Manuals / Cisco Systems / Photography / Camera Accessories

Cisco Systems OL-24201-01 Hardware Models Supported by ACS, ACS Programmatic Interfaces, Config

Models: OL-24201-01

1 650

Download 650 pages 53.38 Kb

Page 31

Chapter 1 Introducing ACS 5.3

Hardware Models Supported by ACS

For information about using the CLI, see the Command Line Interface Reference Guide for Cisco Secure Access Control System 5.3.

Related Topic

•ACS Web-based Interface, page 1-4

ACS Programmatic Interfaces

ACS 5.3 provides web services and command-line interface (CLI) commands that allow software developers and system integrators to programmatically access some ACS features and functions. ACS

5.3also provides you access to the Monitoring & Report Viewer database that you can use to create custom applications to monitor and troubleshoot ACS.

The UCP web service allows users, defined in the ACS internal database, to first authenticate and then change their own password. ACS exposes the UCP web service to allow you to create custom web-based applications that you can deploy in your enterprise.

The Monitoring & Report Viewer web services allow you to create custom applications to track and troubleshoot events in ACS.

You can develop shell scripts using the CLI commands that ACS offers to perform create, read, update, and delete (CRUD) operations on ACS objects. You can also create an automated shell script to perform bulk operations.

The REST PI (Representational State Transfer Programming Interface) allows you to manage your entities such as users, devices and policies on your own management applications and move these entities into ACS. This way you can define these entities and then use them on your own systems and on ACS.

For more information on how to access these web services and their functionalities, see

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.3/sdk/ acs_sdk.html.

Hardware Models Supported by ACS

Table 1-2shows the details of the CAM hardware models supported by ACS 5.3.

Table 1-2	CAM Hardware Models Supported by ACS 5.3

Config		HDD	RAM	NIC

IBM 1121		2 x 250GB	4GB	4X10,100,1000 RJ-45

CAM25-1-2-4.		2 x 250GB	4 x 1GB	2 x 1GE

VMWare ESX 3.5, 4.0,		500GB	4GB	2 NICs
4.1, i4.1, or 5.0

VMWare Server 2.0		60GB	4GB	1 or 2 virtual NICs

User Guide for Cisco Secure Access Control System 5.3

	OL-24201-01	1-5

Image 31

Cisco Systems OL-24201-01 Hardware Models Supported by ACS, ACS Programmatic Interfaces, ACS Web-based Interface, Config

