Configuration Guide for Cisco Secure ACS
Americas Headquarters
Page
 N T E N T S
 Deploying ACS in a NAC/NAP Environment
 Error Messages
 Overview
 Profile Setup
 Profile Setup
 Audience
Organization
 Convention
Conventions
Product Documentation
Boldface font
 Available Formats
 ACSTroubleshooting.html
Related Documentation
 OpenSSL/Open SSL Project
License Issues
OpenSSL License
 Original SSLeay License
 Overview of ACS Configuration
Summary of Configuration Steps
 Click Interface Configuration
Click System Configuration
 Peap EAP-FAST EAP-TLS Leap EAP-MD5
 Overview of ACS Configuration Summary of Configuration Steps
 Configuration Flowchart
EAP-TLS, SSL
 OL-14390-02
 Deploy the Access Control Servers
Determining the Deployment Architecture
 Wired LAN Access
Access Types
Size Users
 Small LAN Environment
Campus LAN
 Geographically Dispersed Wired LAN
ACS in a Campus LAN
 Wireless Access Topology
Simple Wlan
 Campus Wlan
 Regional Wlan Setting
 Large Enterprise Wlan Setting
6shows a regional Wlan
 Dial-up Access Topology
Small Dial-Up Network Access
 Large Dial-Up Network Access
Small Dial-up Network
 Determining How Many ACSs to Deploy Scalability
Placement of the Radius Server
Number of Users
 LAN Versus WAN Deployment Number of LANs in the Network
Number of Network Access Servers
WAN Latency and Dependability
 Load Balancing and Failover
Configuration components for replication-What is replicated
Deploying ACS Servers to Support Server Failover
Database Replication Considerations
 Database Synchronization Considerations
Replication Design
 ACS
Deploying ACS in a NAC/NAP Environment
Component Description
Cisco AAA server product
 Remote Access Policy
Additional Topics
 Administrative Access Policy
Security Policy
 Separation of Administrative and General Users
 Number of Users
Database Considerations
Network Latency and Reliability
Type of Database
 OL-14390-02
 Configuring New Features in ACS
New Global EAP-FAST Configuration Options
 Option Description
PAC
 Use PAC and Do Not Use PAC Options
 Disabling NetBIOS
2shows the new options on the NAP Protocols
 Right-clickMy Network Places and choose Properties
Configuring ACS 4.2 Enhanced Logging Features
To disable NetBIOS over TCP/ IP in Windows 2000, XP, or
Click Internet Protocol TCP/IP and choose Properties
 Configuring Group Filtering at the NAP Level
Click Submit
 Option to Not Log or Store Dynamic Users
Configuring Syslog Time Format in ACS
Check the Disable Dynamic users check box
Active Directory Multi-Forest Support
 RSA Support on the ACS SE
Click Database Configuration
Click Submit and Restart
 Click RSA SecureID Token Server
Click Create New Configuration
Click Configure
Click Upload scconf.rec
 Purging the RSA Node Secret File
FTP Server Login Password Directory
External User Databases Configuration page opens
Field
 Click Purge Node Secret
Configuring RSA SecurID Token and Ldap Group Mapping
Click Configure Ldap
Click RSA SecurID Token and Ldap Group Mapping
 RSA SecurID Token and Ldap Group Mapping Configuration
Choose Process all usernames
 Configuring New Features in ACS RSA Support on the ACS SE
 Configuring New Features in ACS RSA Support on the ACS SE
 Uid=joesmith,ou=members,ou=administrators,o=cisco
 Turning Ping On and Off
 New Rdbms Synchronization Features in ACS Release
ACS 4.2 provides enhanced support for Rdbms Synchronization
 Create a Text File to Define the dACLs
Using Rdbms Synchronization to Configure dACLs
Enable dACLs
Check the Rdbms Synchronization check box
 Code the information in the file as described in Table
Example 4-1shows a sample text file
Keyword Value
 Sample accountActions CSV File
Example 4-2shows a sample accountActions CSV file
