Manuale d’uso / di manutenzione del prodotto CSACS3415K9 del fabbricante Cisco Systems
Vai alla pagina of 678
Americas Hea dquarters Cisc o Syst ems , Inc . 170 West Ta sman Driv e San Jos e, CA 95 134-1706 USA http://www.ci sco.com Tel: 408 526-4000 800 553- NETS (638 7) Fax: 408 527-0883 User Guide f or Cisco S ecure Access Contr ol S ystem 5.
THE SPECIFICATIONS AND INFORMATION REGARDING TH E PRODUCTS IN THIS MANUAL ARE SUBJE CT TO CHANGE WITHOUT NO TICE. ALL STATEMENT S, INFORMATI O N, AND RECOMME NDATIONS IN T HIS MANUAL ARE BELI EVED TO BE A CCURATE BUT ARE P RESENTED W ITHOUT WARRANTY OF ANY KIND, EXPRE SS OR IMPLIED.
iii User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 CONTENTS Preface xx iii Audienc e xxiii Document Conventions xxiii Document ation Update s xxiv Relat ed D ocum ent atio n xxiv Obtain ing Documentat ion and Sub m itti ng a Serv ice Reque st xxv CHAPTER 1 Introdu cing ACS 5.
Cont ents iv User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Polic y Terminol ogy 3-3 Simp le P olici es 3-4 Rule- Based Po licies 3-4 Types of Poli cies 3-5 Acce ss Se rvic es 3-.
Content s v User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Agentl ess Netwo rk Access 4-12 Overvi ew of Agentl ess Network Access 4-12 Host L ookup 4-1 3 Authe nti cati on wi th .
Cont ents vi User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 My A ccoun t Pa ge 5-2 Login Ba nner 5-3 Usin g the Web In terface 5-3 Acce ssin g the We b Interf ace 5-4 Logg ing In.
Content s vii User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Viewing and Perfor ming Bulk Operati ons fo r Network Dev ices 7-6 Export ing Network Device s and AAA Clients 7-7 Pe.
Cont ents viii User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Viewing and Perf orming Bul k Opera tions fo r Intern al Identity St ore Hosts 8-18 Mana geme nt H ier arch y 8-19 A.
Content s ix User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Config uring an AD Identi ty Store 8-49 Select ing an AD Group 8-53 Config uring AD Attribu tes 8-54 Config uring Mach.
Cont ents x User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Managing Author izatio ns and Permiss ions 9-17 Creati ng, Duplicati ng, and Edi ting Authori zation Pr ofile s for Net.
Content s xi User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Config uring a Group Mapp ing Po licy 10-27 Config uring Group Mapp ing Po licy Rul e Propertie s 10-29 Confi guri ng .
Cont ents xii User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Adding Ta bs to the Dashboard 11-6 Adding App l icati ons to Tabs 11-7 Renaming Tabs in t he Dashboard 11- 7 Changin .
Content s xiii User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 CHAPTER 13 Managin g Reports 13-1 Work ing wit h Favo rite Report s 13-3 Adding Re ports to Your Favo rites Page 13-.
Cont ents xiv User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Formatt ing String Data 13-33 Form attin g C ustom St ring Data 13-33 Formatt ing Date an d Time 13-35 Form attin g C.
Content s xv User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Hiding or Di splaying Det ail Ro ws in Groups or Section s 13-68 Work ing wit h Filte rs 13-69 Type s of Filt er Condi.
Cont ents xvi User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 View ing Sc hedu led Jo bs 15-12 Viewing Proces s Status 15-14 Viewing Data Upgr ade Sta tus 15-15 Viewing Fail ure R.
Content s xvii User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Config uring Ident ity Pol icy Rule Pr operties 16-1 8 Adminis trator Auth orizat ion Policy 16-19 Config uring Admi.
Cont ents xviii User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Creati ng, Duplicati ng, Editing, and Del eting Sof tware Reposit ories 17-2 4 Managing Softwar e Reposit ories fr .
Content s xix User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Config uring Global Lo gging Categor ies 18-2 5 Config uring Per-Ins tance Loggi ng Categ ories 18-29 Config uring Pe.
Cont ents xx User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Sessio n Access Request s (Device Adminis trati on [TACACS+] ) A-2 Command Au thorizatio n Requests A-2 Netw ork Acc e.
Content s xxi User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Privat e Keys an d Passwords Backup B-13 EAP-T LS Flow in A CS 5 .4 B-13 PEAP v0/1 B- 14 Overvi ew of PEAP B-15 Support ed PEAP Fe atures B-15 PEAP Flow in ACS 5.
Cont ents xxii User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Authent ication Pr otocol an d Identity Stor e Compatibil ity B-36 APPENDI X C Open Source Li cense Ackno wledgement.
xxiii User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Preface Revised: November 13, 2013 This gu ide de scribes h ow to use C isco Secur e Acce ss Contro l Syste m (ACS) 5.4. Audience This guid e is for secu rity adm inistra tors who use ACS, and who set up and ma intain ne twork and application security .
xxiv User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Preface Cautio n Means re a d e r b e c a re f u l . Y ou are cap able of doing something tha t might result in equipment dam age or loss of data. T imesaver Means t he d escri bed act ion saves tim e .
xxv User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Pre face Obtaining Do cumentation and Submitting a Service Reque st For informat ion on obtai ning docu menta tion, sub mittin .
xxvi User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Preface.
CH A P T E R 1-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 1 Introducing ACS 5.4 This section con tains the follo wing topics: • Overview of A CS, pa ge 1-1 • A CS Di st.
1-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 1 Introducing A CS 5.4 ACS Distrib uted Deploy ment A CS pr ovides advanced monito ring, repor ting, an d troubl eshooting t ools that hel p you admini ster an d manage your ACS deploymen ts.
1-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 Introducing A CS 5.4 ACS Licensi ng Model A CS 4.x did not prov ide increm ental repli cation, only full replicatio n, and ther e was service d o wntime for replicati o n.
1-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 1 Introducing A CS 5.4 ACS Managem ent Interf aces • A CS W eb-b ased In terfa ce, pa ge 1-4 • A CS Command Lin e I.
1-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 Introducing A CS 5.4 Hardware Models Supported by ACS • Conf iguration—Use th ese commands to perform additional conf iguration tasks for the appliance serv er in an A DE-OS en vironme nt.
1-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 1 Introducing A CS 5.4 Har dware Models Suppor ted by ACS.
CH A P T E R 2-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 2 Migrating from ACS 4. x to ACS 5.4 A CS 4.x store s polic y and authenticatio n information , such as T A CAC S+ comman d sets, in the user and user gr o up recor d s.
2-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 2 Migrating fro m ACS 4.x to ACS 5.4 Overvi ew of the Migr ation Proce ss Overview of the Migration Pro cess The Migrat.
2-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 2 Mig rating from ACS 4.x to ACS 5.4 Before You Begin Note Y o u must install the la test patch for the supported migratio n version s listed here. Also , if you ha ve any other version of A CS 4.
2-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 2 Migrating fro m ACS 4.x to ACS 5.4 Migrating fr om ACS 4.x to ACS 5 .
2-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 2 Mig rating from ACS 4.x to ACS 5.4 Functionality Mapping from ACS 4.
2-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 2 Migrating fro m ACS 4.x to ACS 5.4 Funct io nalit y Ma ppin g fro m AC S 4.
2-7 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 2 Mig rating from ACS 4.x to ACS 5.4 Common Sc enarios in Mig ration Common Scenarios in Migration The following a re some of th e co mmon scena rios t hat y ou en counte r wh ile mi grating to ACS 5.
2-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 2 Migrating fro m ACS 4.x to ACS 5.4 Common Scen arios in M igration Migr ating from AC S 3.x t o ACS 5.4 If you have A CS 3.x deployed in your environment , you cannot d irectl y migrate to A C S 5.
2-9 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 2 Mig rating from ACS 4.x to ACS 5.4 Common Sc enarios in Mig ration Step 3 Perform bu lk import of data into A CS 5.4. For more inform ation on p erformi ng bulk i mport o f A CS obje cts, se e http://www .
2-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 2 Migrating fro m ACS 4.x to ACS 5.4 Common Scen arios in M igration.
CH A P T E R 3-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 3 ACS 5.x Policy Model A CS 5.x i s a poli cy-based ac cess contro l syst em. The ter m policy model in A CS 5.x re fers t o the presenta tion of p olicy elem ents, obje cts, an d rules to t he policy adm inistrato r .
3-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 3 ACS 5. x Policy Mode l Overview of the ACS 5.x Po licy Mode l For example, we u se t he inf ormat ion de scribe d for the group- based model : If identity-condition , r estriction-condition then authorization- pr o file In ACS 5.
3-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 3 ACS 5.x Policy Model Overview o f the ACS 5.x Policy Model Poli cy Terminolo gy Ta b l e 3 - 2 descri bes the ru le-base d policy termin ology .
3-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 3 ACS 5. x Policy Mode l Overview of the ACS 5.x Po licy Mode l Simple Policies Y o u can configure al l of your ACS policies as rule-base d polici es.
3-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 3 ACS 5.x Policy Model Overview o f the ACS 5.x Policy Model Types of P olicie s Ta b l e 3 - 3 descri bes the type s of policies that you can configure in A CS.
3-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 3 ACS 5. x Policy Mode l Access Se rvice s Access Services Access services are fundamental con structs i n AC S 5.
3-7 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 3 ACS 5.x Policy Model Access Servi ces Ta b l e 3 - 5 desc ribes an example of a set o f access se rvices. Ta b l e 3 - 6 describes a service selection policy . If A CS 5.
3-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 3 ACS 5. x Policy Mode l Access Se rvice s A CS accepts th e results o f the requ ests and re turns them to the N A S. Y ou must conf igure the e xternal RADIUS and T A CA CS+ serv ers in A CS for A CS to forw ard reque sts to them.
3-9 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 3 ACS 5.x Policy Model Access Servi ces A CS can simultaneously act as a proxy serv er to multiple e xternal RADIUS and T A CA CS+ serv ers. F or A CS to ac t as a proxy server, you must configure a RADIUS or T A CACS+ proxy serv ice in A C S.
3-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 3 ACS 5. x Policy Mode l Access Se rvice s • Identity Sequen ce—Sequ ences of the identity data bases. The seque nce is used for authen tication and, if specif ied, an additional sequen ce is used to retrie ve only attrib utes.
3-11 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 3 ACS 5.x Policy Model Access Servi ces Group Mapp ing Polic y The id entity group mapping policy i s a standa rd po licy .
3-12 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 3 ACS 5. x Policy Mode l Service Select ion Policy Related Topics • Poli c y T erm inol ogy , p age 3-3 • Authori .
3-13 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 3 ACS 5.x Policy Model Service Selection Policy Rules-Base d Service Selection In the rules-based servic e selection mode, A CS decides which access servic e to use based on var ious configurab le opt ions.
3-14 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 3 ACS 5. x Policy Mode l Service Select ion Policy In this e xample, inst ead of cr eating the netwo rk acces s poli cy for 802.1 x, agentles s de vices, and gu est acces s in one access servic e, the polic y is divi ded into three acc ess serv ices.
3-15 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 3 ACS 5.x Policy Model Service Selection Policy The default ru le specif ies the policy result that A CS uses when no other rules exist, or when the attrib ute values in the acces s request do not mat ch any rules.
3-16 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 3 ACS 5. x Policy Mode l Authori zation Pro files for Ne twork Ac cess Policy Conditions Y o u can define simple condi.
3-17 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 3 ACS 5.x Policy Model Policies and Identity Attributes Y ou can def ine multiple au thorization prof iles as a network access p olic y result.