Contents

Americas Headquarters User Guide for Cisco Secure Access Control SystemPage Iii N T E N T SRules-Based Service Selection Configuring an Authorization Policy for Host Lookup Requests My Account Vii Exporting Network Devices and AAA ClientsViii FailoverRadius Identity Store in Identity Sequence Managing Access Policies Maximum User Session in Distributed Environment Xii Creating and Editing Alarm SchedulesXiii Exporting Report DataXiv Adding GroupsFiltering Chart Data Xvi Managing System AdministratorsXvii Activating a Secondary InstanceXviii Configuring LogsXix Using Log TargetsPKI Usage Xxi EAP-MSCHAPv2 B-30Xxii Document Conventions AudienceRevised April 17 Store Documentation UpdatesRelated Documentation Date DescriptionObtaining Documentation and Submitting a Service Request Preface User Guide for Cisco Secure Access Control System Overview of ACS Introducing ACSRelated Topic ACS Distributed DeploymentACS 4.x and 5.3 Replication Related TopicsACS Management Interfaces ACS Licensing ModelACS ACS Web-based Interface ACS Command Line InterfaceACS Web-based Interface, ConfigHardware Models Supported by ACS ACS Programmatic InterfacesOL-24201-01 Migrating from ACS 4.x to ACS Migration Requirements, Supported Migration Versions, Overview of the Migration ProcessMigration Requirements Supported Migration VersionsMigrating from ACS 4.x to ACS Select System Administration Downloads Migration UtilityBefore You Begin Downloading Migration FilesMigrating from ACS 4.x to ACS Functionality Mapping from ACS 4.x to ACS Radius VSA Common Scenarios in MigrationMigrating from ACS 4.2 on Csacs 1120 to ACS Radius VSAMigrating Data from Other AAA Servers to ACS Migrating from ACS 3.x to ACSMigrating from ACS 4.x to ACS Common Scenarios in Migration OL-24201-01 Overview of the ACS 5.x Policy Model ACS 5.x Policy ModelInformation in ACS 5.3 Policy Element Term Description Policy TerminologyRule-Based Policies Simple PoliciesTypes of Policies, Types of Policies Policy Type Access ServicesRadius and TACACS+ Proxy Services Access Service B Access Service C Access Service aFor Device Administration Hosts Wireless Devices Access Service TemplatesFeature ACS Identity Policy Failure Options Processing Rules with Multiple Command Sets Authorization Policy for Device AdministrationGroup Mapping Policy Simple Service Selection, Rules-Based Service Selection, Service Selection PolicySimple Service Selection Exception Authorization Policy RulesAccess Services and Service Selection Scenarios Rules-Based Service SelectionExample Policy Rule Table First-Match Rule TablesColumn Description Policy Conditions Authorization Profiles for Network AccessPolicy Results Policies and Identity Attributes Processing Rules with Multiple Authorization ProfilesExample of a Rule-Based Policy Policies and Network Device GroupsPrerequisites Flows for Configuring Services and PoliciesEditing a Custom Session Condition, Editing Access Services,Customizing a Policy, Configuring Access Service Policies, Step Action Drawer in Web InterfaceRelated Topics OL-24201-01 Common Scenarios Using ACS Overview of Device Administration Session Administration Command Authorization TACACS+ Custom Services and Attributes Password-Based Network AccessOverview of Password-Based Network Access PEAP-GTC RADIUS-PAP RADIUS-CHAPEAP-FAST-GTC EAP-MD5 Leap Radius Chap Password-Based Network Access Configuration FlowProtocol Action MAB Radius PAPEAP-MSCHAPv2 or EAP-GTC or both PeapEAP-FAST Overview of Certificate-Based Network Access Certificate-Based Network AccessEAP-TLS Using Certificates in ACSCertificate-Based Network Access for EAP-TLS Before you BeginUser Guide for Cisco Secure Access Control System Overview of Agentless Network Access Agentless Network AccessValidating an Ldap Secure Authentication Connection Use Cases Attribute Host Lookup802.1x Authentication with Call Check Process Service-Type Call Check PAP/EAP-MD5 AuthenticationFor more information, see , Managing Policy Elements Agentless Network Access FlowNext Step Configuring an Ldap External Identity Store for Host LookupAdding a Host to an Internal Identity Store Previous StepManaging Identity Attributes, Creating an Access Service for Host LookupCreating an Access Service for Host Lookup, Previous StepsSee Viewing Identity Policies, page 10-21, for details Configuring an Identity Policy for Host Lookup RequestsClick Save Changes See Customizing a Policy, page 10-4, for more information VPN Remote Network AccessSelect Host Lookup and click OK LDAP-RADIUS/PAP Supported Authentication ProtocolsSupported Identity Stores RADIUS/PAP RADIUS/CHAPConfiguring VPN Remote Access Service Supported VPN Network Access ServersSupported VPN Clients ACS and Cisco Security Group Access Creating Security Groups Adding Devices for Security Group AccessCreating SGACLs Configuring an Ndac PolicyCreating an