Manuals / Brands / Computer Equipment / Computer Accessories / Cisco Systems / Computer Equipment / Computer Accessories

Cisco Systems CSACS3415K9 - page 64

1 678

Download 678 pages, 9.09 Mb

3-22

User Guide for Cisco Secure Access Control System 5.4

OL-26225-01

Chapter3 ACS 5.x Policy Model

Flows for Configuring Services and Policies

Contents

Main Page CONTENTS Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Preface Audience Document Conventions Documentation Updates Related Documentation Obtaining Documentation and Submitting a Service Request Page Introducing ACS 5.4 Overview of ACS ACS Distributed Deployment ACS 4.x and 5.4 Replication ACS Licensing Model ACS Management Interfaces ACS Web-based Interface ACS Command Line Interface ACS Programmatic Interfaces Hardware Models Supported by ACS Page Migrating from ACS 4.x to ACS 5.4 Overview of the Migration Process Migration Requirements Supported Migration Versions Before You Begin Downloading Migration Files Migrating from ACS 4.x to ACS 5.4 Page Functionality Mapping from ACS 4.x to ACS 5.4 Page Common Scenarios in Migration Migrating from ACS 4.2 on CSACS 1120 to ACS 5.4 Migrating from ACS 3.x to ACS 5.4 Migrating Data from Other AAA Servers to ACS 5.4 Page Page ACS 5.x Policy Model Overview of the ACS 5.x Policy Model Page Policy Terminology Simple Policies Rule-Based Policies Types of Policies Access Services Page Page Identity Policy Page Group Mapping Policy Authorization Policy for Device Administration Processing Rules with Multiple Command Sets Exception Authorization Policy Rules Service Selection Policy Simple Service Selection Rules-Based Service Selection Access Services and Service Selection Scenarios First-Match Rule Tables Page Policy Conditions Policy Results Authorization Profiles for Network Access Processing Rules with Multiple Authorization Profiles Policies and Identity Attributes Policies and Network Device Groups Example of a Rule-Based Policy Flows for Configuring Services and Policies Page Page Page Common Scenarios Using ACS Overview of Device Administration Session Administration Command Authorization TACACS+ Custom Services and Attributes Password-Based Network Access Overview of Password-Based Network Access Page Password-Based Network Access Configuration Flow Page Certificate-Based Network Access Overview of Certificate-Based Network Access Using Certificates in ACS Certificate-Based Network Access Authorizing the ACS Web Interface from Your Browser Using a Certificate Validating an LDAP Secure Authentication Connection Agentless Network Access Overview of Agentless Network Access Host Lookup Authentication with Call Check Process Service-Type Call Check PAP/EAP-MD5 Authentication Agentless Network Access Flow Adding a Host to an Internal Identity Store Configuring an LDAP External Identity Store for Host Lookup Configuring an Identity Group for Host Lookup Network Access Requests Creating an Access Service for Host Lookup Configuring an Identity Policy for Host Lookup Requests Configuring an Authorization Policy for Host Lookup Requests VPN Remote Network Access Supported Authentication Protocols Supported Identity Stores Supported VPN Network Access Servers Supported VPN Clients Configuring VPN Remote Access Service ACS and Cisco Security Group Access Adding Devices for Security Group Access Creating Security Groups Creating SGACLs Configuring an NDAC Policy Configuring EAP-FAST Settings for Security Group Access Creating an Access Service for Security Group Access Creating an Endpoint Admission Control Policy Creating an Egress Policy Creating a Default Policy RADIUS and TACACS+ Proxy Requests Supported Protocols Supported RADIUS Attributes TACACS+ Body Encryption Connection to TACACS+ Server Configuring Proxy Service Understanding My Workspace Welcome Page Task Guides My Account Page Login Banner Using the Web Interface Accessing the Web Interface Logging In Logging Out Understanding the Web Interface Web Interface Design Navigation Pane Content Area Web Interface Location List Pages Page Page Page Secondary Windows Page Page Rule Table Pages Page Importing and Exporting ACS Objects through the Web Interface Supported ACS Objects Page Page Creating Import Files Downloading the Template from the Web Interface Understanding the CSV Templates Creating the Import File Adding Records to the ACS Internal Store Updating the Records