3-18 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 3 ACS 5. x Policy Mode l Policies and Network D evice Gr oups Related Topics • Managing Users and Identity S to res,.
3-19 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 3 ACS 5.x Policy Model Flows for Configuring Services and Policies Figure 3-2 illustrates what this policy rule table could look like . Figur e 3-2 Sample Rule -Based P olicy Each ro w in the polic y table rep resents a single rule.
3-20 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 3 ACS 5. x Policy Mode l Flows for Con figur ing Servic es and Polic ies • Added users to the inte r nal A CS identity store or add e xternal iden tity stores.
3-21 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 3 ACS 5.x Policy Model Flows for Configuring Services and Policies Related Topics • Poli c y T erm inol ogy , p age .
3-22 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 3 ACS 5. x Policy Mode l Flows for Con figur ing Servic es and Polic ies.
CH A P T E R 4-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 4 Common Scenarios Using ACS Network co ntrol refe rs to the pro cess of contro lling access to a networ k. T r aditio nally a user name and password was used to authe nticat e a user to a net work.
4-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 4 Co mmon S cenarios Using ACS Overvi ew of Dev ice Ad ministr ation A CS organize s a sequenc e of independ ent policies into an access serv ice, which is used to proc ess an access reques t.
4-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 4 Com mon Scena rios Using ACS Over view of D evi ce Ad min istr atio n If a c ommand is m atched to a comm and se t, the corre spondi ng perm it or deny set ting for the c omma nd is retrie ved.
4-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 4 Co mmon S cenarios Using ACS Overvi ew of Dev ice Ad ministr ation Step 5 Conf igure an acce ss service p o lic y . See Acce ss Service Policy Creation, pa ge 10-4 . Step 6 Conf igure a service selec tion policy .
4-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 4 Com mon Scena rios Using ACS Password-Based Network Access TACACS+ Cu stom Servic es an d Attributes This top ic describe s the conf iguration flo w to def ine T A CA CS+ cus tom attrib utes and s ervices.
4-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 4 Co mmon S cenarios Using ACS Password-B ased Netw ork Acces s Note During pas swor d-base d access (or certi ficate-b ased access), t he user is not o nly authen ticated but also authorized accordin g to the ACS conf iguration .
4-7 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 4 Com mon Scena rios Using ACS Password-Based Network Access Passwo rd-Based Network A ccess Configura tion Flow This t opic de scribe s the end-to- end flow for passwo rd-based network access and lists t he tasks tha t you must perform .
4-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 4 Co mmon S cenarios Using ACS Password-B ased Netw ork Acces s For RADIUS, non -EAP aut hentica tion met hods (RADI US.
4-9 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 4 Com mon Scena rios Using ACS Certificate-Based Network Access Related Topics • Authentic ation in A CS 5.
4-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 4 Co mmon S cenarios Using ACS Certificate -Based Ne twork Ac cess Y o u can configure two types of cert ificates in A CS: • T rust certi fica te—Also kno wn as CA certif icate.
4-11 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 4 Com mon Scena rios Using ACS Certificate-Based Network Access Y ou can create custom con ditions to use the certif icate’ s attrib utes as a polic y condition. See Creating, Duplicat ing, a nd Edi ting a Custom Se ssion Co ndition, pag e 9-5 , for details.
4-12 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 4 Co mmon S cenarios Using ACS Agentle ss Net work Acc ess A default L ocal Server Certificate is install ed on ACS so that you c an conne ct to ACS with your browser .
4-13 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 4 Com mon Scena rios Using ACS Agentless Network Access The defau lt securit y policy say s that 802.1x au thenticatio n must succee d before access to the networ k is grante d.
4-14 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 4 Co mmon S cenarios Using ACS Agentle ss Net work Acc ess A CS supports host lo okup for the follo wing identity stores: • Intern al hosts • Exte rnal LDAP • Intern al users • Acti ve Directory Y ou can a ccess th e Act i ve Direct ory via the LD AP API.
4-15 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 4 Com mon Scena rios Using ACS Agentless Network Access • T wel ve consec utive hexadecima l di gits wi thout any se.
4-16 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 4 Co mmon S cenarios Using ACS Agentle ss Net work Acc ess Agentless N etwork Acce ss Flow This topic describes the end -to-end flow for agentless netwo rk access and lists the tasks that you must perform.
4-17 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 4 Com mon Scena rios Using ACS Agentless Network Access Step 7 Def ine the se r vice selec tion. Step 8 Add the ac cess service to you r service selectio n polic y . For more informatio n, see Creating, Dupli cating, and Editing Serv ice Selection Rule s, page 10-8 .
4-18 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 4 Co mmon S cenarios Using ACS Agentle ss Net work Acc ess Previ ous St ep: Network Devices and AAA Clients, page 7-5 .
4-19 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 4 Com mon Scena rios Using ACS Agentless Network Access c. Select Ne twork Access , and chec k Identity an d A ut horizati on . The group ma pping an d Externa l Policy opti ons are optio nal.
4-20 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 4 Co mmon S cenarios Using ACS VPN Remote Network Ac cess Configuring an Authorization Policy for Host Lookup Requests.
4-21 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 4 Com mon Scena rios Using ACS VPN Remo te Network Acces s Supported Authentic ation Protocols A CS 5.
4-22 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 4 Co mmon S cenarios Using ACS VPN Remote Network Ac cess Supporte d VPN Ne twork Ac cess Serve rs A CS 5.
4-23 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 4 Com mon Scena rios Using ACS ACS and C isco Secur ity Group Ac cess Related Topics • VPN Remote Netwo rk Access, p.
4-24 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 4 Co mmon S cenarios Using ACS ACS and Cisco Security Grou p Access 6. Conf ig uring EAP - F AST Settings f or Secur ity Group Access . 7. Creati ng an Access Ser v ice for Security Gr oup Access .
4-25 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 4 Com mon Scena rios Using ACS ACS and C isco Secur ity Group Ac cess Devices consid er on ly th e SGT value; the name a nd de scripti on of a sec urity group a re a m anag ement con ve nience an d are not con vey ed to the de vices.
4-26 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 4 Co mmon S cenarios Using ACS ACS and Cisco Security Grou p Access T o conf igure an ND A C policy for a de vice: Step 1 Choose Access P olicies > Se curity Gr oup Access Control > Security Group Acce ss > Network Dev ice Access > Aut horization Poli cy .
4-27 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 4 Com mon Scena rios Using ACS ACS and C isco Secur ity Group Ac cess Step 7 Click Fin ish . Creating an E ndpoint Admis sion Control P olicy After you crea te a servi ce, you configure t he endpoi nt adm ission co ntrol p olicy .
4-28 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 4 Co mmon S cenarios Using ACS ACS and Cisco Security Grou p Access Initia lly , the m atrix c ontai ns the cell f or the unknown sour ce and unknown de stinat ion SG. Unknown refers to the prec onfigured SG, which i s not modifiable.
4-29 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 4 Com mon Scena rios Using ACS RADIUS and T ACAC S+ Prox y Reque sts RADIUS and TACACS+ Proxy Requests Y ou can us e A.
4-30 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 4 Co mmon S cenarios Using ACS RADIUS a nd TACACS+ Prox y Request s • T A C_PLUS_A UTHOR • T A C_PLUS_A UTHEN 4. Recei ves the follo wing packets from the remote T A C A CS+ server and retu rns them back to the N AS: This be havior is configurabl e.
4-31 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 4 Com mon Scena rios Using ACS RADIUS and T ACAC S+ Prox y Reque sts • Supporte d RAD IUS Att ributes, pag e 4-31 .
4-32 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 4 Co mmon S cenarios Using ACS RADIUS a nd TACACS+ Prox y Request s Configuring Proxy Service T o co nfigure p roxy servic es: Step 1 Configure a set of rem ote RAD IUS and T A CACS+ servers.
CH A P T E R 5-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 5 Understanding My Workspace The Ci sco Sec ure ACS web int erface is design ed to be v iewed using M icroso ft Int ernet E xplore r versions 6.x to 9.x and Moz illa Fire fox version s 3.
5-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 5 Understand ing My Workspace Task Guides In A CS 5.4, you can also se e a ba nner in t he wel come page. Y o u ca n cu stomize this After L ogin banner text from the L ogin Banner pa ge.
5-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 5 Understandi ng My Works pace Login Bann er Related Topics • Conf iguring Authentica tion Settings for Administrators, page 16-10 • Chan ging the Admini stra tor Pas sword, page 1 6-22 Login Banner A CS 5.
5-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 5 Understand ing My Workspace Using th e Web Interfac e • Comm on Errors, page 5-25 • Accessibi lity , page 5-27 Accessin g the Web Interface The ACS web inter face is suppo rted o n HT TPS-enable d Mic rosoft Int ernet Ex plorer versions 6.
5-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 5 Understandi ng My Works pace Using the Web Interface Note The license page only appears the f ir st time that you log in to A CS. Step 7 See In stalling a License File, page 18-35 to install a v alid license.
5-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 5 Understand ing My Workspace Using th e Web Interfac e Web Interface Design Figure 5-1 sh ows th e ove r all design of the A CS web interface.
5-7 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 5 Understandi ng My Works pace Using the Web Interface Navigation Pane Use the navigation pa ne to navigate through the drawers of the we b interface (see Fi gure 5-3 ). Figur e 5-3 Na vigatio n P ane Ta b l e 5 - 4 de scribes the functi on o f each drawer .
5-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 5 Understand ing My Workspace Using th e Web Interfac e T o h ide t he n avigation pane a nd expa nd the con tent area , cli ck th e c ollaps e ar row , which is cente red ver ticall y between the na vigation pane and con tent area.
5-9 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 5 Understandi ng My Works pace Using the Web Interface • Seco ndary W indo ws, pa ge 5-13 • Rul e T able P ages, pa ge 5-16 Web Inter face Locat ion Y our curre nt loca tion in the inter face appear s at the top of the content area.
5-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 5 Understand ing My Workspace Using th e Web Interfac e T able 5-5 Common Cont ent Ar ea But tons and Fields f or List P ages Button or Field Description Rows per pa ge U se th e dro p-down list to sp ecify the n umber of it ems t o dis play on this page .
5-11 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 5 Understandi ng My Works pace Using the Web Interface T r ee table pages are a v a riati on of list page s (see Figure 5-6 ). Y ou can perf orm the s ame operat ions on tree tab le pages that you can on list pa ges, except for pa ging .
5-12 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 5 Understand ing My Workspace Using th e Web Interfac e Filtering Lar ge lists in a conten t area windo w or a secondar y windo w (see Figure 5-9 ) ca n be diff i cult to navigate through and selec t the data that you wa nt.
5-13 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 5 Understandi ng My Works pace Using the Web Interface For pages that d o not have a Nam e or De scripti on co lumn , the so rting mechan ism m ay be supporte d in the le ft-most colum n of the pa ge, or the D escri ption c olum n.
5-14 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 5 Understand ing My Workspace Using th e Web Interfac e Figur e 5-9 Secondary Windo w In addi tion to selec ting and f ilterin g data, you can create a select able objec t within a secondary wind ow .
5-15 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 5 Understandi ng My Works pace Using the Web Interface Figur e 5 -1 0 T ran sf er Bo x T able 5-7 T ransf er Bo x Fields and But tons Field or Button Description A vailabl e List of a va ilable items for select io n.
5-16 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 5 Understand ing My Workspace Using th e Web Interfac e Sche dule B oxes Schedu le boxes are a common ele ment in c ontent area pages (se e Fi gur e 5-10 ).
5-17 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 5 Understandi ng My Works pace Using the Web Interface Directly abov e the rule ta ble are tw o display o ptions: • Standard Polic y—Click to display the standard polic y rule table.