Access Service for Security Group Access Configuring EAP-FAST Settings for Security Group AccessSelect Network Access, and check Identity and Authorization Creating an Egress Policy Creating an Endpoint Admission Control PolicyCreating a Default Policy Radius and TACACS+ Proxy Requests Tacplusauthor Tacplusauthen Supported ProtocolsTacplusacct PAP Ascii Chap Supported Radius AttributesTACACS+ Body Encryption Connection to TACACS+ ServerConfiguring Proxy Service My Workspace Welcome WelcomeField Description My Account Task GuidesAccessing the Web Interface Using the Web InterfaceLogging In, Logging Out, Logging Logging Out Understanding the Web InterfaceHeader Header, Navigation Pane, Content Area,Navigation Pane, Content Area, Web Interface DesignDrawer Function Navigation PaneHeader, Content Area, Content AreaWeb Interface Location Deleted item Button or Field Description Sorting FilteringSecondary Windows Secondary Window Transfer BoxesTransfer Box Fields and Buttons Schedule Boxes Rule Table PagesSee Displaying Hit Counts, page 10-10for more information Option DescriptionACS 5.x Policy Model Supported ACS ObjectsSupported ACS Objects, Creating Import Files, Property Name Property Data Type Uments Creating Import FilesClick Download Add Template Downloading the Template from the Web InterfaceUnderstanding the CSV Templates Click File OperationsHeader Field Description Creating the Import FileUpdating the Records in the ACS Internal Store Deleting Records from the ACS Internal Store Concurrency Conflict Errors Common ErrorsDeletion Errors System Failure Errors AccessibilityDisplay and Readability Features Obtaining Additional Accessibility Information Keyboard and Mouse FeaturesStep No Task Drawer Refer to Configuring Minimal System SetupConfiguring Administrator Configuring Local ServerConfiguring Authentication Settings for AdministratorsStep No Task Drawer Refer to Task Drawer Refer to Configuring ACS to Manage Access PoliciesDuplicating Alarm Configuring System AlarmSettings, Understanding AlarmOL-24201-01 External Servers Managing Network ResourcesCreating, Duplicating, and Editing Network Device Groups Network Device GroupsChoose Network Resources Network Device Groups Deleting Network Device Groups Field Description Deleting Network Device Groups from a Hierarchy Network Devices and AAA ClientsChoose Network Resources Network Devices and AAA Clients Viewing and Performing Bulk Operations for Network DevicesSee Displaying Network Device Properties, Network Device page appears Exporting Network Devices and AAA ClientsPerforming Bulk Operations for Network Resources and Users Managing Network Resources Network Devices and AAA Clients Creating, Duplicating, and Editing Network Devices Exporting Network Resources and UsersConfiguring Network Device and AAA Clients TACACS+ SGT KEKDisplaying Network Device Properties TACACS+ Access Advanced Settings AccessSecurity Group Deleting Network Devices Configuring a Default Network DeviceAbout creating network device groups Creating, Duplicating, and Editing External Proxy Servers Working with External Proxy ServersChoose Network Resources External Proxy Servers Choose to create Radius proxy server Deleting External Proxy Servers OL-24201-01 Internal Identity Stores OverviewLdap External Identity StoresIdentity Stores with Two-Factor Authentication Certificate-Based AuthenticationIdentity Groups Identity Sequences Managing Internal Identity StoresAuthentication Information Select Users and Identity Stores Identity Groups Creating Identity GroupsClick File Operations to Deleting an Identity Group Managing Identity AttributesStandard Attributes, User Attributes, Host Attributes, User Attributes Standard AttributesAttribute Description Choose System Administration Users Authentication Settings Configuring Authentication Settings for UsersHost Attributes Options Description Password HistoryCreating Internal Users Resources and Users, Defined under System Administration Users AuthenticationOption Identity Stores Internal Identity Stores Users Administration Users Authentication SettingsMon dd hhmmss UTC YYYY, where Deleting Users from Internal Identity StoresInternal Users page appears without the deleted users Creating Hosts in Identity Stores Hhmmss UTC Yyyy , where Deleting Internal Hosts Attributes of Management Hierarchy Configuring AAA Devices for Management HierarchyConfiguring Users or Hosts for Management Hierarchy Management HierarchyConfiguring and Using UserIsInManagement Hierarchy Attribute Related Topics Ldap Overview Managing External Identity StoresMultiple Ldap Instances Directory ServiceAuthentication Using Ldap Configuring Ldap Groups, Viewing Ldap Attributes,Failover Authenticating a User Using a Bind ConnectionLdap Connection Management Attributes Retrieval Group Membership Information RetrievalCreating External Ldap