in the ACS Internal Store Deleting Records from the ACS Internal Store Common Errors Concurrency Conflict Errors Deletion Errors System Failure Errors Accessibility Display and Readability Features Keyboard and Mouse Features Obtaining Additional Accessibility Information Post-Installation Configuration Tasks Configuring Minimal System Setup Configuring ACS to Perform System Administration Tasks Page Configuring ACS to Manage Access Policies Configuring ACS to Monitor and Troubleshoot Problems in the Network Page Page Managing Network Resources Network Device Groups Creating, Duplicating, and Editing Network Device Groups Deleting Network Device Groups Creating, Duplicating, and Editing Network Device Groups Within a Hierarchy Deleting Network Device Groups from a Hierarchy Network Devices and AAA Clients Viewing and Performing Bulk Operations for Network Devices Exporting Network Devices and AAA Clients Performing Bulk Operations for Network Resources and Users Page Exporting Network Resources and Users Creating, Duplicating, and Editing Network Devices Configuring Network Device and AAA Clients Page Page Displaying Network Device Properties Page Page Deleting Network Devices Configuring a Default Network Device Page Working with External Proxy Servers Creating, Duplicating, and Editing External Proxy Servers Page Deleting External Proxy Servers Working with OCSP Services Creating, Duplicating, and Editing OCSP Servers Page Deleting OCSP Servers Managing Users and Identity Stores Overview Internal Identity Stores External Identity Stores Identity Stores with Two-Factor Authentication Identity Groups Certificate-Based Authentication Identity Sequences Managing Internal Identity Stores Authentication Information Identity Groups Creating Identity Groups Deleting an Identity Group Managing Identity Attributes Standard Attributes User Attributes Host Attributes Configuring Authentication Settings for Users Page Creating Internal Users Page Page Page Deleting Users from Internal Identity Stores Viewing and Performing Bulk Operations for Internal Identity Store Users Creating Hosts in Identity Stores Page Deleting Internal Hosts Viewing and Performing Bulk Operations for Internal Identity Store Hosts Management Hierarchy Attributes of Management Hierarchy Configuring AAA Devices for Management Hierarchy Configuring Users or Hosts for Management Hierarchy Configuring and Using UserIsInManagement Hierarchy Attribute Configuring and Using HostIsInManagement Hierarchy Attributes Managing External Identity Stores LDAP Overview Directory Service Authentication Using LDAP Multiple LDAP Instances Failover LDAP Connection Management Authenticating a User Using a Bind Connection Group Membership Information Retrieval Attributes Retrieval Certificate Retrieval Creating External LDAP Identity Stores Configuring an External LDAP Server Connection Page Configuring External LDAP Directory Organization Page Page Page Deleting External LDAP Identity Stores Configuring LDAP Groups Viewing LDAP Attributes Leveraging Cisco NAC Profiler as an External MAB Database Enabling the LDAP Interface on Cisco NAC Profiler to Communicate with ACS Configuring Endpoint Profiles in NAC Profiler for LDAP Authentication Configuring NAC Profile LDAP Definition in ACS for Use in Identity Policy Page Page Page Troubleshooting MAB Authentication with Profiler Integration Microsoft AD Page Machine Authentication Attribute Retrieval for Authorization Group Retrieval for Authorization Certificate Retrieval for EAP-TLS Authentication Concurrent Connection Management User and Machine Account Restrictions Machine Access Restrictions Distributed MAR Cache MAR Cache Distribution Groups Distributed MAR Cache Operation Distributed MAR Cache Reliability Dial-In Permissions Callback Options for Dial-In users Dial-In Support Attributes Joining ACS to an AD Domain Configuring an AD Identity Store Page Joining Nodes to an AD Domain Disconnecting Nodes from the AD Domain Selecting an AD Group Configuring AD Attributes Page Configuring Machine Access Restrictions AD Deployments with Users Belonging to Large Number of Groups RSA SecurID Server Configuring RSA SecurID Agents Create an Agent Record (sdconf.rec) Reset the Node Secret (securid) Override Automatic Load Balancing Manually Intervene to Remove a Down RSA SecurID Server Creating and Editing RSA SecurID Token Servers Configuring ACS