5-18 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 5 Understand ing My Workspace Importing and Exporting A CS Object s through t he Web Interfac e Related Topic • A CS 5.
5-19 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 5 Understandi ng My Works pace Importing and Exporting ACS Objects through the Web Interface Ta b l e 5 - 1 0 lists t he A CS objects, t h eir prop erties, a nd the pr operty data types.
5-20 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 5 Understand ing My Workspace Importing and Exporting A CS Object s through t he Web Interfac e Fields th at are optional can be l eft empty and A CS substitu tes the d efault values for those field s.
5-21 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 5 Understandi ng My Works pace Importing and Exporting ACS Objects through the Web Interface For example, when f ields that are rela ted to a hierarc hy are lef t blank, A CS assigns the v alue of the roo t node in the hierarch y .
5-22 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 5 Understand ing My Workspace Importing and Exporting A CS Object s through t he Web Interfac e • NDG – Locat ion.
5-23 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 5 Understandi ng My Works pace Importing and Exporting ACS Objects through the Web Interface Adding Re cords to the ACS Internal Store When you ad d records to the A CS internal stor e, you add the re cords to the exis ting list.
5-24 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 5 Understand ing My Workspace Importing and Exporting A CS Object s through t he Web Interfac e Figur e 5-13 Update Users–Im port File Note The second column, Upda ted name, is the addit ional column that you can add to the Update templ ate.
5-25 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 5 Understandi ng My Works pace Common E rrors Common Errors Y o u might en count er th ese co mmon er rors: • Concur.
5-26 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 5 Understand ing My Workspace Common Errors Error Message The item you are trying to Submit is referencing items that do not exist anymore.
5-27 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 5 Understandi ng My Works pace Accessibility System Failure Errors System f ailure errors occur when a syste m malfu nction is detec ted. When a system fa ilure e r ror is detecte d , a dia log box appe ars, wi th an error me ssage and OK b utton.
5-28 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 5 Understand ing My Workspace Accessi bility • Color use d as an enha ncem ent of inform atio n only , not as the onl y indi cator . For examp le, requ ired fi elds are associ ated with a r ed aster isk.
CH A P T E R 6-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 6 Post-Installation Configuration Tasks This chapter pro vides a set of config uration tasks that you must pe rform to work with A CS.
6-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 6 Post-Installation Configuration Tasks Configuring A CS to Perform Syst em Administr ation Tasks Configuring ACS to Pe rform System Administration Tasks Ta b l e 6 - 2 lists the set of system administration tasks that you must perform to administer A CS.
6-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 6 Post-Installa tion Configu ration Tas ks Configu ring ACS to Perfor m System Admini strati on Tasks Step 8 Add use rs or hosts to the internal identity sto re, or def ine exter nal identity stores, or both.
6-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 6 Post-Installation Configuration Tasks Configuring A CS to Manage Acc ess Policies Configuring ACS to Mana ge Access Policies Ta b l e 6 - 3 li sts the s et of tasks t hat you must perform to ma nage a ccess re striction s and permi ssions.
6-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 6 Post-Installa tion Configu ration Tas ks Configuring ACS to Mon itor and Troubleshoot Problems in the Network Step 4 E nable syste m alarms and speci fy how yo u would like to receiv e notif ication.
6-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 6 Post-Installation Configuration Tasks Configuring A CS to Monitor and Troubl eshoot Prob lems in the Network.
CH A P T E R 7-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 7 Managing Network Resou rces The N etwork R esources drawer de fines element s withi n the network t hat issu e reque sts to A CS or tho se that A CS interacts with a s part of processing a request.
7-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 7 M anaging N etwork Resou rces Network Device Group s Network Devic e Groups In A CS, you can define net work device g roups (N DGs), which a re set s of de vice s.
7-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 7 Managing N etwork Res ources Network Device Groups Step 4 Click Submit . The net work device group configurat ion is saved. The Networ k Device Groups pag e appear s with the new network device gr oup configu ration.
7-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 7 M anaging N etwork Resou rces Network Device Group s Creating, Duplicating, an d Editing Network Device Gr oups Withi.
7-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 7 Managing N etwork Res ources Network Devices an d AAA Clients Deleting Netw ork Device Gro ups from a Hier archy T o d elete a net work device gr oup from wit hin a hiera rchy: Step 1 Choose Network Resour ces > Network Device Gr oups .
7-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 7 M anaging N etwork Resou rces Network Devices and A AA Clients Y ou must install Securi ty Group Acces s licens e to enable Sec urity Grou p Access options.
7-7 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 7 Managing N etwork Res ources Network Devices an d AAA Clients – Descriptio n – NDG Locatio n – De vice T ype Y .
7-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 7 M anaging N etwork Resou rces Network Devices and A AA Clients Step 1 Choose Network Resour ces > Netwo rk Devices and AAA Clients . The Networ k Device page appea rs.
7-9 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 7 Managing N etwork Res ources Network Devices an d AAA Clients The Oper ation di alog box appear s . Step 2 Click Next to downlo ad the .csv fi le template if you do not hav e it.
7-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 7 M anaging N etwork Resou rces Network Devices and A AA Clients Exporting Netw ork Re sources and Users T o export a list of network resource s or users: Step 1 Click Export on the User s, Network Devices, or MAC Address page of the web inter face.
7-11 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 7 Managing N etwork Res ources Network Devices an d AAA Clients The first page of the Create Network D evice process app ears if you ar e crea ting a new networ k device.
7-12 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 7 M anaging N etwork Resou rces Network Devices and A AA Clients IP Rang e(s) By Mask Choose to ente r an IP address ra nge. Y ou can configure up t o 40 IP addre sses or subnet masks for each netw ork de vice.
7-13 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 7 Managing N etwork Res ources Network Devices an d AAA Clients Single C onnec t De vice Check to use a single T CP conn ection for all T A CAC S+ co mmunicati on with the netwo rk de vice.
7-14 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 7 M anaging N etwork Resou rces Network Devices and A AA Clients Displaying N etwork Devic e Properties Choose Netwo r.
7-15 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 7 Managing N etwork Res ources Network Devices an d AAA Clients IP Ran ge(s) By Mask Choo se to enter an IP address ra nge. Y ou can configure up t o 40 IP addresse s or subnet masks for each network de vice.
7-16 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 7 M anaging N etwork Resou rces Network Devices and A AA Clients RADIUS Sh ared Secret Shared secre t of the network device, i f you have enabled the RADIUS pro toco l.
7-17 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 7 Managing N etwork Res ources Configuring a Default Network Device Related Topics: • V iewing and Pe rformi ng Bulk.
7-18 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 7 M anaging N etwork Resou rces Configuring a D efault N etwork Dev ice Choose Network Resour ces > Default Netw o rk De vice to configure the de fault netwo rk device.
7-19 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 7 Managing N etwork Res ources Working with External Proxy Ser vers Related Topics • Network Device Groups, page 7 -.
7-20 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 7 M anaging N etwork Resou rces Working wit h External Proxy Servers Step 2 Do one of the follo wing: • Click Cr eate . • Check the check box ne xt to the external proxy ser ver that you want to duplica te, then click Duplicate .
7-21 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 7 Managing N etwork Res ources Wo rking with OCSP Services Note If you want A CS to for ward unkn own RADIUS attributes you have to define VSAs for pro xy .
7-22 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 7 M anaging N etwork Resou rces Working with OCSP Service s • Unknown —The certi ficate status is un known. The sta tus of the c ertificate is u nknown if the OCSP is no t configured to ha ndle the giv en certificate CA.
7-23 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 7 Managing N etwork Res ources Wo rking with OCSP Services Fail back T o Primary Server Enable this option to use th e secondary serv er for the gi ven amount of time when the pr imary is compl etely down.
7-24 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 7 M anaging N etwork Resou rces Working with OCSP Service s Step 4 Click Submit to sa ve you r changes. The OCSP Server con fig uratio n is sa ved. The O CSP Serv er page app ears w ith the ne w conf igurati on.
CH A P T E R 8-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 8 Managing Users and Identity Stores Overview A CS manages your n etwork devices and other ACS clients by using the ACS network re source repositor ies and ident ity stores .
8-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Overvi ew Fixed compone nts ar e: • Name • Descriptio n • Password • En.
8-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Over view Identity Stores with Two-Factor A uthentication Y ou can use the RSA SecurID T oken Serv er an d RADIUS Id entity S erver to pro vide two-f a ctor authenti cation.
8-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing Internal Iden tity Stores Identity Sequences Y ou can conf igure a comp lex condition wher e multiple id entity stores a nd prof iles are u sed to process a request.
8-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing Internal Identity Stores • Authentic ation inf ormation Note A CS 5.4 sup ports authenti cation for intern al users against th e inter nal ident ity store on ly .
8-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing Internal Iden tity Stores Identity Groups Y ou can assign each internal u ser to one identity gr oup. Identity groups are def ined within a hie rarchical structure .
8-7 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing Internal Identity Stores Related Topics • Managing Users and Identity.
8-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing Internal Iden tity Stores Standard Attributes Ta b l e 8 - 1 describes the standard attrib utes in the internal user record.
8-9 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing Internal Identity Stores In A C S 5.4, you ca n configure id entity attributes th at are use d within your polic ies, in thi s order : 1.
8-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing Internal Iden tity Stores Step 3 In the Advance d tab, enter the value s for the c riter ia that you want to configure for your u ser authenti cation proc ess.
8-11 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing Internal Identity Stores Step 4 Click Submit . The user passw ord is c o nfi g ured w ith the d ef ined crit eria. These cr iteria w ill apply only f or futur e logins.
8-12 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing Internal Iden tity Stores The Chang e Password page appears. Step 3 Comple te the fields as describe d in Ta b l e 8 - 4 to c hange th e i nternal user pa ssword.
8-13 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing Internal Identity Stores . T able 8-5 User s and Identity Sto r es > Int erna l Identity Stor e > User Pr operties P age Option Description General Name Username.
8-14 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing Internal Iden tity Stores Step 5 Click Submit . The use r co nfiguration is saved. The I nterna l Use rs page appea rs with the new con figuration.
8-15 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing Internal Identity Stores Deleting Users from In ternal Identity Stores T o delete a user from an int ernal identity store : Step 1 Select Use rs and Identity Stores > Internal Identity Store > Users .
8-16 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing Internal Iden tity Stores – Delete—Choo se this o ption to delete the internal users listed in t he import file from A C S.
8-17 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing Internal Identity Stores Step 4 Click Submit to save changes. The M A C addre ss co nfiguration is saved. The I nterna l MAC list page app ears w ith the new configurat ion.
8-18 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing Internal Iden tity Stores • V iewing and Per forming Bulk Operat io.
8-19 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing Internal Identity Stores Related Topics • Host Look up, p age 4- 13 .
8-20 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing Internal Iden tity Stores Configuring Users or Hosts for Management H.
8-21 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing Internal Identity Stores Step 8 After succe ssfully creati n g the polic y , try authentica ting the user using the create d polic y .
8-22 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores Managing External Identity Stores A CS 5.4 inte grates with e xternal id entity system s in a number of way s.
8-23 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores • Configuring L D A P Group s, pa ge 8-33 .
8-24 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores Failover A CS 5. 4 supports fai lover between a prim ary LDAP server and secon dary LDAP server .
8-25 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores Possible r easons f or a n LD AP server to retur n bind (authe nticat ion) err ors ar e: – Filterin g errors —A search using f ilter criteria fails.
8-26 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores • String • Unsigned In teger 32 • IP Address—T his can be either an IP version 4 (IPv4 ) or IP version 6 (IPv6) addr ess.
8-27 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores Step 4 Check th e En able Passwor d Cha nge opt ion t o modif y the password, to d etect t he passwor d expiratio n, and to reset the passwo rd.