Identity Stores Certificate RetrievalConfiguring an External Ldap Server Connection Ldap Server Connection Configuring External Ldap Directory Organization Schema If the tree containing subjects is the base DN, enter External identity store you created is saved Deleting External Ldap Identity Stores Configuring Ldap GroupsViewing Ldap Attributes Leveraging Cisco NAC Profiler as an External MAB DatabaseClick Server Ldap Interface Configuration in NAC Profiler Advanced Options Active Response DelayClick Save Profile Configuring Endpoint Profiles in NAC ProfilerEdit NAC Profiler Definition General Click the Server Connection tabTest Bind to Server Dialog Box Click Test ConfigurationNumber of Subjects Number of Directory Groups Microsoft AD Supported Authentication ProtocolsUser Guide for Cisco Secure Access Control System Protocol Port number Machine AuthenticationConcurrent Connection Management Attribute Retrieval for AuthorizationGroup Retrieval for Authorization Certificate Retrieval for EAP-TLS AuthenticationMachine Access Restrictions Dial-in Permissions Machine Authentication AD Group Required ATZ profileCallback Options for Dial-in users ACS Response Dial-in Support AttributesMachine Authentication, page B-34 Configuring an AD Identity StoreJoining ACS to an AD Domain Click Selecting an AD Group Selecting an AD Group, Configuring AD Attributes,Configuring AD Attributes Available from the Attributes secondary window only Joining ACS to Domain Controllers RSA SecurID Server Configuring RSA SecurID AgentsPIN Creating and Editing RSA SecurID Token ServersRSA Realm Settings Tab Enable the RSA options file, Reset Agent Files, Configuring ACS Instance SettingsReset Agent Files Enable the RSA options fileCheck the Enable identity caching check box Configuring Advanced OptionsRadius Identity Stores Supported Authentication ProtocolsRadius PAP TACACS+ ASCII/PAP User Group Mapping Password PromptGroups and Attributes Mapping Username Special Format with Safeword Server Authentication Failure MessagesCause of Authentication Failure Failure Cases Radius Identity Store in Identity SequenceCreating, Duplicating, and Editing Radius Identity Servers User Attribute CacheRadius PAP TACACS+ ASCII\PAP Configuring General Settings Server Connection Configuring Shell Prompts Cisco-av-pair.some-avpair Configuring Directory AttributesConfiguring Shell Prompts, Configuring Advanced Options, Configuring CA CertificatesSelect Users and Identity Stores Certificate Authorities Adding a Certificate AuthorityDescription of the certificate Deleting a Certificate Authority Exporting a Certificate Authority Configuring Certificate Authentication ProfilesCertificate Authentication Profile page reappears Attribute Retrieval Sequence Configuring Identity Store SequencesAuthentication Sequence Creating, Duplicating, and Editing Identity Store Sequences22 Identity Store Sequence Properties Deleting Identity Store Sequences OL-24201-01 OL-24201-01 Managing Policy Conditions Managing Policy ElementsManaging Policy Elements Managing Policy Conditions Select Policy Elements Session Conditions Date and Time Deleting a Session Condition, Managing Network Conditions,Policy, Select Policy Elements Session Conditions Custom Managing Network Conditions Deleting a Session ConditionManaging Policy Elements Managing Policy Conditions Importing Network Conditions Creating, Duplicating, and Editing End Station Filters Exporting Network ConditionsDefining IP Address-Based End Station Filters Defining CLI or DNIS-Based End Station Filters Defining MAC Address-Based End Station FiltersCreating, Duplicating, and Editing Device Filters Defining Name-Based Device Filters Defining IP Address-Based Device FiltersDefining NDG-Based Device Filters Creating, Duplicating, and Editing Device Port FiltersDefining IP Address-Based Device Port Filters Defining Name-Based Device Port Filters Defining NDG-Based Device Port Filters Managing Authorizations and PermissionsAuthorization Profiles Specifying Common Attributes in Authorization Profiles Specifying Authorization ProfilesVlan ID/Name Includes a Vlan assignment Attribute, its name, value, and type appear in the table. To Specifying Radius Attributes in Authorization ProfilesDictionary Creating Security Groups, Creating and Editing Security GroupsRelated Topics Defining Common Tasks Defining General Shell Profile PropertiesDefining Common Tasks, Defining Custom Attributes, Privilege Level Shell Profile Common Tasks Replace Defining Custom AttributesOL-24201-01 Duplicated ShowCreating, Duplicating, and Editing Downloadable ACLs Appears without the deleted object Deleting an Authorizations and Permissions Policy ElementConfiguring Security Group Access Control Lists OL-24201-01 10-1 Policy Creation FlowPolicy Creation Flow-Next Steps Network Definition and Policy Goals10-2 10-3 Policy Elements in