Instance Settings Editing ACS Instance Settings Configuring Advanced Options RADIUS Identity Stores Supported Authentication Protocols Failover Password Prompt User Group Mapping Groups and Attributes Mapping RADIUS Identity Store in Identity Sequence Authentication Failure Messages Username Special Format with Safeword Server User Attribute Cache Creating, Duplicating, and Editing RADIUS Identity Servers Configuring General Settings Page Configuring Shell Prompts Configuring Directory Attributes Configuring Advanced Options Configuring CA Certificates Adding a Certificate Authority Editing a Certificate Authority and Configuring Certificate Revocation Lists Deleting a Certificate Authority Exporting a Certificate Authority Configuring Certificate Authentication Profiles Page Configuring Identity Store Sequences Creating, Duplicating, and Editing Identity Store Sequences Page Deleting Identity Store Sequences Page Page Managing Policy Elements Managing Policy Conditions Page Creating, Duplicating, and Editing a Date and Time Condition Page Creating, Duplicating, and Editing a Custom Session Condition Deleting a Session Condition Managing Network Conditions Page Importing Network Conditions Exporting Network Conditions Creating, Duplicating, and Editing End Station Filters Page Page Creating, Duplicating, and Editing Device Filters Page Page Creating, Duplicating, and Editing Device Port Filters Page Managing Authorizations and Permissions Creating, Duplicating, and Editing Authorization Profiles for Network Access Specifying Authorization Profiles Specifying Common Attributes in Authorization Profiles Page Page Specifying RADIUS Attributes in Authorization Profiles Page Creating and Editing Security Groups Creating, Duplicating, and Editing a Shell Profile for Device Administration Page Defining General Shell Profile Properties Defining Common Tasks Page Page Defining Custom Attributes Creating, Duplicating, and Editing Command Sets for Device Administration Page Page Creating, Duplicating, and Editing Downloadable ACLs Deleting an Authorizations and Permissions Policy Element Configuring Security Group Access Control Lists Managing Access Policies Policy Creation Flow Network Definition and Policy Goals Policy Elements in the Policy Creation Flow Access Service Policy Creation Service Selection Policy Creation Customizing a Policy Configuring the Service Selection Policy Configuring a Simple Service Selection Policy Service Selection Policy Page Page Creating, Duplicating, and Editing Service Selection Rules Page Displaying Hit Counts Deleting Service Selection Rules Configuring Access Services Editing Default Access Services Creating, Duplicating, and Editing Access Services Configuring General Access Service Properties Page Page Configuring Access Service Allowed Protocols Page Page Page Configuring Access Services Templates Deleting an Access Service Configuring Access Service Policies Viewing Identity Policies Page Viewing Rules-Based Identity Policies Configuring Identity Policy Rule Properties Page Configuring a Group Mapping Policy Page Configuring Group Mapping Policy Rule Properties Configuring a Session Authorization Policy for Network Access Page Configuring Network Access Authorization Rule Properties Configuring Device Administration Authorization Policies Configuring Device Administration Authorization Rule Properties Configuring Device Administration Authorization Exception Policies Configuring Shell/Command Authorization Policies for Device Administration Configuring Authorization Exception Policies Page Creating Policy Rules Duplicating a Rule Editing Policy Rules Deleting Policy Rules Configuring Compound Conditions Compound Condition Building Blocks Types of Compound Conditions Page Page Using the Compound Expression Builder Security Group Access Control Pages Egress Policy Matrix Page Editing a Cell in the Egress Policy Matrix Defining a Default Policy for Egress Policy Page NDAC Policy Page NDAC Policy Properties Page Page Network Device Access EAP-FAST Settings Page Maximum User Sessions Max Session User Settings Max Session Group Settings Max Session Global Setting Purging User Sessions Maximum User Session in Distributed Environment Maximum User Session in Proxy Scenario Monitoring and Reporting in ACS Authentication Records and Details Dashboard Pages Page Working with Portlets Working with Authentication