8-28 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores Anonymous Acces s Cli ck to ensur e that searc hes on t he LDAP directo ry occur anonymousl y .
8-29 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores Step 2 Click Next . Step 3 Continue w ith Configur ing Extern al LDAP Director y Organization , page 8- 29 .
8-30 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores T able 8-8 LD AP: Dir ect ory Or ganization Pag e Option Description Schema Subject Obj ect class V alue of the LD AP o bjectClass attrib ute that identif ies the subject.
8-31 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores Subje cts In Groups Ar e Stored In Me mber At.
8-32 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores Step 2 Click Fin ish .
8-33 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores Related Topics • Configuring L D A P Group .
8-34 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores Viewing LDAP Attribute s Use this page to vie w the ex ternal LD AP attrib utes. Step 1 Select Use rs and Identity Stores > External Identity St ores > LD AP .
8-35 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores This me ans the swit ch port to wh ich th ese de vices att ach cannot authentic ate them using the 80 2.
8-36 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores Figur e 8-1 LD AP Interf ace Configur ation in NA C Pr ofiler Step 5 Click Updat e Server . Step 6 Click the Configuration tab and click Apply Changes .
8-37 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores Step 2 Choose Configuration > Endpoint Prof iles > V iew/Edit Prof iles List . A list of prof iles in a table appears.
8-38 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores T o edit t he N A C Prof iler templa te in A CS: Step 1 Choose Use rs and Identi ty Stores > External Iden tity Stores > LDAP .
8-39 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores Figur e 8-5 T est Bind to Serv er Dialog Bo x For more inf ormati on, see Creating Exte rnal LD AP Identity Stores, page 8-26 .
8-40 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores Figur e 8-7 T est Configur ation Dialog Bo .
8-41 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores Troubleshooting MAB Authentication with Profi.
8-42 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores • Maximu m passwor d ag e is N day s. • Mini mum pas sw ord a ge is N da ys. • Mini mum passw ord length is N char acter s.
8-43 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores Note T o prevent A CS from using the outdate d ma ppings, you sh ould cr eate new AD grou ps in stead of chan ging or moving the existing ones.
8-44 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores Machin e authentica tion happens while star ting up a compu ter or whil e logging in to a computer .
8-45 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores If the user has one of these limitati o ns, the AD1::Iden tityAccessR estricted attribu te on t h e AD dedicated dictionar y is se t to indic ate tha t the u ser has re strict ed acc ess.
8-46 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores The E nginee rs' rule is an ex ampl e of MA R rule th at on ly allow s engineers acces s if their m achine was succes sfully authen ticated against windo ws DB.
8-47 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores The dist rib uted search is performe d based on the cach e entry qu ery attem pts and cach e entry query timeouts that are configu red in the A CS web interface.
8-48 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores Callback Options fo r Dial-In users If the callba ck option is enabled , the serve r calls the caller back during the connecti o n process.
8-49 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores The callb ack numb er v alue is also returned o n the RADI US respon se, usin g the RADI US attrib ute Cal lback Number (#19 ).
8-50 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores Note Whe n you upgrad e A CS t o A CS 5.
8-51 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores • Sa ve Changes to sav e the configurati o n.
8-52 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores Step 4 Click: • Joi n to join the selec ted nodes to th e AD do main. T he sta tus of the nodes are changed ac cording to the join results.
8-53 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores Step 4 Click: • Leav e to disc onne ct th e sele cted nodes from AD do main. • Cancel to ca ncel the oper ation.
8-54 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores The Grou ps page appe ars. Th e Selec ted Dire ctory Gr oups field lists the AD groups you selected and sav ed.
8-55 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores Step 3 Click: • Sa ve Changes to sav e the configurati o n. • Discard Changes to discard a ll cha nges.
8-56 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores • If AD is al ready configur ed and you w.
8-57 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores AD Deployments with User s Belonging to Large Number of Groups In A CS 5.
8-58 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores Thus wh en a cor rect t oken co de is sup plied toge ther w ith a PIN , ther e is a h igh degre e of cer taint y that the per son is a v alid user .
8-59 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores Manually I ntervene to Remove a Down RSA Se curID Server When a n RSA Se curID serv er is do wn, the au tomatic exclusion m echanism does n ot alway s wo rk quickly .
8-60 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores Step 5 Click the Adv anced tab . See Con figuring Advanced Options, page 8-6 2 for more i nfor matio n.
8-61 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores Editing ACS Insta nce Settings Y ou can edit .
8-62 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores Step 1 Choose either of the follo wing options: • T o r eset node secret on t he agen t host, chec k th e Remove securid f ile on submit ch eck box .
8-63 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores • Creatin g and E diting RSA Secu rID T oke.
8-64 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores Failover A CS 5.4 allo ws you to co nfigur e multiple RADIUS identity stor es. Ea ch RADIUS id entity st ore can hav e pri mary a nd sec ondary RADI US se rvers.
8-65 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores RADIUS Iden tity Store in Identity Sequenc e Y ou can add the RADIUS identity st ore for authentic ation sequen ce in an identi ty sequen ce.
8-66 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores Safeword token servers support both the formats.
8-67 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores • Check the check box next to the iden tity store you want to duplicate, th en click Duplicate .
8-68 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores Related Topics • RADI US Iden tity Sto re.
8-69 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Managing External Identity Stores Configur ing She ll Prompts For T A CACS+ ASCII auth entication, A CS must return the passw ord prompt to the us er .
8-70 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Managing External Ident ity Stores Step 2 Do either of the foll ow ing: • Click Submit to save yo ur change s and retur n to t he RADIUS Iden tity Ser vers p age.
8-71 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Configuring CA Certificates Click Submit to save t he RADIUS Id entity Ser ver .
8-72 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Configuring CA Certificates Note A CS buil d s a certif icate chain with the CA cer tific ates that you add to it and uses this chain during TLS nego tiations.
8-73 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Configuring CA Certificates Editing a Certificate Authori ty and C onfiguring Certificate Revocation Lists Use this page to edit a trusted CA (Certif icate Author ity) certif icate.
8-74 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Configuring CA Certificates Step 3 Click Submit . The Trust Cer tificat e pag e appe ars with th e ed ited certi ficate. The ad minist rator has th e righ ts to configure CRL and OCSP ver ification.
8-75 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores Configuring Certificate Authentication Profiles The T rust Certif icate page appea rs without th e delet ed certif icate(s).
8-76 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Configuring Ce rtificate A uthenticat ion Profiles When A CS processe s a cert.
8-77 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores C onfiguring Identity Store Seq uences Step 4 Click Submit.
8-78 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Configuring I dentity Stor e Sequences Attribute Retrieval Sequence Y ou can optionally d ef ine a list o f databases f rom which to retrie ve additio nal attrib utes.
8-79 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores C onfiguring Identity Store Seq uences Password Base d Check this chec k box to use the password-ba sed authen ticatio n meth od.
8-80 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Configuring I dentity Stor e Sequences Step 3 Click Submit .
8-81 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 8 Managing U sers and Iden tity Stores C onfiguring Identity Store Seq uences • Mana ging In ternal Iden tity Sto re.
8-82 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 8 Managing Use rs and Id entity Sto res Configuring I dentity Stor e Sequences.
CH A P T E R 9-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 9 Managing Policy Elements A polic y defines the authentica tion and au thorization processing of c lients that at tempt to access the A CS network. A cli ent c an be a user, a networ k device, or a us er associat ed with a network device.
9-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 9 Managing P olicy Elemen ts Managing Policy Condit ions Y o u can m ap users and h osts to identit y gro ups by using the group ma pping policy .
9-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 9 Managing Po licy Elem ents Mana gi ng Pol icy C ond ition s • Creatin g, Dupl icat ing, and E diting a D ate and Ti.
9-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 9 Managing P olicy Elemen ts Managing Policy Condit ions T o a dd date a nd time condi tions to a policy , yo u must first cu stomiz e the rule t able. See Cu stomizing a Policy , page 1 0-4 .
9-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 9 Managing Po licy Elem ents Mana gi ng Pol icy C ond ition s Related Topics • Creating, Du plicating, a n d Editing .
9-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 9 Managing P olicy Elemen ts Managing Policy Condit ions T o ad d custom c onditio ns to a po licy , you must first cu stomiz e the rule table. Se e Customi zing a Pol icy , page 10-4 .
9-7 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 9 Managing Po licy Elem ents Mana gi ng Pol icy C ond ition s Note Th e filters in ACS 5.4 are similar to t he NARs in A CS 4.x. In A CS 4.x, the N ARs were base d on eithe r the user or us er gr oup.
9-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 9 Managing P olicy Elemen ts Managing Policy Condit ions The device dictionary (the NDG dictionary) cont ains networ k device group attributes s uch as Location , De vice T ype, or other d ynamically created attrib utes that r epresent NDGs.
9-9 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 9 Managing Po licy Elem ents Mana gi ng Pol icy C ond ition s Step 5 Click Close to close the I mport Pr ogress window . Y o u can submi t only one .csv file to the system at on e t ime.
9-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 9 Managing P olicy Elemen ts Managing Policy Condit ions Note T o conf igure a f ilter , at a minimum, you must enter f ilter criteria in at least one of the three ta bs.
9-11 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 9 Managing Po licy Elem ents Mana gi ng Pol icy C ond ition s • Def ining MA C Address-Based End Station Filte rs, p.
9-12 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 9 Managing P olicy Elemen ts Managing Policy Condit ions Step 2 Check the CL I check box t o enter the CL I numbe r of the end stat ion. Y ou can optiona lly set t his fi eld to A NY to re fer to a ny CLI number .
9-13 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 9 Managing Po licy Elem ents Mana gi ng Pol icy C ond ition s Note T o conf igure a f ilter , at a minimum, you must enter f ilter criteria in at least one of the three ta bs.
9-14 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 9 Managing P olicy Elemen ts Managing Policy Condit ions Defining Name-Based Device Filters Y o u can cr eate, duplica te, an d edi t the nam e of t he network d evice that yo u want t o permi t or deny ac cess to.
9-15 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 9 Managing Po licy Elem ents Mana gi ng Pol icy C ond ition s Creating, Duplicating, and Editi ng Device Port Filters Use the De vice Port Filters page to create, duplic ate, and edit devi ce port f ilters.
9-16 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 9 Managing P olicy Elemen ts Managing Policy Condit ions • Check the check bo x next to the IP-b ased dev ice port f ilter that you want to duplicate , then click Duplicate .
9-17 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 9 Managing Po licy Elem ents Managi ng Authoriz ations a nd Permissi ons Step 3 Check the Por t check box a nd enter t he port num ber .
9-18 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 9 Managing P olicy Elemen ts Managing Authoriza tions and Permissions • Security groups and securi ty group ACLs for Cisco Securi ty Group Acce ss. See ACS and Cisco Security Group Acce ss, page 4-23 , for information on conf iguring these polic y elements.
9-19 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 9 Managing Po licy Elem ents Managi ng Authoriz ations a nd Permissi ons • Click t he nam e tha t y ou want t o mo dify; or , check the chec k box next to t he na me tha t you want t o modify a nd click Edit .
9-20 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 9 Managing P olicy Elemen ts Managing Authoriza tions and Permissions Step 1 Select P olicy Elements > A uthorizati.
9-21 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 9 Managing Po licy Elem ents Managi ng Authoriz ations a nd Permissi ons T able 9-5 A uthor ization Pr ofile: Common T asks P ag e Option Description ACLS Do wnloadable A CL Name Includes a def ined do wnload able A CL.