the Policy Creation FlowPolicy Creation Flow-Previous Step Network Definition and Policy Goals,10-4 Access Service Policy CreationService Selection Policy Creation Customizing a PolicyConfiguring a Policy-Next Steps Configuring the Service Selection Policy10-5 10-6 Configuring a Simple Service Selection PolicyService Selection Policy Select Access Policies Service Selection Policy10-7 See Displaying Hit Counts,Select Access Policies Service Selection Policy. If you Creating, Duplicating, and Editing Service Selection Rules10-8 10-9 ConditionsDisplaying Hit Counts Deleting Service Selection Rules10-10 Editing Default Access Services Configuring Access Services10-11 Select Access Policies Access Services Creating, Duplicating, and Editing Access Services10-12 10-13 Configuring General Access Service Properties10-14 Select Access Policies Access Services, then click Configuring Access Service Allowed Protocols10-15 10-16 Server Certificates, page 18-14for more information10-17 10-18 10-19 Configuring Access Services Templates10-20 Deleting an Access ServiceAccess Service Type Protocols Policies Conditions ResultsViewing Identity Policies Configuring Access Service Policies10-21 10-22 10-23 Viewing Rules-Based Identity Policies10-24 Configuring Identity Policy Rule Properties10-25 10-26 Configuring a Group Mapping Policy10-27 Displaying Hit Counts,10-28 Configuring Group Mapping Policy Rule Properties10-29 Select Access Policies Access Services service Authorization10-30 10-31 Configuring Network Access Authorization Rule Properties10-32 Configuring Device Administration Authorization Policies10-33 10-34 Condition10-35 Configuring Authorization Exception Policies10-36 Condition Name10-37 Creating Policy RulesEditing Policy Rules Duplicating a Rule10-38 10-39 Deleting Policy RulesCompound Condition Building Blocks Configuring Compound Conditions10-40 10-41 Types of Compound ConditionsOperand1 Operand2 Example Atomic ConditionMultiple Nested Compound Condition Single Nested Compound Condition10-42 10-43 Compound Expression with Dynamic value10-44 Using the Compound Expression BuilderPolicy Page, Security Group Access Control PagesEgress Policy Matrix Policy Matrix,Creating an Egress Policy, Defining a Default Policy for Egress PolicyCreating an Egress Policy, Creating a Default Policy, Editing a Cell in the Egress Policy Matrix10-47 Ndac PolicySimple Policy Rule-Based PolicyNdac Policy Properties Configuring an Ndac Policy, Ndac Policy Properties Page,10-48 10-49 Configuring an Ndac Policy, Ndac Policy Page,Maximum User Sessions Network Device Access EAP-FAST Settings10-50 Max Session Group Settings Max Session User Settings10-51 Max User Session Global Settings Max Session Global Setting10-52 Purging User Sessions Go to System Administration Users Purge User Sessions10-53 Click Get Logged-in User List Maximum User Session in Distributed Environment10-54 10-55 Maximum User Session in Proxy Scenario10-56 Epm logging Logging monitor informational Logging origin-id ip11-1 11-2 Authentication Records and DetailsAuthentication Records and Details, Dashboard Pages11-3 11-4 Working with Portlets11-5 Working with Authentication Lookup PortletAdding Tabs to the Dashboard Configuring Tabs in the DashboardRunning Authentication Lookup Report Dashboard Pages, Running Authentication Lookup Report,Adding Applications to Tabs Renaming Tabs in the Dashboard11-7 11-8 Changing the Dashboard LayoutDeleting Tabs from the Dashboard Click Manage Pages12-1 Understanding AlarmsThreshold Alarms, System Alarms, Threshold AlarmsEvaluation Cycle1 Evaluating Alarm ThresholdsSystem Alarms Evaluating Alarm Thresholds, Notifying Users of Events,Notifying Users of Events Viewing and Editing Alarms in Your Inbox12-3 12-4 Alarm Severity12-5 12-6 12-7 12-8 Select Monitoring and Reports Alarms Inbox12-9 Understanding Alarm SchedulesCreating and Editing Alarm Schedules Choose Monitoring and Reports Alarms SchedulesChoose Monitoring and Reports Alarms Thresholds Assigning Alarm Schedules to Thresholds12-10 12-11 Creating, Editing, and Duplicating Alarm ThresholdsDeleting Alarm Schedules Select Monitoring and Reports Alarms Thresholds12-12 12-13 Configuring General Threshold InformationACS Instance Configuring Threshold CriteriaPassed Authentications Passed Authentication Count12-15 12-16 Failed AuthenticationsFailed Authentication Count Device IP12-17 12-18 Authentication Inactivity12-19 Tacacs Command Accounting12-20 Tacacs Command Authorization12-21 ACS Configuration Changes12-22 ACS System Diagnostics12-23 ACS Process StatusCPU ACS System Health12-24 12-25 ACS AAA Health12-26 Radius SessionsUnknown NAD Count of Unknown NAD Authentication Records12-27 12-28 External DB Unavailable12-29 Rbacl Drops12-30 NADDGT DstipDevice IP Count of NAD-Reported AAA Down Events NAD-Reported AAA Downtime12-31 12-32 Configuring Threshold