Lookup Portlet Running Authentication Lookup Report Configuring Tabs in the Dashboard Adding Tabs to the Dashboard Adding Applications to Tabs Renaming Tabs in the Dashboard Changing the Dashboard Layout Deleting Tabs from the Dashboard Managing Alarms Understanding Alarms Evaluating Alarm Thresholds Notifying Users of Events Viewing and Editing Alarms in Your Inbox Page Page Page Page Page Understanding Alarm Schedules Creating and Editing Alarm Schedules Assigning Alarm Schedules to Thresholds Deleting Alarm Schedules Creating, Editing, and Duplicating Alarm Thresholds Page Configuring General Threshold Information Configuring Threshold Criteria Passed Authentications Page Failed Authentications Page Authentication Inactivity TACACS Command Accounting TACACS Command Authorization ACS Configuration Changes ACS System Diagnostics ACS Process Status ACS System Health ACS AAA Health RADIUS Sessions Unknown NAD External DB Unavailable RBACL Drops Page NAD-Reported AAA Downtime Configuring Threshold Notifications Deleting Alarm Thresholds Configuring System Alarm Settings Understanding Alarm Syslog Targets Creating and Editing Alarm Syslog Targets Deleting Alarm Syslog Targets Managing Reports Page Working with Favorite Reports Adding Reports to Your Favorites Page Viewing Favorite-Report Parameters Editing Favorite Reports Running Favorite Reports Deleting Reports from Favorites Sharing Reports Working with Catalog Reports Available Reports in the Catalog Page Page Page Running Catalog Reports Deleting Catalog Reports Running Named Reports Understanding the Report_Name Page Page Page Enabling RADIUS CoA Options on a Device Changing Authorization and Disconnecting Active RADIUS Sessions Customizing Reports Restoring Reports Viewing Reports About Standard Viewer About Interactive Viewer About the Interactive Viewer Context Menus Navigating Reports I Using the Table of Contents Exporting Report Data Page Printing Reports Saving Report Designs in Interactive Viewer Formatting Reports in Interactive Viewer Editing Labels Formatting Labels Formatting Data Resizing Columns Changing Column Data Alignment Formatting Data in Columns Formatting Data in Aggregate Rows Formatting Data Types Formatting Numeric Data Formatting Fixed or Scientific Numbers or Percentages Formatting Custom Numeric Data Formatting String Data Formatting Custom String Data Page Formatting Date and Time Formatting Custom Date and Time Formatting Boolean Data Applying Conditional Formats Setting Conditional Formatting for Columns Page Deleting Conditional Formatting Setting and Removing Page Breaks in Detail Columns Setting and Removing Page Breaks in a Group Column Organizing Report Data Displaying and Organizing Report Data Reordering Columns in Interactive Viewer Moving Data Values from Columns to Group Headers Page Removing Columns Hiding or Displaying Report Items Hiding Columns Displaying Hidden Columns Merging Columns Page Selecting a Column from a Merged Column Sorting Data Sorting a Single Column Sorting Multiple Columns Page Grouping Data Adding Groups Grouping Data Based on Date or Time Removing an Inner Group Creating Report Calculations Understanding Supported Calculation Functions Page Page Page Page Page Page Page Understanding Supported Operators Using Numbers and Dates in an Expression Using Multiply Values in Calculated Columns Adding Days to an Existing Date Value Subtracting Date Values in a Calculated Column Working with Aggregate Data Page Creating an Aggregate Data Row Adding Additional Aggregate Rows Deleting Aggregate Rows Hiding and Filtering Report Data Hiding or Displaying Column Data Suppressing Repeated Values Displaying Repeated Values Hiding or Displaying Detail Rows in Groups or Sections Working with Filters Types of Filter Conditions Setting Filter Values Creating Filters Modifying or Clearing a Filter Creating a Filter with Multiple Conditions Page Deleting One Filter Condition in a Filter that Contains Multiple Conditions Filtering Highest or Lowest Values in Columns Understanding Charts Modifying Charts Filtering Chart Data Changing Chart Subtype Changing Chart Formatting Page Page Troubleshooting ACS with the Monitoring and Report Viewer Available Diagnostic and Troubleshooting Tools Connectivity Tests ACS Support Bundle Expert Troubleshooter Performing Connectivity Tests Downloading ACS Support Bundles for Diagnostic Information