9-22 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 9 Managing P olicy Elemen ts Managing Authoriza tions and Permissions Specifying RADIUS Attribute s in Authorization Profil es Use this tab t o conf igure which RADIUS attrib utes to includ e in the Access -Accept p acket f or an authori zation prof ile.
9-23 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 9 Managing Po licy Elem ents Managi ng Authoriz ations a nd Permissi ons Step 3 T o conf igure: • Basic informatio n of an authorizatio n profile ; see Specifyin g Auth orizat ion Pr ofiles, page 9-19 .
9-24 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 9 Managing P olicy Elemen ts Managing Authoriza tions and Permissions Creating and Editing S ecurity Grou ps Use this .
9-25 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 9 Managing Po licy Elem ents Managi ng Authoriz ations a nd Permissi ons The Com mon T asks tab al lows you to select and c onfigure the fre quently used attributes for the pr ofile.
9-26 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 9 Managing P olicy Elemen ts Managing Authoriza tions and Permissions Defining Gen eral Shell Prof ile Properties Use this page to defin e a shell prof ile’ s general properties.
9-27 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 9 Managing Po licy Elem ents Managi ng Authoriz ations a nd Permissi ons T able 9-9 Shell P ro file: Comm on T asks Op.
9-28 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 9 Managing P olicy Elemen ts Managing Authoriza tions and Permissions Step 3 Click: • Submit to save your cha nges an d retu rn to t he She ll Profiles pa ge.
9-29 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 9 Managing Po licy Elem ents Managi ng Authoriz ations a nd Permissi ons Defining Custom Attributes Use this tab to defin e custom attrib utes for the shell profile.
9-30 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 9 Managing P olicy Elemen ts Managing Authoriza tions and Permissions After yo u create comm and sets, you c an use them in aut horizat ions and permissi ons wi thin rule tables.
9-31 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 9 Managing Po licy Elem ents Managi ng Authoriz ations a nd Permissi ons Step 4 Click Submit . The com mand set is saved. Th e Comm and Se ts page appe ars with the c ommand set th at yo u create d or duplicat ed.
9-32 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 9 Managing P olicy Elemen ts Managing Authoriza tions and Permissions Related Topics • Creatin g, Duplic ating , and.
9-33 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 9 Managing Po licy Elem ents Managi ng Authoriz ations a nd Permissi ons – Click Start Export to export the D ACLs without any enc ryption .
9-34 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 9 Managing P olicy Elemen ts Managing Authoriza tions and Permissions Configurin g Security Grou p Acce ss Cont rol Lists Securi ty group ac cess cont rol list s (SGACLs) are applie d at Egress, ba sed on the sour ce an d destinat ion SGTs.
CH A P T E R 10-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 10 Managing Acc ess Policies In A CS 5.4, polic y dri ves all acti vities. Policies consist m ainly of rules th at determi ne the actio n of the polic y . Y ou create acc ess services to def ine authentica tion and authorization policies fo r requests.
10-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Policy Creation F low In short, you must determine th e: • Details of your ne twork configurat ion. • Access ser v ices that imp lement y our policie s.
10-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Policy Creation Flow Policy Elements in the Policy Creation Flow The web interf ace pro.
10-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Customizing a Pol icy Policy Creation Flow—Next Steps • Access Service Po licy Creati.
10-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Configuring the Service Selection Policy If you have implemented Sec urity Group Acce ss functiona lity , you can al so custom ize results fo r authorizati o n policies.
10-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring t he Service Se lection Policy Note If you create and sav e a simple p olicy , and the n change to a rule-b ased polic y , the simple policy becomes the defau lt rule of th e rule-b ased poli cy .
10-7 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Configuring the Service Selection Policy T o conf igure a rule- based s ervice selectio.
10-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring t he Service Se lection Policy Creating, Duplicatin g, and Editing Servic e Selection Rules Create se rvice select ion rules to deter mine which a ccess service processes in coming r equests.
10-9 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Configuring the Service Selection Policy • The Defau lt Ru le— Y ou can chan ge onl y the acc ess se rvice. See T able 1 0-3 for field descr iptions: Step 4 Click OK.
10-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring t he Service Se lection Policy Displaying Hit Counts Use this page to reset and refresh the Hit Count display on the Rule-base d Policy page.
10-11 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Configuring Access Services Configuring Acce ss Services Access services cont ain the authen tication and authoriza tion policie s for r equests .
10-12 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring A ccess Services Step 3 Edi t the fiel ds i n t he Al lowed Protoc ols tab as de scribed in Ta b l e 1 0 - 7 . Step 4 Click Submit to sa ve th e changes y ou hav e made to the de fault access ser vice.
10-13 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Configuring Access Services Step 2 Do one of the follo wing: • Click Cr eate . • Check t he check box next to t he ac cess ser vice that you wa nt to dupli cate; then cli ck Duplicate .
10-14 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring A ccess Services Description Description of the access service. Access Servi ce Policy Structu re Based on serv ice templat e Creates an access service conta ining policies b ased on a predefined te mplate.
10-15 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Configuring Access Services Step 3 Click Next to conf igure the allo wed protocols. See Configuring Access Service A llowed Protocols, page 10-1 6 .
10-16 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring A ccess Services Configuring Access Service Allowed Protocols The allowed p rotoco ls ar e t he se cond part o f ac cess servi ce creat ion.
10-17 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Configuring Access Services Allo w EAP-TLS Enables t he EAP-TLS Auth entication protocol a nd conf igures EA P-TLS settings.
10-18 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring A ccess Services Allo w EAP-F AST Enab les the EAP-F AST authentication protocol and EAP-F AST settings. The EAP-F AST proto col ca n suppo rt multip le int ernal pr otocol s on the same server .
10-19 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Configuring Access Services Allo w EAP-F AST (conti nued) PA C O p t i o n s • T unnel P A C T im e T o Li ve—The T ime T o Li ve (TTL) v alue restricts the lifetime o f the P A C.
10-20 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring A ccess Services Step 3 Click Fin ish to sa ve your changes to t h e acce ss service. T o enabl e an access service, you mu st add it to the se rvice sele ction pol icy .
10-21 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Configuring Access Services Deleting an Ac cess Service T o delete an access serv ice: Step 1 Select Ac cess Policies > Access Services .
10-22 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring A ccess Serv ice Polic ies Configuring Acce ss Service Policies Y ou confi g.
10-23 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Configuring Access Service Policies In the rule-b ased polic y , each rule contains one or mo re conditions an d a result, which i s the identity source to use for authentica tion.
10-24 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring A ccess Serv ice Polic ies Viewing Rules-Based Identi ty Policies Select Ac cess Policies > Access Services > service > Identity , wher e <ser vi ce> is the name of the acces s service.
10-25 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Configuring Access Service Policies • Creating Pol icy Rules, page 10-38 • Duplic .
10-26 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring A ccess Serv ice Polic ies T able 1 0-1 1 Identity Rule Pr oper ties P age Option Description General Rule Name N ame of the ru le.
10-27 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Configuring Access Service Policies Configuring a Group Mapping Policy Conf ig ure a group mapping polic y to map groups and attrib utes that are retrie ved from extern al identity stores to A CS identity groups.
10-28 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring A ccess Serv ice Polic ies Step 2 Select a n identity group.
10-29 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Configuring Access Service Policies • Deleting Po licy Ru les, page 10-40 Related To.
10-30 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring A ccess Serv ice Polic ies Configuring a Session Authoriz ation Policy for Network Ac cess When yo u creat e an access serv ice for netw ork ac cess aut h orizat ion, it creates a Session Authori zation polic y .
10-31 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Configuring Access Service Policies T able 1 0-15 Networ k A ccess A uthor ization P olicy P age Option Description Status Rule sta tuses are: • Enabled—Th e rule is acti ve.
10-32 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring A ccess Serv ice Polic ies Configuring Ne twork Acce ss Au thorization R ule Properties Use this page to create, dup licate, and edit th e rules to determine acce ss permissions in a network acce s s service.
10-33 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Configuring Access Service Policies Configuring Device Administration Authorization Policies A device admi nistratio n autho rization policy det ermines the aut horizat ions an d permi ssions for network admini strat ors.
10-34 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring A ccess Serv ice Polic ies Configuring Device Administratio n Authorization .
10-35 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Configuring Access Service Policies Configuring Shell/Command Authorizatio n Policies .
10-36 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring A ccess Serv ice Polic ies T o conf igure rules, see: • Creating Pol icy R.
10-37 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Configuring Access Service Policies T o conf igure rules, see: • Creating Pol icy Ru.
10-38 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring A ccess Serv ice Polic ies Creating Policy Rules When you crea te rules, remember that the order of the rules is im portant.
10-39 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Configuring Access Service Policies Duplicating a Rule Y ou can duplicat e a rule if yo u want to create a ne w rule that is the same , or ve ry similar to , an e xisting rule.
10-40 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring A ccess Serv ice Polic ies Step 4 Click OK . The Polic y page appears with the ed ited rule. Step 5 Click Sa ve C hanges to save th e new conf iguration.
10-41 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Config uring Compo und Con diti ons Configuring Co mpound Conditions Use compound conditions to d efi ne a set of c onditions based on any at tributes allo wed in simple pol icy conditi ons.
10-42 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring Co mpound Con ditions Note D ynamic at tribute mappi ng is not ap plica ble for Ex tern alGro ups attr ibute of T ype "String Enum" an d "T ime And Date " attrib ute of type "Date T ime Perio d".
10-43 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Config uring Compo und Con diti ons Figur e 1 0-2 Compound Expr ession - At omic Conditio n Single Nested Compound Co ndition Consis ts of a singl e operat or follo wed b y a set of pr edicates (>=2) .
10-44 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Configuring Co mpound Con ditions Figur e 1 0-4 Multiple Nest ed Compound Expr ession Co.
10-45 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Config uring Compo und Con diti ons Related Topics • Compound Con dition Buil ding B.
10-46 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Security Grou p Access Control Page s Related Topics • Compound Con dition Bui lding B.
10-47 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Security Gro up Access Contro l Pages Related Topic • Creatin g an Eg ress Po licy , page 4- 27 Editing a Cell in th e Egress Policy Matrix Use thi s page to co nf igure t he polic y for the select ed cell.
10-48 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Security Grou p Access Control Page s NDAC Policy Page The N etwork Device Admission Cont rol (N DA C) pol icy deter mines t he SGT for ne twork d evices in a Security Group Access e n vi ronment .
10-49 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Security Gro up Access Contro l Pages Related Topics: • Conf igur ing an ND A C Poli.
10-50 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Security Grou p Access Control Page s Note For end point adm ission con trol, you must de f ine an a ccess serv ice and s ession aut horizatio n policy .
10-51 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Maximum Use r Sess ions Network Dev ice Acce ss EAP- FAST Settings Page Use this page to conf igure parameters f or the E AP-F AST protocol t h at the ND A C polic y uses.
10-52 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Maximum User Sessions Max Session User Settings Y o u can configure ma ximu m user session to impose maxim um sessi on value for each users.
10-53 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Maximum Use r Sess ions Unlimited is select ed by defau lt.
10-54 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Maximum User Sessions Related topics • Maximum User Sessi ons, pa ge 10-51 • Max Ses.
10-55 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 0 Managing Ac cess Polici es Maximum Use r Sess ions The Purge User Ses sion pag e appear s with a lis t of all AAA cli ents. Step 2 Select the AAA client for which you want to purge the user sessions.
10-56 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 10 Managing Access Policie s Maximum User Sessions Maximu m User Sessio n in Proxy Scenar io Authentic ation and accoun ting requests should be sent to the same A CS serve r , else the Maximum Session fe ature w ill not work as desi red.