 Action Code Name Required Description
Configure Rdbms Synchronization to Use a Local CSV File
Click Rdbms Synchronization
 Rdbms Synchronization Setup Page ACS for Windows
 Configuration Guide for Cisco Secure ACS OL-14390-02
 Running CSDBSync Manually to Create the dACLs
Perform Rdbms Synchronization
Running Rdbms Synchronization from the ACS GUI
ACS for Windows
 Performing Rdbm Synchronization Using a Script
View the dACLs
 Entry for the Sample dACL
 Explanation
Error Messages
NAF
 Enabled correctly in the ACS GUI
User has write access to the ACS
On the ACS is configured correctly
Reading, Updating, and Deleting dACLs
 Daclreplace
Updatedacl
Readdacl
Deletedacl
 Updateuserdacl UNGN, VN
Deleteuserdacl Ungn
 Creating, Reading, Updating and Deleting AAA clients
Updatenas
Readnas
 OL-14390-02
 Password Policy Configuration Scenario
 Add and Edit a New Administrator Account
 Administration Control
 To specify password restrictions
Configure Password Policy
Server 4.2, Administrators and Administrative Policy
Privileges that you want to grant
 Administrator Password Policy Setup
 Password Lifetime Options
Specify Password Validation Options
Specify Password Lifetime Options
Password Inactivity Options
 Specify Incorrect Password Attempt Options
Configure Session Policy
Specify Password Inactivity Options
Incorrect Password Attempt Options section, configure
 Session Policy Setup
 Access Policy Setup page appears, as shown in Figure
Configure Access Policy
Click Access Policy
Before You Begin
 Access Policy Setup
Click the appropriate IP Address Filtering option
 Range includes the Start and End IP addresses
IP Address Ranges table contains ten rows for configuring
IP address ranges. The ranges are always inclusive that is,
Must differ only in the last octet Class C format
 Installation process. With SSL enabled, ACS begins using
Viewing Administrator Entitlement Reports
Configuration ACS Certificate Setup to access
Displays an error
 View Privilege Reports
Click Entitlement Reports
 OL-14390-02
 Agentless Host Support Configuration Scenario
Overview of Agentless Host Support
 Using Audit Servers and Game Group Feedback
1shows the flow of MAB information
 Configure a Radius AAA client
See Configure a Radius AAA Client, page 6-5for details
 Basic Configuration Steps for Agentless Host Support
Install ACS
 Configure a Radius AAA Client
 Install and Set Up an ACS Security Certificate
Click Submit + Apply
 Obtain Certificates and Copy Them to the ACS Host
Go to selecteddrive\Certs
 Click ACS Certificate Setup Click Install ACS Certificate
Enable Security Certificates on the ACS Installation
Select Install Certificate
Click Submit
 To install the CA Certificate
Install the CA Certificate
Add a Trusted Certificate
 Configure an External Ldap Database for MAB Support
Configure Ldap Support for MAB
Create one or more Ldap database configurations in ACS
 Description of the Settings in the Sample Ldap Schema
802.1x device n 802.1x device n+1
 How the Subtrees Work
How the Ldap User Groups Work
 1describes the attributes of the sample Ldap groups
Create One or More Ldap Database Configurations in ACS
Click Generic Ldap
 Specify the common Ldap configuration
6shows the Common Ldap Configuration section
 OL-14390-02
 Ldap Server Configuration Sections
ACS SE Only
 Configure User Groups for MAB Segments
 Create a New NAP
Enable Agentless Request Processing
Click Add Profile
 Profile Setup page opens, shown in Figure
Profile Setup
 You are now ready to enable agentless request processing
Enable Agentless Request Processing for a NAP
Check the check box for Allow Agentless Request Processing
 Configure MAB