Notifications12-33 Deleting Alarm Thresholds12-34 Configuring System Alarm SettingsCreating and Editing Alarm Syslog Targets Understanding Alarm Syslog Targets12-35 12-36 Deleting Alarm Syslog Targets13-1 Managing Reports13-2 Catalog-Monitoring & Reports Reports Catalog reporttype13-3 Working with Favorite ReportsAdding Reports to Your Favorites Click Add to Favorites13-4 Viewing Favorite-Report ParametersClick Add to Favorite Choose Monitoring and Reports Reports Favorites13-5 Editing Favorite ReportsRunning Favorite Reports Select Monitoring & Reports Reports FavoritesReports Reports Catalog ACS Instance Sharing ReportsDeleting Reports from Favorites Click Launch Interactive Viewer for more options13-7 Working with Catalog ReportsAvailable Reports in the Catalog Report Name Description Logging Category13-8 13-9 13-10 13-11 Running Catalog Reports13-12 Running Named Reports Deleting Catalog Reports13-13 13-14 Reporttype Reportname13-15 Understanding the ReportName13-16 13-17 13-18 Enabling Radius CoA Options on a DeviceRadius Active Session Report 13-1913-20 Customizing ReportsRestoring Reports Click Launch Interactive ViewerAbout Interactive Viewer’s Context Menus Viewing ReportsAbout Standard Viewer About Interactive ViewerContext Menu for Column Data in Interactive Viewer 13-22Navigating Reports Using the Table of Contents13-24 Exporting Report Data12 The Export Data Dialog Box 13-25Saving Report Designs in Interactive Viewer Printing Reports13-26 Editing Labels Formatting Reports in Interactive Viewer13-27 Select Change Text Formatting LabelsFormatting Data Resizing ColumnsSelect Style Font Changing Column Data AlignmentFormatting Data in Columns Formatting Data in Aggregate RowsData type Option Description Formatting Data Types13-30 13-31 Formatting Numeric Data13-32 Formatting Fixed or Scientific Numbers or PercentagesFormatting Custom Numeric Data Data in the data set Result of formatting13-33 SymbolFormatting String Data Formatting Custom String DataData in the data source Results of formatting Formatting Date and Time13-34 13-35 Formatting Custom Date and TimeFormat Result of formatting MmmmApplying Conditional Formats Formatting Boolean Data13-36 Select Style Conditional Formatting Setting Conditional Formatting for Columns13-37 19 Comparison Value Field 13-3813-39 Deleting Conditional FormattingSetting and Removing Page Breaks in a Group Column Setting and Removing Page Breaks in Detail Columns13-40 Displaying and Organizing Report Data Organizing Report Data13-41 Select Column Move to Group Header Reordering Columns in Interactive Viewer13-42 13-43 Removing ColumnsSelect Column Hide Column Hiding or Displaying Report ItemsHiding Columns Select Hide or Show Items13-45 Displaying Hidden ColumnsMerging Columns Select Column Show ColumnsSelect Column Merge Columns Selecting a Column from a Merged Column13-46 Sorting a Single Column, Sorting Multiple Columns, Sorting DataSorting a Single Column Sorting Multiple Columns13-48 Grouping Data13-49 Grouping Data Based on Date or Time Adding Groups13-50 Creating Report Calculations Removing an Inner Group13-51 37 Calculated Column 13-52Function Description Example of use Understanding Supported Calculation Functions13-53 Countdistinct Count13-54 13-55 Isbottomnpercent13-56 13-57 Movingaverage13-58 Today13-59 Weightedaverage13-60 Using Numbers and Dates in an ExpressionUnderstanding Supported Operators Operator Description13-61 Using Multiply Values in Calculated ColumnsAdding Days to an Existing Date Value Select Add CalculationSubtracting Date Values in a Calculated Column Working with Aggregate Data13-62 13-63 Aggregate functions Description13-64 Creating an Aggregate Data RowClick Add aggregation Adding Additional Aggregate Rows13-65 13-66 Hiding and Filtering Report DataDeleting Aggregate Rows Hiding or Displaying Column DataHiding or Displaying Detail Rows in Groups or Sections Displaying Repeated Values13-67 Condition Description Working with Filters13-68 13-69 Types of Filter Conditions13-70 Setting Filter Values13-71 Creating FiltersCreating a Filter with Multiple Conditions Modifying or Clearing a Filter13-72 Click Add Condition Click Advanced Filter13-73 13-74 Filtering Highest or Lowest Values in Columns13-75 Understanding ChartsFiltering Chart Data Modifying Charts13-76 13-77 Changing Chart SubtypeChanging Chart Formatting Select Chart Subtype13-78 50 Chart Formatting Options14-1 Available Diagnostic and Troubleshooting ToolsConnectivity Tests ACS Support Bundle14-2 Expert TroubleshooterACS-Assigned SGT Records, page 14-14for more information Diagnostic Tool DescriptionPerforming Connectivity Tests See Comparing Sgacl Policy Between a Network Device and ACS14-4 Downloading ACS Support Bundles for Diagnostic Information14-5 Working with Expert TroubleshooterNAS IP Troubleshooting Radius Authentications14-6 14-7 14-8 Click