CH A P T E R 11-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 11 Monitoring and Reporting in ACS The Monitori ng a nd Repo rts d rawer a ppears i n the pri mary w eb in terface wind ow and conta ins the Launch Moni tori ng an d Rep ort V iewer optio n.
11-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapte r 11 Monit o ring an d Reporti ng in ACS Authent ication Records and D etails • Support for n on-Engl ish cha racter .
11-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 1 Monitoring and Reporting in ACS Dashbo ard Pa ges Note Th ese tabs ar e custom izable , and you ca n modify or delete th e following tabs.
11-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapte r 11 Monit o ring an d Reporti ng in ACS Work ing wit h Port lets – Authentic ation Snapsh ot—Prov ides a snap shot of au thenticatio ns in t he graphic al and ta bular format s for up to the p ast 30 days.
11-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 1 Monitoring and Reporting in ACS Working with Portlets Figur e 1 1 -1 P ortlets T op 5 Alar ms an d My Favorite Report s appea r in sep arate windows. Y ou can e dit e ach of thes e portle ts separately .
11-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapte r 11 Monit o ring an d Reporti ng in ACS Configuring Ta bs in the D ashboard Related Topic • Das hbo ard P ages, page.
11-7 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 1 Monitoring and Reporting in ACS Configuring Tabs in the Dashboard Step 5 Click Add Page .
11-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapte r 11 Monit o ring an d Reporti ng in ACS Configuring Ta bs in the D ashboard Changing the Dash board L ayout Y o u can chan ge the loo k and fee l of the Dash board . A CS provi des you wit h nine different in-built layouts.
CH A P T E R 12-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 12 Managing Alarms The Moni torin g featur e in A C S genera tes alarm s to notify you of critic al system co nditi ons. The monitori ng comp onent r etrieves data fro m ACS.
12-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 12 M anaging Alarms Underst anding Alarms System Alarms System alarms notify you of critica l conditions encountered du ring the ex ecution of the A CS Monitoring and Reportin g vie wer .
12-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 2 Managing Al arms Viewi ng a nd Ed itin g Al arms i n Your In box Notifying Users of Events When a threshold is reached o r a s ystem alarm i s gen erated, the alarm appears in t he Alarms I nbox o f the web in terfa ce.
12-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 12 M anaging Alarms Viewing and Ed iting Al arms in Your I nbox Ti m e Displ ay only . Indicates t he time of the as sociate d alarm ge neration in the f ormat Ddd Mmm dd hh:mm: ss timezon e yyyy , wher e: • Ddd = Sun, Mon, Tue, W ed, Th u, Fri, Sat.
12-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 2 Managing Al arms Viewi ng a nd Ed itin g Al arms i n Your In box Configure Inc rement al Back up Dat a Reposito ry as Rem ote Rep ository otherwi se backup will fail and I ncremental bac kup mode will be chang ed to off.
12-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 12 M anaging Alarms Viewing and Ed iting Al arms in Your I nbox Full Database Pur ge Backup f ailed: Exception Details.
12-7 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 2 Managing Al arms Viewi ng a nd Ed itin g Al arms i n Your In box Note Th e Alarm for A CS dat abase exceedi ng the quot a is sent only wh en the total size of the A CS database exceeds the quo ta.
12-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 12 M anaging Alarms Viewing and Ed iting Al arms in Your I nbox Note ACS cannot be use d as a rem ote syslog server . But , you can us e an external server as a s ysl og ser ver .
12-9 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 2 Managing Al arms Understandi ng Alarm Sch edules Related Topics • Creatin g, Editing, a nd Duplicat ing Alarm Th.
12-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 12 M anaging Alarms Underst anding Al arm Schedu les Step 3 Click Submit to sa ve th e alarm schedu le. The schedule that y ou create is added to the Schedule list box in the Thre shold pages.
12-11 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 2 Managing Al arms Crea ting, Editing, and Duplicating Alarm Thresh olds Deleting Alarm Schedules Note Before you delete an alar m schedule, ensu re that it is not referenced by an y thresholds tha t are def ined in A CS.
12-12 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 12 M anaging Alarms Creating, Edi ting, and D uplicating Alarm Th resholds Step 2 Do one of the follo wing: • Click Cr eate . • Check th e check box next to the a larm t hat you want to duplicat e, then click Duplicate .
12-13 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 2 Managing Al arms Crea ting, Editing, and Duplicating Alarm Thresh olds Related Topics • Conf igur ing Gener al .
12-14 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 12 M anaging Alarms Creating, Edi ting, and D uplicating Alarm Th resholds Configuring Threshold Criteria A CS 5.
12-15 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 2 Managing Al arms Crea ting, Editing, and Duplicating Alarm Thresh olds Note Y o u can specify one or more filter s to limit the passed aut hentications that are consi dered for thresho ld e valuation.
12-16 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 12 M anaging Alarms Creating, Edi ting, and D uplicating Alarm Th resholds Related Topics • Creatin g, Editing, a n.
12-17 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 2 Managing Al arms Crea ting, Editing, and Duplicating Alarm Thresh olds An alar m is triggere d because at least one De vice IP has gr eater than 10 fai led authen tications in the past 2 hours.
12-18 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 12 M anaging Alarms Creating, Edi ting, and D uplicating Alarm Th resholds Related Topics • Creatin g, Editing, a n.
12-19 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 2 Managing Al arms Crea ting, Editing, and Duplicating Alarm Thresh olds The aggr egation job b egins at 00:05 hou rs every day . From 23:50 ho urs, up u ntil the t ime the a ggregation job compl et es, th e auth ent icat ion in activity alar ms are s upp resse d.
12-20 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 12 M anaging Alarms Creating, Edi ting, and D uplicating Alarm Th resholds Related Topics • Creatin g, Editing, a n.
12-21 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 2 Managing Al arms Crea ting, Editing, and Duplicating Alarm Thresh olds Related Topics • Creatin g, Editing, a n.
12-22 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 12 M anaging Alarms Creating, Edi ting, and D uplicating Alarm Th resholds Related Topics • Creatin g, Editing, a n.
12-23 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 2 Managing Al arms Crea ting, Editing, and Duplicating Alarm Thresh olds Related Topics • Creatin g, Editing, a n.
12-24 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 12 M anaging Alarms Creating, Edi ting, and D uplicating Alarm Th resholds Related Topics • Creatin g, Editing, a n.
12-25 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 2 Managing Al arms Crea ting, Editing, and Duplicating Alarm Thresh olds Related Topics • Creatin g, Editing, a n.
12-26 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 12 M anaging Alarms Creating, Edi ting, and D uplicating Alarm Th resholds Related Topics • Creatin g, Editing, a n.
12-27 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 2 Managing Al arms Crea ting, Editing, and Duplicating Alarm Thresh olds Unknown NAD When A CS e v aluates this thr.
12-28 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 12 M anaging Alarms Creating, Edi ting, and D uplicating Alarm Th resholds Related Topics • Creatin g, Editing, a n.
12-29 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 2 Managing Al arms Crea ting, Editing, and Duplicating Alarm Thresh olds Y ou can spec ify one o r more f ilters to lim it the f ailed authentic ations t h at are co nsider ed for threshold e valuation.
12-30 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 12 M anaging Alarms Creating, Edi ting, and D uplicating Alarm Th resholds If, in the p ast fo ur hou rs, RBA CL d ro.
12-31 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 2 Managing Al arms Crea ting, Editing, and Duplicating Alarm Thresh olds NAD-Reported AAA Downtime When A CS e v aluates this thresh old, it e xamines the N AD-reported AAA d o wn e vents that occurred during the specified inter val up to the previous 24 hour s.
12-32 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 12 M anaging Alarms Creating, Edi ting, and D uplicating Alarm Th resholds Related Topics • Creatin g, Editing, a n.
12-33 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 2 Managing Al arms Deleting Ala rm Threshol ds Related Topics • V iewing and E diti ng Alar ms in Y our Inbo x, p.
12-34 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 12 M anaging Alarms Configuring Sy stem Ala rm Settings Configuring System Alarm Settings System alarms ar e used to .
12-35 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 2 Managing Al arms Unders tanding Alarm Sy slog Targ ets Understandin g Alarm Syslog Targets Alarm syslog tar gets are the destinations where alarm syslog messages are sent.
12-36 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 12 M anaging Alarms Underst anding Alarm Sysl og Targe ts Step 4 Click Submit .
CH A P T E R 13-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 13 Managing Reports The Moni toring a nd Report V i ewer component of A CS co llect s log and configurat ion data from various A CS server s in you r deploy ment, ag gre gates it, and pro vides interacti ve r eports that h elp you analyze the dat a.
13-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports • Catalog— Monitoring and Reports > Reports > Catalog > < rep o r t _ t y pe > For easy acces s, you can add reports to yo ur Fa vorites page , from whi ch you can cus tomiz e and dele te reports .
13-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Wo rking with Favorite Reports This chapte r describes in detail the follo wing: • W ork ing wi.
13-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Working wit h Favor ite Report s Step 5 Click Add to F a vorite .
13-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Wo rking with Favorite Reports Editing Favorite Reports After you view the existing parame ters in your favorite report , you can edit th em.
13-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Sharing Repor ts The repor t is gener ated i n the page .
13-7 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Working w ith Catalog Reports Step 7 Click Sa ve .
13-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Working wit h Catalog Report s T A CA CS Authentication Provides T ACA CS+ authentic ation details for a select ed time per iod.
13-9 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Working w ith Catalog Reports A CS Log Info rmat ion Provides ACS log inform ation for a parti cular log cate gory and A CS serve r for a selected tim e peri od.
13-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Working wit h Catalog Report s Networ k Devic e Au then tic ati on Su mm ary Pro vides the RA.
13-11 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Working w ith Catalog Reports Running C atalog Re ports T o run a repo rt th at is in th e Ca ta.
13-12 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Working wit h Catalog Report s The av ailable reports for the report type you select ed are disp layed with the informa tion shown in T able 13- 3 .
13-13 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Working w ith Catalog Reports Note Y ou cannot delete system re ports fro m the Reports > Catalog pages; y ou can de lete cu stomize d reports only .
13-14 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Working wit h Catalog Report s Related Topics • W orki ng with Cata log Repor ts, page 13 -.
13-15 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Working w ith Catalog Reports Identity Group Enter an identity group nam e or click Select to enter a v a lid iden tity gr oup name on which to run yo ur repor t.
13-16 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Working wit h Catalog Report s Comm and Accounting On ly Check the ch eck box to enable yo ur repo rt to run for comm and acco unting .
13-17 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Working w ith Catalog Reports Related Topics • W orkin g with Cata log Report s, page 13-7 •.
13-18 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Working wit h Catalog Report s Changing Authorizatio n and Discon necting Active RA DIUS Session s Note Som e of th e N ADs i n you r deploym ent do not send an Ac counti ng Stop or Acc ountin g Off packet af ter a reload.
13-19 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Working w ith Catalog Reports Figur e 13-3 CoA Options Step 4 Click Run to reauthenti cate or disc onnect the RADIU S session.
13-20 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports View ing Rep orts Note If you save the customi zed report with t he same name a s the original system repo rt (overwriting the or igina l system repo rt), yo u ca nnot de lete i t.
13-21 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Viewing Re ports About St andard Viewer From Stand ard V iewer , you ca n open a tab le of content s, navigate the repo rt, export data t o spreadshe et format , and prin t the repo rt.
13-22 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports View ing Rep orts Figur e 13-5 Cont ext Men u f or Labels in Int era ctive Viewer If the rep .
13-23 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Viewing Re ports Using the Table of Contents In the viewer , you can open a ta ble of conte nts to view the report struc ture and n avigate t he re port .