Page Working with Expert Troubleshooter Troubleshooting RADIUS Authentications Page Page Page Executing the Show Command on a Network Device Evaluating the Configuration of a Network Device Page Comparing SGACL Policy Between a Network Device and ACS Comparing the SXP-IP Mappings Between a Device and its Peers Page Page Comparing IP-SGT Pairs on a Device with ACS-Assigned SGT Records Comparing Device SGT with ACS-Assigned Device SGT Page Page Managing System Operations and Configuration in the Monitoring and Report Viewer Page Configuring Data Purging and Incremental Backup Page Page Page Configuring NFS Staging Restoring Data from a Backup Viewing Log Collections Page Log Collection Details Page Page Recovering Log Messages Viewing Scheduled Jobs Page Viewing Process Status Viewing Data Upgrade Status Viewing Failure Reasons Editing Failure Reasons Specifying E-Mail Settings Configuring SNMP Preferences Understanding Collection Filters Creating and Editing Collection Filters Deleting Collection Filters Configuring System Alarm Settings Configuring Alarm Syslog Targets Configuring Remote Database Settings Page Changing the Port Numbers for Oracle Database Managing System Administrators Understanding Administrator Roles and Accounts Understanding Authentication Configuring System Administrators and Accounts Understanding Roles Assigning Roles Assigning Static Roles Assigning Dynamic Roles Permissions Predefined Roles Changing Role Associations Administrator Accounts and Role Association Recovery Administrator Account Creating, Duplicating, Editing, and Deleting Administrator Accounts Page Viewing Predefined Roles Viewing Role Properties Configuring Authentication Settings for Administrators Page Configuring Session Idle Timeout Configuring Administrator Access Settings Working with Administrative Access Control Administrator Identity Policy Viewing Rule-Based Identity Policies Page Configuring Identity Policy Rule Properties Administrator Authorization Policy Configuring Administrator Authorization Policies Configuring Administrator Authorization Rule Properties Administrator Login Process Resetting the Administrator Password Changing the Administrator Password Changing Your Own Administrator Password Resetting Another Administrators Password Page Configuring System Operations Understanding Distributed Deployment Activating Secondary Servers Removing Secondary Servers Promoting a Secondary Server Understanding Local Mode Understanding Full Replication Specifying a Hardware Replacement Scheduled Backups Creating, Duplicating, and Editing Scheduled Backups Page Backing Up Primary and Secondary Instances Synchronizing Primary and Secondary Instances After Backup and Restore Editing Instances Viewing and Editing a Primary Instance Page Page Page Viewing and Editing a Secondary Instance Deleting a Secondary Instance Activating a Secondary Instance Registering a Secondary Instance to a Primary Instance Page Page Deregistering Secondary Instances from the Distributed System Management Page Deregistering a Secondary Instance from the Deployment Operations Page Promoting a Secondary Instance from the Distributed System Management Page Promoting a Secondary Instance from the Deployment Operations Page Replicating a Secondary Instance from a Primary Instance Replicating a Secondary Instance from the Distributed System Management Page Replicating a Secondary Instance from the Deployment Operations Page Changing the IP address of a Primary Instance from the Primary Server Failover Using the Deployment Operations Page to Create a Local Mode Instance Creating, Duplicating, Editing, and Deleting Software Repositories Managing Software Repositories from the Web Interface and CLI Page Managing System Administration Configurations Configuring Global System Options Configuring TACACS+ Settings Configuring EAP-TLS Settings Configuring PEAP Settings Configuring EAP-FAST Settings Generating EAP-FAST PAC Configuring RSA SecurID Prompts Managing Dictionaries Viewing RADIUS and TACACS+ Attributes Creating, Duplicating, and Editing RADIUS Vendor-Specific Attributes Creating, Duplicating, and Editing RADIUS Vendor-Specific Subattributes Page Viewing RADIUS Vendor-Specific Subattributes Configuring Identity Dictionaries Creating, Duplicating, and Editing an Internal User Identity Attribute Configuring Internal Identity Attributes Deleting an Internal