Show Results Summary14-9 Executing the Show Command on a Network DeviceAAA Evaluating the Configuration of a Network Device14-10 SGA Comparing Sgacl Policy Between a Network Device and ACS14-11 14-12 Comparing the SXP-IP Mappings Between a Device and its PeersVRF Click the User Input Required button14-13 14-14 14-15 Comparing Device SGT with ACS-Assigned Device SGT14-16 15-1 15-2 15-3 Configuring Data Purging and Incremental Backup15-4 15-5 15-6 Configuring NFS stagging15-7 Restoring Data from a BackupConfiguring Data Purging and Incremental Backup, Viewing Log Collections15-8 Log Collection Details Page,15-9 Log Collection Details15-10 Viewing Scheduled Jobs Recovering Log Messages15-11 15-12 15-13 Viewing Process StatusFailure Reasons Editor Viewing Data Upgrade StatusViewing Failure Reasons Editing Failure Reasons15-15 Specifying E-Mail SettingsConfiguring Snmp Preferences Email SettingsCreating and Editing Collection Filters Understanding Collection Filters15-16 15-17 Configuring Alarm Syslog TargetsConfiguring Remote Database Settings Deleting Collection Filters15-18 16-1 Managing System Administrators16-2 Understanding Administrator Roles and Accounts16-3 Configuring System Administrators and AccountsUnderstanding Authentication Understanding Roles16-4 PermissionsPredefined Roles Role Privileges16-5 Changing Role AssociationsChoose System Administration Administrators Accounts Administrator Accounts and Role Association16-6 16-7 Button and click View Choose System Administration Administrators RolesViewing Predefined Roles Viewing Role Properties16-9 Configuring Authentication Settings for Administrators16-10 Allow All IP Addresses to Connect Configuring Session Idle TimeoutConfiguring Administrator Access Settings Choose System Administration Administrators Settings AccessAccess-setting accept-all Resetting the Administrator Password16-12 16-13 Changing the Administrator PasswordChanging Your Own Administrator Password Choose My Workspace My Account16-14 Resetting Another Administrator’s Password17-1 Configuring System Operations17-2 Service PortUnderstanding Distributed Deployment Aaa-server radius-authport17-3 Activating Secondary ServersRemoving Secondary Servers Activating Secondary Servers,17-4 Understanding Local ModePromoting a Secondary Server Understanding Distributed Deployment,Understanding Full Replication Specifying a Hardware Replacement17-5 Choose System Administration Operations Scheduled Backups Scheduled BackupsCreating, Duplicating, and Editing Scheduled Backups Creating, Duplicating, and Editing Scheduled Backups,Backing Up Primary and Secondary Instances, Backing Up Primary and Secondary Instances17-7 Viewing and Editing a Primary Instance Editing Instances17-8 17-9 Ddmmyyyy17-10 GUI17-11 17-12 Viewing and Editing a Secondary InstanceDeleting a Secondary Instance Editing Instances, Viewing and Editing a Primary Instance,17-13 Activating a Secondary InstanceRegistering a Secondary Instance to a Primary Instance Click Activate17-14 17-15 Click Register to PrimaryClick Deregister from Primary Click Deregister17-16 17-17 17-18 Replicating a Secondary Instance from a Primary Instance17-19 Click Full Replication17-20 See Registering a Secondary Instance to a Primary Instance,17-21 Failover17-22 Click Request Local Mode17-23 17-24 18-1 Configuring Global System OptionsConfiguring TACACS+ Settings Manage licensing. See Licensing Overview,18-2 Configuring EAP-TLS Settings18-3 Configuring Peap SettingsConfiguring EAP-FAST Settings Generating EAP-FAST PAC,Tokencode Configuring RSA SecurID PromptsGenerating EAP-FAST PAC Click Generate PACRadius Ietf Managing DictionariesViewing Radius and TACACS+ Attributes YOU Prepared to Accept a SYSTEM-GENERATED PIN?18-6 Radius VSAs, page A-618-7 Viewing Radius and TACACS+ Attributes,18-8 18-9 Viewing Radius Vendor-Specific Subattributes18-10 Configuring Identity Dictionaries18-11 Configuring Internal Identity AttributesPolicy Elements Session Conditions Custom Deleting an Internal User Identity Attribute18-12 18-13 Deleting an Internal Host Identity AttributeAdding Local Server Certificates Configuring Local Server Certificates18-14 Signing Request, Associating Certificates to Protocols,18-15 18-16 Generating Self-Signed CertificatesEAP Select Generate Self Signed Certificate NextClick Finish Generating a Certificate Signing RequestBinding CA Signed Certificates Select Generate Certificate Signing Request NextSelect Bind CA Signed Certificate Next Editing and Renewing Certificates18-18 18-19 Deleting CertificatesViewing Outstanding Signing Requests Exporting Certificates18-20 Configuring Remote Log Targets Configuring Logs18-21 18-22 Target ConfigurationGeneral Deleting a Remote Log Target,Deleting Local Log Data Configuring the Local LogConfiguring Remote Log Targets, Deleting a Remote Log Target18-24 Configuring Logging