13-24 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports View ing Rep orts Exporting Re port Da ta The vie wer supports the ability to e x port report da ta to an Excel spread sheet as a comma-sep arated values (.
13-25 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Viewing Re ports Figur e 13-12 The Expor t Da ta Dialog Box A vailab le Result Sets lists the tables in the report. A vailable Co lumn s lists the colu mns you c an export fr om the speci fied table.
13-26 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports View ing Rep orts Printing Reports Y o u can p rint a report that ap pears i n the viewer in H TML or PDF f ormat.
13-27 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Formatting Repor ts in Interactive Viewer Figur e 13-13 Sav e Dialog Bo x Step 2 Nav igate to the location wher e you want to sa ve the f ile. Step 3 T ype a file na me an d cli ck Save .
13-28 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Formatti ng Reports in In teractive Vi ewer The text of a column header come s from t he data s ource.
13-29 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Formatting Repor ts in Interactive Viewer • Modify the f ont, col or , style , and other propert ies of the text . • Specify t hat t he column disp lays up percase or lowercase.
13-30 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Formatti ng Reports in In teractive Vi ewer Formatting Data in Aggregate Rows An aggr eg ate row dis plays a total , aver age, or ot her summary da ta for a colu mn.
13-31 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Formatting Repor ts in Interactive Viewer . Formatting N umeric Data Numeric data can t ake s e veral f orms. A colum n of postal codes require s differen t fo rmatti ng fro m a column of sal es figures.
13-32 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Formatti ng Reports in In teractive Vi ewer The data type of a column is deter mined by the data source . Ke ep in mind that a text or str ing data type can conta in nu meric d igits.
13-33 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Formatting Repor ts in Interactive Viewer Formatting C ustom Numeric Data T o def ine a custom form at, you use special sy mbols to constru ct a format pattern.
13-34 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Formatti ng Reports in In teractive Vi ewer 415-555-2121 Y o u can cr eate c ustom formats for str ing data . T ab le 13-8 describ es the sy mbols yo u can use to define custom string formats .
13-35 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Formatting Repor ts in Interactive Viewer Step 4 Click A pply . Formatting Date and Time The appe aranc e of date and tim e data depends on t he loca le in whi ch you are working.
13-36 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Formatti ng Reports in In teractive Vi ewer T o create a cust om date or time fo rmat, Step 1 Sele ct a dat e-an d-ti me co lumn , th en clic k Fo r m a t .
13-37 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Formatting Repor ts in Interactive Viewer Figur e 13-1 7 Specifying Disp lay V alues f or T r ue an d F alse Applying Condition al Formats Conditional formattin g changes th e formatti ng of data whe n a certain condition i s true.
13-38 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Formatti ng Reports in In teractive Vi ewer After you c reate the con dition, you set th e format in which to displ a y data tha t meets the co ndition.
13-39 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Formatting Repor ts in Interactive Viewer Figur e 13-20 T wo Compar ison V alue Fields A ppear f or the Be tween Op era tor The values for the com pari son can be typed i n direc tly or de riv ed from the sp ecified repo rt col umn.
13-40 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Formatti ng Reports in In teractive Vi ewer T o add additional conditio nal formatting rules, select Add Rule an d repeat s teps 3 an d 4 for eac h ne w rule.
13-41 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Or ganizing Report Data Step 4 Click A pply . Setting a nd Removing Page Breaks in a Group C olumn In Inte ractive V i ewer , if your r eport design h as groupe d data, you ca n set p age bre aks bef ore or a fter t he grouped da ta.
13-42 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Organizin g Report Data Displaying a nd Organizin g Repo rt Data After you access a data source and se lect the data set to use, you d etermine t he best w ay to display the data in a repo rt.
13-43 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Or ganizing Report Data Figur e 13-25 Report Displ aying Cust omers Gr ouped by Country Step 2 Select Column > Move t o Group Header . The Mo ve to Gro up He ader wind o w appears, as sho wn in Figure 13-26 .
13-44 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Organizin g Report Data Figur e 13-27 Report Displ aying Cust omer Name in Ea ch Gr oup Header Removin g Column s T o remov e a column, select the column and click Delete .
13-45 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Or ganizing Report Data Step 3 Select any items you want to hide or Dese lect any hidden items you want to displ ay . T o display all hidden items, cli ck Clear .
13-46 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Organizin g Report Data Figur e 13-29 Separat e Columns In Figur e 13-30 , the data f rom these two columns is me rged into on e column.
13-47 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Or ganizing Report Data Selectin g a Colu mn from a Merged C olumn Y ou can aggrega te, filter , and group data in a colu mn that contain s data that is mer ged from multiple column s.
13-48 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Organizin g Report Data When you sort multiple columns, it is important t o unders tand the order of precedence for the sort. I n Adv anced Sort, the fi rst column y ou select is the pri mary sorting col umn.
13-49 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Or ganizing Report Data Grouping Data A report can conta in a great deal of data.
13-50 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Organizin g Report Data Figur e 13-33 Groupe d D ata Y o u can group da ta in the re port desi gn editor or i n Intera ctive V iewer . The chan ges you ma ke in the viewer do not affect the report design .
13-51 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Or ganizing Report Data Step 2 From the co ntext menu , select Group > A dd Group . The Grou p Detail dialog box appe ars, as shown in Figure 13- 35 .
13-52 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Organizin g Report Data Step 2 From the co ntext menu , select Group > Delete Inner Group .
13-53 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Or ganizing Report Data Figur e 13-38 Selecting a F unction Understanding Supported C alculation Functions T able 13- 11 provides examples of the functi ons you ca n use to create calcula tions.
13-54 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Organizin g Report Data AND Combines tw o condition s and retur n s records that match bot h cond itions . For example, you ca n reque st records from cus tomers w ho spend more than $50,0 00 a year and al so have a cre dit r ank o f A.
13-55 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Or ganizing Report Data False The B oolean False.
13-56 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Organizin g Report Data ISBO TTOMN(e xpr, n) Displays T rue if the value is withi n the lo west n va lues for th e e xpress ion, and Fals e ot herwi s e.
13-57 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Or ganizing Report Data LIKE(str ) Displays T rue if the va lues match, and F alse otherwise. Use SQL syntax to specify the string pattern. The foll owing rules apply: • Literal patt ern charac ters must match e xactly .
13-58 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Organizin g Report Data OR The logical OR operator .
13-59 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Or ganizing Report Data R OUNDDO W N(num) Rounds a nu mber do wn. ROUNDDOWN([StockPrice]) R OUNDDO W N(num, dec) Rounds a number do wn, awa y from 0, to the spe cified numbe r of digi ts.
13-60 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Organizin g Report Data WEEKD A Y(date, option) Displays the day of the week in one of the follo wing format opti ons: • 1 - Re tur ns the day n umber, from 1 ( Sund ay) throu gh 7 (Saturda y).
13-61 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Or ganizing Report Data Understanding Supported Operat ors T able 13- 12 descr ibes t he ma themat ical and l ogica l op erators you c an u se in w riting expressi ons tha t create ca lculat ed columns.
13-62 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Organizin g Report Data Using Multiply Values i n Calculated Columns T o use multiply v alues in calculated columns: Step 1 Selec t a col umn. In t he repo rt, the new calc ulate d co lumn appears to the right of the column yo u select .
13-63 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Or ganizing Report Data Step 7 For the second argume nt, typ e the numbe r of days to ad d. In this ca se, type 7. Step 8 V alidate t he e xpressi on, the n click A pply .
13-64 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Organizin g Report Data Figur e 13-39 Aggr egat e Row f or a Gr oup T able 13- 13 shows the aggregate functions that you ca n use.
13-65 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Or ganizing Report Data Creating an Ag gregate Data Row T o create an aggre gate data r ow: Step 1 Select a column , then selec t Aggregation . The Aggre gation di alog box appe ars.
13-66 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Organizin g Report Data Adding Addi tional Aggregate Rows After y ou cr eat e a si ngle a ggregate row for a colu mn, y ou can add u p to two mor e ag gregate r ows for the same column.
13-67 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Hiding and F ilteri ng Re port Da ta Deleting A ggregate Ro ws T o delete an aggre gate row : Step 1 Select the calcul ated co lumn that contains the agg reg ation y ou wa nt to re mov e, then sel ect Aggregati on .
13-68 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Hiding an d Filter ing Report D ata Figur e 13-43 Suppr essed V alues Y o u can sup press d uplicat e values to ma ke your report easier t o read .
13-69 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Hiding and F ilteri ng Re port Da ta Figur e 13-44 Gr oup D etail Row s Display ed Figure 13-45 shows the results of hidin g the detail rows for the creditra nk groupin g.
13-70 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Hiding an d Filter ing Report D ata Types of Filter Conditions T able 13- 15 describes the types of filt er conditions and provides e xamples of how f ilter conditions are translat ed into i n structions to the d ata sourc e.
13-71 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Hiding and F ilteri ng Re port Da ta Setting Filter Values After y ou choose a co nditi on, you set a filte r value. Step 1 T o vie w all the v alues for th e selected column, se lect Select V alues .
13-72 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Hiding an d Filter ing Report D ata Figur e 13-46 Selecting a Fil ter V alue in In ter active V iewer Step 2 T o sear ch for a valu e, type the v alue in the Fin d V alue f ield, t hen clic k Fi nd .
13-73 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Hiding and F ilteri ng Re port Da ta Step 3 From the Conditi o n pulldo wn menu, select a c o ndition. T able 1 3-14 descri bes t he cond itions you ca n select .
13-74 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Hiding an d Filter ing Report D ata Figur e 13-47 The A dvance d Filter D ialog Bo x in Inte rac tiv e V iewe r Adv anced Filter provides a great d eal of flex ibility in settin g the filte r valu e.
13-75 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Hiding and F ilteri ng Re port Da ta Step 7 V alidate the fi lter syntax b y clic king V alidate . Y ou hav e no w created a filte r with one conditi on.
13-76 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Underst anding Chart s Step 2 From the Fi lter pul ldown menu, se lect a pa rticular numbe r of rows or a p ercenta ge of rows, a s shown in Figure 13-48 .
13-77 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Unde rsta ndin g Ch arts Figu re 13-49 Parts of a Basi c Bar Chart Ther e are a variety of ch art types. Some typ es of data are best depic ted wit h a specific type of ch art .
13-78 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Underst anding Chart s Changing Chart Subtype char ts have subtyp es, w hich you ca n cha nge.
13-79 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 3 Managing Reports Unde rsta ndin g Ch arts Figu re 13-50 Ch art For matting Opti ons Y o u use this page to: • Edit a nd format the default chart title. • Edit an d format the defaul t title for the categor y , or x-, axis.
13-80 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 13 Ma nagin g Re ports Underst anding Chart s.
CH A P T E R 14-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 14 Troubleshooting ACS with the Monitoring an d Report Viewer This ch ap ter de scribes the diagnost ic an d tro ubleshoo ting tools that t he Mo nito ring and Repor t V iewer prov ides for the Cisco Secure Access Control System .
14-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 14 Troub leshooting ACS with the Monitoring and Report Viewer Availa ble Diagn ostic and Troubl eshootin g Tools Support bundles typ icall y con tain t he A CS dat abas e, log files, core files, an d Moni toring and Re port V iewer support files.
14-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 4 Troubleshooting ACS with the Mo nitoring and Re port Viewe r Performing Connectivity Tests Performing Connectivit y Tests Y o u can test your conne ctivity to a network device with th e device’ s hostna me or IP ad dress.
14-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 14 Troub leshooting ACS with the Monitoring and Report Viewer Downlo ading ACS Sup port Bundl es for Di agnosti c Info.
14-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 4 Troubleshooting ACS with the Mo nitoring and Re port Viewe r Downloading ACS Support Bundles for Diagnostic Inform.