You are now ready to configure MAB settings
 Click Internal ACS DB
13 MAC Address Input Area
 Configure Logging and Reports
Configuring Reports for MAB Processing
 Configuration Steps for Audit Server Support
Configure Game Group Feedback
 Configure global authentication settings
Configure Security Certificates
To configure PEAP-TLS Configure security certificates
Specify EAP-TLS options
 Obtain Certificates and Copy Them to the ACS Host
 Enable Security Certificates on the ACS Installation
 Install the CA Certificate
Add a Trusted Certificate
 Click Global Authentication Setup
Configure Global Authentication Settings
Global Authentication Setup page opens, as shown in Figure
 Specify EAP-TLS Options
Optional Configure Authentication Policy
EAPMSCHAP2 EAP-GTC
 Click Logging
Configuring Syslog Logging
Overview
Logging page opens, shown in Figure
 Logging Configuration
 Enable Logging
 Format of Syslog Messages in ACS Reports
Facility Codes
 Message Length Restrictions
 OL-14390-02
 NAC Configuration Scenario
Install ACS
 Perform Network Configuration Tasks
This section describes
 Add AAA Client
 Configure the AAA Server
 Click Submit and Apply
Set Up System Configuration
This section describes the following tasks
 Click ACS Certificate Setup
Set Up the ACS Certification Authority
Click ACS Certification Authority Setup
 Choose ACS Certificate Setup Edit Certificate Trust List
Edit the Certificate Trust List
 Install ACS Certificate page opens, as shown in Figure
Set Up Global Configuration
Install the ACS Certificate
Click the Read certificate from file radio button
 Set Up Global Authentication
Global Authentication Setup Page appears, as shown in Figure
 Global Authentication Setup
 Allow Posture Validation
Allow EAP-MSCHAPv2
Allow EAP-GTC
Click Submit + Restart
 Click EAP-FAST Configuration
Set Up EAP-FAST Configuration
EAP Fast Configuration page appears, as shown in Figure
 -8, this is ACS NAC Server. However, this can be any string
Check the Allow EAP-FASTcheck box
Provisioning check boxes
 Configure Logs and Reports
Configure the Logging Level
Click Service Control
 Check the Log to CSV Passed Authentications Report check box
 Check the Log to CSV Radius Accounting Report check box
 Click Add Administrator
Set Up Administration Control
Add Remote Administrator Access
Add Administrator page opens, as shown in Figure
 10 Add Administrator
 Click Grant All
 Configure Network Access Filtering Optional
Set Up Shared Profile Components
Click Network Access Filtering
 Configure Downloadable IP ACLs
11 Edit Network Access Filtering
 Choose Shared Profile Components Downloadable IP ACLs
Adding an ACL
To add a new ACL
List of dACLs appears, as shown in Figure
 Adding an ACE
13 Downloadable IP ACLs
 14 Downloadable IP ACL Content
 Saving the dACL
Configure Radius Authorization Components
New ACL appears on the list of downloadable ACLs
 Click Radius Authorization Components
16 Radius Authorization Components
 17 RAC Attribute Add/Edit
 18 Attribute Selection for the CiscoFullAccess RAC
 19 Attribute Selection for the CiscoRestricted RAC
 Number Attribute Name Description
Attribute
ACL
 Configure an External Posture Validation Audit Server
Add the Posture Attribute to the ACS Dictionary
 Configure the External Posture Validation Audit Server
Click Add Server
 20 External Posture Validation Audit Server Setup
 21 Use These Audit Servers Section
 Configure Posture Validation for NAC
Configure Internal Posture Validation Policies
 Click Internal Posture Validation Setup
Click Add Rule
 Click Add Condition Set
Add/Edit Condition page appears, as shown in Figure
 Configure External Posture Validation Policies
26 Edit External Posture Validation Servers