CategoriesConfiguring Global Logging Categories Option Descriptions18-25 18-26 Category Log and Description18-27 18-28 Show logging systemConfiguring Per-Instance Security and Log Settings, Configuring Per-Instance Logging Categories18-29 18-30 Configuring Per-Instance Security and Log Settings18-31 Configuring Per-Instance Remote Syslog TargetsConfigure Logged Attributes Click the Remote Syslog Target tab18-32 Displaying Logging CategoriesViewing the Log Message Catalog Configuring the Log Collector18-33 18-34 Licensing OverviewTypes of Licenses License Description18-35 Installing a License FilePAK Viewing the Base License18-36 Upgrading the Base Server License, Upgrading the Base Server License18-37 18-38 Viewing License Feature Options18-39 Adding Deployment License Files18-40 Deleting Deployment License FilesAvailable Downloads Click Delete to delete the license file18-41 Downloading UCP Web Service FilesDownloading Migration Utility Files Downloading Sample Python ScriptsChoose System Administration Downloads Rest Service Downloading Rest Services18-42 About Logging, ACS 4.x Versus ACS 5.3 Logging, About Logging19-1 Logging Categories Using Log Targets19-2 19-3 Log Message Severity Levels Global and Per-Instance Logging Categories19-4 ACS Severity Syslog Severity Level Description Local Store Target19-5 19-6 19-7 Critical Log Target19-8 Remote Syslog Server Target19-9 Viewing Log Messages Monitoring and Reports Server Target19-10 19-11 Debug LogsCSV ACS 4.x Versus ACS 5.3 Logging19-12 Use the Reports and Activity pages Use the System Configuration Logging19-13 19-14 Typical Use Cases Device Administration TACACS+PAP Chap Network Access Radius With and Without EAPSession Access Requests Device Administration TACACS+ Command Authorization RequestsEAP-FAST/EAP-GTC RADIUS-Based Flow Without EAP AuthenticationRADIUS-Based Flows with EAP Authentication PEAP/EAP-GTCFigure A-3shows a RADIUS-based authentication with EAP Overview of TACACS+ Access Protocols-TACACS+ and RadiusPoint of Comparison Radius VSAs Overview of RadiusACS 5.3 as the AAA Server Address IP Integer Time Radius Attribute Support in ACSAccounting Radius Access RequestsAuthentication AuthorizationOL-24201-01 Authentication and User Databases Authentication ConsiderationsEAP-MSCHAPv2, page B-30 PAP, page B-2 CHAP, page B-31EAP Radius PAP AuthenticationEAP-GTC EAP message type EAP codeEAP Method Description Information see EAP-MSCHAPv2, page B-30Overview of EAP-MD5 Host Lookup, Overview of Agentless Network Access,EAP- MD5 Flow in ACS Overview of EAP-TLS User Certificate AuthenticationPKI Authentication PKI Usage PKI CredentialsFixed Management Certificates Acquiring Local CertificatesImporting Trust Certificates Initial Self-Signed Certificate Generation Importing the ACS Server CertificateCertificate Generation Exporting Credentials Credentials Distribution Hardware Replacement and CertificatesSecuring the Cryptographic Sensitive Material EAP-TLS Flow in ACS Private Keys and Passwords BackupOverview of PEAP, page B-15 EAP-MSCHAPv2, page B-30 PEAPv0/1Overview of Peap Supported Peap FeaturesFast Reconnect Creating the TLS Tunnel Peap Flow in ACSOverview of EAP-FAST Authenticating with MSCHAPv2EAP-FAST EAP-FAST Benefits EAP-FAST in ACSAbout PACs About Master-KeysTypes of PACs Provisioning ModesAutomatic In-Band PAC Provisioning Machine PAC Authentication ACS-Supported Features for PACsProactive PAC Update PAC Accept Peer on Authenticated ProvisioningPAC-Less Authentication PAC Type Tunnel v1/v1a/SGA Machine AuthorizationMaster Key Generation and PAC TTLs EAP-FAST Flow in ACSEAP-FAST for Allow TLS Renegotiation EAP-FAST PAC Management EAP-FAST PAC-Opaque Packing and Unpacking Key Distribution AlgorithmRevocation Method PAC Migration from ACS EAP Authentication with Radius Key WrapOverview of EAP-MSCHAPv2 MSCHAPv2 for User AuthenticationMSCHAPv2 for Change Password EAP-MSCHAPv2EAP- MSCHAPv2 Flow in ACS Windows Machine Authentication Against ADSAN-DNS Certificate AttributesCertificate Binary Comparison SANRules Relating to Textual Attributes Certificate RevocationMachine Authentication MSCHAPv1/MSCHAPv2 Authentication Protocol and Identity Store CompatibilityMicrosoft AD, Managing External Identity Stores, Identity StoreEAP-MSCHAPv2 EAP-TLSOpenSSL/Open SSL Project License IssuesOpenSSL License Original SSLeay License Appendix C Open Source License Acknowledgments OL-24201-01 GL-1 O S S a R YGL-2 Capability of ACS to record user sessions in a log fileGL-3 Validity and conformance of the original informationGL-4 GL-5 GL-6 GL-7 GL-8 FTP GL-9GL-10 EAP-FAST PACGL-11 GL-12 GL-13 Service providerISPGL-14 GL-15 Extension within certificate informationGL-16 GL-17 GL-18 GL-19 GL-20 IN-1 SymbolsIN-2 IN-3 Date expressionsIN-4 Formatting symbolsIN-5 Hide Detail commandIN-6 IN-7 Or operator 13-60,13-74IN-8 Summary valuesIN-9 Upper functionIN-10