the last octet Class C format IP Address Ranges table contains ten rows for configuringIP address ranges. The ranges are always inclusive that is, Range includes the Start and End IP addressesDisplays an error Viewing Administrator Entitlement ReportsConfiguration ACS Certificate Setup to access Installation process. With SSL enabled, ACS begins usingClick Entitlement Reports View Privilege ReportsOL-14390-02 Overview of Agentless Host Support Agentless Host Support Configuration Scenario1shows the flow of MAB information Using Audit Servers and Game Group FeedbackSee Configure a Radius AAA Client, page 6-5for details Configure a Radius AAA clientInstall ACS Basic Configuration Steps for Agentless Host SupportConfigure a Radius AAA Client Click Submit + Apply Install and Set Up an ACS Security CertificateGo to selecteddrive\Certs Obtain Certificates and Copy Them to the ACS HostClick Submit Enable Security Certificates on the ACS InstallationSelect Install Certificate Click ACS Certificate Setup Click Install ACS CertificateInstall the CA Certificate To install the CA CertificateAdd a Trusted Certificate Configure Ldap Support for MAB Configure an External Ldap Database for MAB SupportCreate one or more Ldap database configurations in ACS 802.1x device n 802.1x device n+1 Description of the Settings in the Sample Ldap SchemaHow the Ldap User Groups Work How the Subtrees WorkCreate One or More Ldap Database Configurations in ACS 1describes the attributes of the sample Ldap groupsClick Generic Ldap 6shows the Common Ldap Configuration section Specify the common Ldap configurationOL-14390-02 ACS SE Only Ldap Server Configuration SectionsConfigure User Groups for MAB Segments Enable Agentless Request Processing Create a New NAPClick Add Profile Profile Setup Profile Setup page opens, shown in FigureEnable Agentless Request Processing for a NAP You are now ready to enable agentless request processingCheck the check box for Allow Agentless Request Processing You are now ready to configure MAB settings Configure MAB13 MAC Address Input Area Click Internal ACS DBConfiguring Reports for MAB Processing Configure Logging and ReportsConfigure Game Group Feedback Configuration Steps for Audit Server SupportSpecify EAP-TLS options Configure Security CertificatesTo configure PEAP-TLS Configure security certificates Configure global authentication settingsObtain Certificates and Copy Them to the ACS Host Enable Security Certificates on the ACS Installation Add a Trusted Certificate Install the CA CertificateConfigure Global Authentication Settings Click Global Authentication SetupGlobal Authentication Setup page opens, as shown in Figure Optional Configure Authentication Policy Specify EAP-TLS OptionsEAPMSCHAP2 EAP-GTC Logging page opens, shown in Figure Configuring Syslog LoggingOverview Click LoggingLogging Configuration Enable Logging Facility Codes Format of Syslog Messages in ACS ReportsMessage Length Restrictions OL-14390-02 Install ACS NAC Configuration ScenarioThis section describes Perform Network Configuration TasksAdd AAA Client Configure the AAA Server Set Up System Configuration Click Submit and ApplyThis section describes the following tasks Set Up the ACS Certification Authority Click ACS Certificate SetupClick ACS Certification Authority Setup Edit the Certificate Trust List Choose ACS Certificate Setup Edit Certificate Trust ListClick the Read certificate from file radio button Set Up Global ConfigurationInstall the ACS Certificate Install ACS Certificate page opens, as shown in FigureGlobal Authentication Setup Page appears, as shown in Figure Set Up Global AuthenticationGlobal Authentication Setup Click Submit + Restart Allow EAP-MSCHAPv2Allow EAP-GTC Allow Posture ValidationSet Up EAP-FAST Configuration Click EAP-FAST ConfigurationEAP Fast Configuration page appears, as shown in Figure Check the Allow EAP-FASTcheck box -8, this is ACS NAC Server. However, this can be any stringProvisioning check boxes Configure the Logging Level Configure Logs and ReportsClick Service Control Check the Log to CSV Passed Authentications Report check box Check the Log to CSV Radius Accounting Report check box Add Administrator page opens, as shown in Figure Set Up Administration ControlAdd Remote Administrator Access Click Add Administrator10 Add Administrator Click Grant All Set Up Shared Profile Components Configure Network Access Filtering OptionalClick Network Access Filtering 11 Edit Network Access Filtering Configure Downloadable IP ACLsList of dACLs appears, as shown in Figure Adding an ACLTo add a new ACL Choose Shared Profile Components Downloadable IP ACLs13 Downloadable IP ACLs Adding an ACE14 Downloadable IP ACL Content Configure Radius Authorization Components Saving the dACLNew ACL appears on the list of downloadable ACLs 16 Radius Authorization Components Click Radius Authorization Components17 RAC Attribute Add/Edit 18 Attribute Selection for the CiscoFullAccess RAC 19 Attribute Selection for the CiscoRestricted RAC Attribute Number Attribute Name DescriptionACL Add the Posture Attribute to the ACS Dictionary Configure an External Posture Validation Audit ServerClick Add Server Configure the External Posture Validation Audit Server20 External Posture Validation Audit Server Setup 21 Use These Audit Servers Section Configure Internal Posture Validation Policies Configure Posture Validation for NACClick Add Rule Click Internal Posture Validation SetupAdd/Edit Condition page appears, as shown in Figure Click Add Condition Set26 Edit External Posture Validation Servers Configure External Posture Validation Policies27 Add/Edit External Posture Validation Server Configure an External Posture Validation Audit Server 28 External Posture Validation Audit Server Setup 29 Use These Audit Servers Section 30 Audit Flow Settings and Game Group Feedback Sections Authorization Policy and NAC AuditEAP-FAST GTC Set Up Templates to Create NAPsSample NAC Profile Templates Sample NAC Layer 3 Profile Template31 Create Profile From Template Profile Setup32 Profile Setup Page for Layer 3 NAC Template Protocols Policy for the NAC Layer 3 Template EAP Configuration section, Posture Validation is enabled34 Authentication Page for Layer 3 NAC Profile Template Authentication PolicySample NAC Layer 2 Template Sample Posture Validation RuleFrom the Template drop-down list, choose NAC L2 IP Go to Network Access Profiles To enable the profile setup36 Profile Setup Page for NAC Layer 2 Template ACS and Attribute-Value Pairs Default ACLs37shows the Protocols settings for the NAC Layer 2 template Protocols Settings38 Authentication Settings for NAC Layer 2 Template 39 Sample Posture Validation Policy for NAC Layer 2 Template Sample NAC Layer 2 802.1x Template40 Create Profile From Template 41 Profile Setup Page for NAC Layer 2 802.1x Template Protocols Policy 42 Protocols Setting for NAC Layer 802.1x TemplateAuthorization Policy Sample Wireless NAC L2 802.1x Template 45 Create Profile From Template 46 Profile Setup Page for Wireless NAC L2 802.1xTemplate 47 Protocols Setting for Wireless NAC 802.1x Template Authorization Policy Using a Sample Agentless Host Template 50 Create Profile From Template Profile Setup 52 Protocols Setting for Agentless Host for Layer 3 Template Enter a Name for the rule Choose Network Access ProfilesMap Posture Validation Components to Profiles Choose the relevant profile Posture Validation policyClick Apply + Restart Click Back to return to the Posture Validation policyClick Select Audit Check the Do not reject when Audit failed check boxMap an Audit Server to a Profile Check the Allow Agentless Request Processing check boxOptional Configure Game Group Feedback Configure an external audit serverClick Apply and Restart Import an Audit Vendor File by Using CSUtil Import a Device-Type Attribute File by Using CSUtilImport NAC Attribute-Value Pairs Restart ACS Navigation bar, click System Configuration Configure Database Support for Agentless Host ProcessingEnable Posture Validation Configure an External Audit Server\ACSInstallDir\bin\CSUtil -addAVP filename 56 External Posture Validation Audit Server Setup 57 Use These Audit Servers Section 58 Audit Flow Settings and Game Group Feedback Sections ACS Solution Engine Enable Game Group FeedbackUnix Mac Integrated DevicePDA Posture-validation server Being authenticatedAuthentication agent installed, such as Cisco Trust Agent Resource usageGL-2 Authenticate the device, instead of using an IP addressGL-3 Network access Microsoft, and RSA Security submitted to the IetfRadius Attribute Component Updatenas Updateuserdacl AdduserACE Audit servers Configuring Configuring audit flow settings for 9-35,9-43,9-78CA certificate Installing Deleteuserdacl CreateuserdaclNAP Layer 2 NAC 802.1x template Configuring new features in ACS 4.2ACS configuration for Specifying Certificate Binary Comparison forNAC L2 IP NetbiosNAC NAC/NAPRSA ReliabilityReaddacl Readnas Reading dACLs Regional Wlan Related documentationSecurity policies Security protocols Using Windows Certificate Import WizardInstalling the CA certificate Purging Node Secret file purging Sarbanes-OxleySignificance Windows Certificate Import Wizard
Related manuals
Manual 94 pages 10.59 Kb Manual 34 pages 46.13 Kb