 27 Add/Edit External Posture Validation Server
 Configure an External Posture Validation Audit Server
 28 External Posture Validation Audit Server Setup
 29 Use These Audit Servers Section
 Authorization Policy and NAC Audit
30 Audit Flow Settings and Game Group Feedback Sections
 Sample NAC Layer 3 Profile Template
Set Up Templates to Create NAPs
Sample NAC Profile Templates
EAP-FAST GTC
 Profile Setup
31 Create Profile From Template
 32 Profile Setup Page for Layer 3 NAC Template
 EAP Configuration section, Posture Validation is enabled
Protocols Policy for the NAC Layer 3 Template
 Authentication Policy
34 Authentication Page for Layer 3 NAC Profile Template
 Sample Posture Validation Rule
Sample NAC Layer 2 Template
From the Template drop-down list, choose NAC L2 IP
 To enable the profile setup
Go to Network Access Profiles
 36 Profile Setup Page for NAC Layer 2 Template
 Default ACLs
ACS and Attribute-Value Pairs
 Protocols Settings
37shows the Protocols settings for the NAC Layer 2 template
 38 Authentication Settings for NAC Layer 2 Template
 Sample NAC Layer 2 802.1x Template
39 Sample Posture Validation Policy for NAC Layer 2 Template
 40 Create Profile From Template
 41 Profile Setup Page for NAC Layer 2 802.1x Template
 42 Protocols Setting for NAC Layer 802.1x Template
Protocols Policy
 Authorization Policy
 Sample Wireless NAC L2 802.1x Template
 45 Create Profile From Template
 46 Profile Setup Page for Wireless NAC L2 802.1xTemplate
 47 Protocols Setting for Wireless NAC 802.1x Template
 Authorization Policy
 Using a Sample Agentless Host Template
 50 Create Profile From Template
 Profile Setup
 52 Protocols Setting for Agentless Host for Layer 3 Template
 Choose the relevant profile Posture Validation policy
Choose Network Access Profiles
Map Posture Validation Components to Profiles
Enter a Name for the rule
 Click Back to return to the Posture Validation policy
Click Apply + Restart
 Check the Allow Agentless Request Processing check box
Check the Do not reject when Audit failed check box
Map an Audit Server to a Profile
Click Select Audit
 Configure an external audit server
Optional Configure Game Group Feedback
Click Apply and Restart
 Import a Device-Type Attribute File by Using CSUtil
Import an Audit Vendor File by Using CSUtil
Import NAC Attribute-Value Pairs
 Configure an External Audit Server
Configure Database Support for Agentless Host Processing
Enable Posture Validation
Restart ACS Navigation bar, click System Configuration
 \ACSInstallDir\bin\CSUtil -addAVP filename
 56 External Posture Validation Audit Server Setup
 57 Use These Audit Servers Section
 58 Audit Flow Settings and Game Group Feedback Sections
 Enable Game Group Feedback
ACS Solution Engine
 Mac Integrated Device
Unix
PDA
 Resource usage
Being authenticated
Authentication agent installed, such as Cisco Trust Agent
Posture-validation server
 Authenticate the device, instead of using an IP address
GL-2
 GL-3
 Microsoft, and RSA Security submitted to the Ietf
Network access
Radius Attribute Component
 Adduser
Updatenas Updateuserdacl
ACE
 Configuring audit flow settings for 9-35,9-43,9-78
Audit servers Configuring
CA certificate Installing
 Createuserdacl
Deleteuserdacl
NAP
 Specifying Certificate Binary Comparison for
Configuring new features in ACS 4.2
ACS configuration for
Layer 2 NAC 802.1x template
 NAC/NAP
Netbios
NAC
NAC L2 IP
 Reading dACLs Regional Wlan Related documentation
Reliability
Readdacl Readnas
RSA
 Purging Node Secret file purging Sarbanes-Oxley
Using Windows Certificate Import Wizard
Installing the CA certificate
Security policies Security protocols
 Significance Windows Certificate Import Wizard