User Identity Attribute Creating, Duplicating, and Editing an Internal Host Identity Attribute Deleting an Internal Host Identity Attribute Adding Static IP address to Users in Internal Identity Store Configuring Local Server Certificates Adding Local Server Certificates Importing Server Certificates and Associating Certificates to Protocols Generating Self-Signed Certificates Generating a Certificate Signing Request Binding CA Signed Certificates Editing and Renewing Certificates Deleting Certificates Exporting Certificates Viewing Outstanding Signing Requests Configuring Logs Configuring Remote Log Targets Page Deleting a Remote Log Target Configuring the Local Log Deleting Local Log Data Configuring Logging Categories Configuring Global Logging Categories Page Page Viewing ADE-OS Logs Configuring Per-Instance Logging Categories Configuring Per-Instance Security and Log Settings Configuring Per-Instance Remote Syslog Targets Displaying Logging Categories Configuring the Log Collector Viewing the Log Message Catalog Licensing Overview Types of Licenses Installing a License File Viewing the Base License Upgrading the Base Server License Viewing License Feature Options Adding Deployment License Files Deleting Deployment License Files Available Downloads Downloading Migration Utility Files Downloading UCP Web Service Files Downloading Sample Python Scripts Downloading Rest Services Understanding Logging About Logging Using Log Targets Logging Categories Page Global and Per-Instance Logging Categories Log Message Severity Levels Local Store Target Page Critical Log Target Remote Syslog Server Target Page Monitoring and Reports Server Target Viewing Log Messages Debug Logs ACS 4.x Versus ACS 5.4 Logging Page Page A AAA Protocols Typical Use Cases Device Administration (TACACS+) Session Access Requests (Device Administration [TACACS+]) Network Access (RADIUS With and Without EAP) RADIUS-Based Flow Without EAP Authentication RADIUS-Based Flows with EAP Authentication Page Access ProtocolsTACACS+ and RADIUS Overview of TACACS+ Overview of RADIUS RADIUS VSAs ACS 5.4 as the AAA Server RADIUS Attribute Support in ACS 5.4 RADIUS Attribute Rewrite Operation Add Attribute Update Attribute Delete Attribute RADIUS Access Requests Page B Authentication in ACS 5.4 Authentication Considerations Authentication and User Databases PAP RADIUS PAP Authentication EAP Page EAP-MD5 Overview of EAP-MD5 EAP- MD5 Flow in ACS 5.4 EAP-TLS Overview of EAP-TLS User Certificate Authentication PKI Authentication PKI Credentials PKI Usage Fixed Management Certificates Importing Trust Certificates Acquiring Local Certificates Importing the ACS Server Certificate Initial Self-Signed Certificate Generation Certificate Generation Exporting Credentials Credentials Distribution Hardware Replacement and Certificates Securing the Cryptographic Sensitive Material Private Keys and Passwords Backup EAP-TLS Flow in ACS 5.4 Host Network device ACS EAP-TLS server 1 2 3 4 5 PEAPv0/1 Overview of PEAP Supported PEAP Features Server Authenticated and Unauthenticated Tunnel Establishment Modes Fast Reconnect Session Resume Protected Exchange of Arbitrary Parameters Cryptobinding TLV Extension PEAP Flow in ACS 5.4 Creating the TLS Tunnel Authenticating with MSCHAPv2 EAP-FAST Overview of EAP-FAST Page EAP-FAST Benefits EAP-FAST in ACS 5.4 About Master-Keys About PACs Provisioning Modes Types of PACs Automatic In-Band PAC Provisioning Manual PAC Provisioning ACS-Supported Features for PACs Page Master Key Generation and PAC TTLs EAP-FAST for Allow TLS Renegotiation EAP-FAST Flow in ACS 5.4. EAP-FAST PAC Management Key Distribution Algorithm EAP-FAST PAC-Opaque Packing and Unpacking Revocation Method PAC Migration from ACS 4.x EAP Authentication with RADIUS Key Wrap EAP-MSCHAPv2 Overview of EAP-MSCHAPv2 MSCHAPv2 for User Authentication MSCHAPv2 for Change Password Windows Machine Authentication Against AD EAP- MSCHAPv2 Flow in ACS 5.4 CHAP LEAP Certificate Attributes Certificate Binary Comparison Rules Relating to Textual Attributes Certificate Revocation Machine Authentication Authentication Protocol and Identity Store Compatibility Page Page C Open Source License Acknowledgements Notices OpenSSL/Open SSL Project License Issues Page Page Page GLOSSARY A Page B C Page Page D Page E F G H I J K L M N P Page R S Page T U V W X Page INDEX Symbols A B C D E F G H I L M N O P Q R S T U V W