4.2 specifications

Cisco Systems, a global leader in IT and networking solutions, has consistently evolved to meet the demands of modern enterprises. One of its noteworthy offerings is Cisco Systems 4.2, a version that embodies a significant leap in networking technology and capability. With its rich set of features, Cisco Systems 4.2 caters to a wide range of industries, facilitating enhanced performance and security.

One of the main features of Cisco Systems 4.2 is its improved scalability. The architecture has been designed to support an ever-increasing number of devices and users, making it ideal for growing enterprises. The enhanced scalability allows organizations to expand their network capacities without compromising performance, ensuring seamless integration of new technologies and devices.

Another critical aspect of Cisco Systems 4.2 is its advanced security protocols. With cyber threats constantly evolving, Cisco prioritizes security in this version by offering robust features such as end-to-end encryption, improved firewall capabilities, and enhanced intrusion detection systems. These security enhancements provide organizations with peace of mind, knowing that their sensitive data and networks are well-protected from unauthorized access and potential threats.

Cisco Systems 4.2 also introduces intelligent automation features, which significantly streamline network management. Through the use of artificial intelligence and machine learning, Cisco enables organizations to automate routine tasks, reduce human error, and optimize performance. This automation not only enhances efficiency but also allows IT teams to focus on strategic initiatives rather than day-to-day maintenance.

Moreover, Cisco Systems 4.2 emphasizes infrastructure flexibility. The new architecture supports various deployment models, including on-premises, cloud, and hybrid environments. This flexibility enables organizations to adapt their networking strategies according to their specific needs and operational requirements, facilitating a more tailored approach to IT infrastructure.

Collaboration tools have also been enhanced in this version. Cisco Systems 4.2 integrates advanced communication solutions that empower teams to collaborate in real time, regardless of their geographical location. Features such as high-definition video conferencing, secure messaging, and file sharing enhance productivity and foster innovation across teams.

In summary, Cisco Systems 4.2 stands out as a forward-thinking networking solution with key features such as scalability, advanced security, intelligent automation, flexible infrastructure, and enhanced collaboration tools. These characteristics position Cisco Systems 4.2 as an invaluable asset for enterprises striving for digital transformation in an increasingly interconnected world. The ongoing innovation reflects Cisco's commitment to delivering cutting-edge technology solutions that drive business success and resilience.