14-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 14 Troub leshooting ACS with the Monitoring and Report Viewer Working wit h Expert Trou bleshoot er Working with Exp e.
14-7 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 4 Troubleshooting ACS with the Mo nitoring and Re port Viewe r Working with Expert Troubleshooter Step 4 Click Sear ch to di splay the RADIUS authe ntications that match your se arch criteria.
14-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 14 Troub leshooting ACS with the Monitoring and Report Viewer Working wit h Expert Trou bleshoot er The Ex pert Troubleshoot er begins to troub lesho ot your RAD IUS au thent icatio n.
14-9 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 4 Troubleshooting ACS with the Mo nitoring and Re port Viewe r Working with Expert Troubleshooter Step 8 Click Done to return to the Expert T roubleshooter .
14-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 14 Troub leshooting ACS with the Monitoring and Report Viewer Working wit h Expert Trou bleshoot er Executing the Sho.
14-11 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 4 Troubleshooting ACS with the Mo nitoring and Re port Viewe r Working with Expert Troubleshooter Step 3 Click Run . The Progress Detail s page appears. The Mo nitoring and Report V iewe r prompts you for additio nal input.
14-12 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 14 Troub leshooting ACS with the Monitoring and Report Viewer Working wit h Expert Trou bleshoot er Comparing SGACL P.
14-13 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 4 Troubleshooting ACS with the Mo nitoring and Re port Viewe r Working with Expert Troubleshooter Use this dia gnostic tool to compa re the SXP-IP mappi ngs betwee n a device and its peers.
14-14 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 14 Troub leshooting ACS with the Monitoring and Report Viewer Working wit h Expert Trou bleshoot er Step 4 Click S XP-IP Mappings from the list of troublesh ooting tools.
14-15 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 4 Troubleshooting ACS with the Mo nitoring and Re port Viewe r Working with Expert Troubleshooter Step 10 Click Show Results Summary to vie w the diagnos is and resol ution steps.
14-16 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 14 Troub leshooting ACS with the Monitoring and Report Viewer Working wit h Expert Trou bleshoot er Step 6 Click Show Re sults Summary to view the diagnosis and re solution steps.
14-17 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 4 Troubleshooting ACS with the Mo nitoring and Re port Viewe r Working with Expert Troubleshooter Step 3 Click Run . The Progre ss Details page appea rs with a summa ry .
14-18 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 14 Troub leshooting ACS with the Monitoring and Report Viewer Working wit h Expert Trou bleshoot er.
CH A P T E R 15-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 15 Managing System Operat ions and Configuration in the Monitoring an d Report Viewer This cha pter descr ibes the tasks that you must perfo rm to configure an d admi nister th e Monitor ing an d Report V iewer .
15-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 15 Managing Syst em Operati ons and C onfiguratio n in the Monitoring and Report View er • Configure an d edit fail.
15-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 5 Managing Syste m Opera tions and Configuratio n in the Moni toring an d Report Viewer Configuri ng Data Purgi ng a.
15-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 15 Managing Syst em Operati ons and C onfiguratio n in the Monitoring and Report View er Configuring D ata Purgin g and Increm ental Back up If yo u en able increm ent al ba ckup, data is purged daily at 4 :00 a.
15-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 5 Managing Syste m Opera tions and Configuratio n in the Moni toring an d Report Viewer Configuri ng Data Purgi ng a.
15-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 15 Managing Syst em Operati ons and C onfiguratio n in the Monitoring and Report View er Configuring D ata Purgin g a.
15-7 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 5 Managing Syste m Opera tions and Configuratio n in the Moni toring an d Report Viewer Restoring Data from a Backup.
15-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 15 Managing Syst em Operati ons and C onfiguratio n in the Monitoring and Report View er View ing Log Collect ions Step 2 Choose a backu p file that you want to r estore.
15-9 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 5 Managing Syste m Opera tions and Configuratio n in the Moni toring an d Report Viewer Viewin g Log Coll ections Related Topic Log Collec tion Deta ils Page, page 15-10 T able 15-3 Log Collec tion Pag e Option Description A CS Serv er Name of the A CS server .
15-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 15 Managing Syst em Operati ons and C onfiguratio n in the Monitoring and Report View er View ing Log Collect ions Log Collection Details Page Use this page to vi ew the rec ently col lected log names for an A CS serv er .
15-11 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 5 Managing Syste m Opera tions and Configuratio n in the Moni toring an d Report Viewer Viewin g Log Coll ections Related Topic • V iewing Log C ollecti ons, page 15-8 T able 15-4 Log Collec tion Details P age Option Description Log Name Name of t he log file.
15-12 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 15 Managing Syst em Operati ons and C onfiguratio n in the Monitoring and Report View er Recove ring Log Me ssage s .
15-13 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 5 Managing Syste m Opera tions and Configuratio n in the Moni toring an d Report Viewer Viewing Sc hedul ed Jobs No.
15-14 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 15 Managing Syst em Operati ons and C onfiguratio n in the Monitoring and Report View er Viewing Proce ss Status Viewing Process Status Use this pag e to view the status of processe s running i n your A CS en vi ronmen t.
15-15 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 5 Managing Syste m Opera tions and Configuratio n in the Moni toring an d Report Viewer Viewing Data Upgrade Status Viewing Data Upgra de Status After y ou upg rade to A C S 5.
15-16 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 15 Managing Syst em Operati ons and C onfiguratio n in the Monitoring and Report View er Spec ifyi ng E -Ma il Se tt.
15-17 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 5 Managing Syste m Opera tions and Configuratio n in the Moni toring an d Report Viewer Understanding Collection Fi.
15-18 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 15 Managing Syst em Operati ons and C onfiguratio n in the Monitoring and Report View er Configuring Sy stem Ala rm Settings Step 3 Click Submit .
15-19 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 5 Managing Syste m Opera tions and Configuratio n in the Moni toring an d Report Viewer Configuring Remote Database Settings Note A CS does not supp ort remo te data base with cl uster setup .
15-20 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 15 Managing Syst em Operati ons and C onfiguratio n in the Monitoring and Report View er Configuring Re mote Da tabase Setti ngs Note Y ou ca n view the statu s of y our expor t job in th e Schedul er .
CH A P T E R 16-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 16 Managing System Administrators System adm inistra tors ar e respon sible for depl oying, c onfiguring, m aintaini ng, and monitori ng the A C S servers in your network.
16-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 16 Managing Sy stem Administr ators Underst anding Adminis trator Roles and Ac count s • Conf igure administrator session setting • Conf igure ad ministr ator a ccess settin g The first time y ou log in to A C S 5.
16-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 6 Managing Sys tem Ad ministrato rs Config uring Syst em Admini strator s and Accounts When these steps are co mpleted , def ined administr ators can lo g in and star t working in the syste m.
16-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 16 Managing Sy stem Administr ators Underst anding Role s • Dynamic Role assign ment—Rol es are a ssigned ba sed on the rul es in the A A C authoriz ation policy . Assigning Static Roles A CS 5.
16-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 6 Managing Sys tem Ad ministrato rs Underst anding Ro les Predefined Roles T able 16- 1 shows the pred efin ed roles.
16-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 16 Managing Sy stem Administr ators Underst anding Role s Note At first logi n, only the Su per Ad min is assigne d to a spec ific admini strator .
16-7 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 6 Managing Sys tem Ad ministrato rs Creating, Duplicating, Editing, and Deleting Administrator Accounts Only appr opriate a dministrators can conf igure ident ities and certif icates.
16-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 16 Managing Sy stem Administr ators Creating, Du plica ting, Edit ing, and Del eting Ad minis trator Ac counts Step 2 Do any of the f ollowing: • Click Cr eate . • Check t he check box next to the a ccount that you want to du plicat e an d cli ck Duplicate .
16-9 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 6 Managing Sys tem Ad ministrato rs Viewing Predefined Roles Step 4 Click Submit . The new account is sav ed. The Admi nistrat ors page app ear s, with the new account th at you cre ated or duplicat ed.
16-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 16 Managing Sy stem Administr ators Configuring A uthenti cation Set tings for Ad ministra tors Choose System Administratio n > Administrators > Roles . The Rol es pag e ap pears with a li st of pr edefine d role s.
16-11 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 6 Managing Sys tem Ad ministrato rs Configuring Authentication Settings for Administrators The Pa ssword Polic ies page a ppears with t he Passw ord Comple xity and Ad v anced tabs.
16-12 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 16 Managing Sy stem Administr ators Configuring Se ssion Idl e Timeout Note A CS auto matical ly deact iv ates o r disable s your a ccount ba sed on yo ur last l ogin, la st password chan ge, or numbe r of login retrie s.
16-13 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 6 Managing Sys tem Ad ministrato rs Configuring Administrator Access Settings Step 1 Choose System Administration > Administrators > Settings > Session . The GUI Session pa ge appears.
16-14 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 16 Managing Sy stem Administr ators Working with Administrative Access Control Step 1 Choose System Administration > Administrators > Settings > Access . The IP A ddresses Filter ing page appears.
16-15 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 6 Managing Sys tem Ad ministrato rs Working with Administrative Access Control The AA C service process es thes e two pol icies in a sequence . Y ou need to con fig ure bot h the Administra tor identity polic y and the Administrator authorizat ion p olic y .
16-16 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 16 Managing Sy stem Administr ators Working with Administrative Access Control In cases whe re Den y Access is sel ected as the resu lt, the acce ss of the admini strator is denied.
16-17 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 6 Managing Sys tem Ad ministrato rs Working with Administrative Access Control T o conf igure a rule-bas ed polic y.
16-18 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 16 Managing Sy stem Administr ators Working with Administrative Access Control Configuring Identity Po licy Rule Prop.
16-19 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 6 Managing Sys tem Ad ministrato rs Working with Administrative Access Control Administrator Authorization Policy The au thoriza tion poli cy in the Admin istrative Access Contro l is used for dynami call y assigni ng roles to admini strators upon login .
16-20 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 16 Managing Sy stem Administr ators Working with Administrative Access Control Configuring Administ rator Au thorization Rule Properties Use this page to create, dupli cate, an d edit th e rules t o determine administrato r roles in the AA C access service.
16-21 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 6 Managing Sys tem Ad ministrato rs Working with Administrative Access Control Administra tor Login Process When an adm inistrator l o gs in to the A CS web interface , AC S 5.
16-22 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 16 Managing Sy stem Administr ators Rese ttin g th e Adm inis tra tor P assw or d Note If the adm inist rator password o n the AD or LDAP server is expir ed or reset, then ACS denies the administrato r access to the web interf ace.
16-23 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 6 Managing Sys tem Ad ministrato rs Changing t he Admini strat or Password The ad ministra tor password i s created. Y o u can also use the acs reset- password command to reset your ACSAdmin account pa ssword.
16-24 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 16 Managing Sy stem Administr ators Changing the A dministr ator Passwor d.
CH A P T E R 17-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 17 Configuring System Operation s Y o u can configure an d deploy A CS instanc es so that one ACS i nstan ce becom es the primar y instance and th e other A CS instances c an be re gister ed to the primary as secondary instances .
17-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 17 Configuring System Operations Underst anding Distri buted Depl oymen t • Using th e Deploym ent Ope ratio ns Page to Creat e a Local Mo de Instan ce, pa ge 17-2 3 Understandin g Distributed Deployment Y ou can conf igure multiple ACS servers in a deplo yment.
17-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 7 Configuring Syste m Operatio ns Understand ing Distributed Depl oyment A CS 5. 4 supports one primary and twen ty second ary servers in a large A CS deployme nt. The me dium A CS depl oyment co nsists of one pri mar y and twelve secon dary servers.
17-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 17 Configuring System Operations Underst anding Distri buted Depl oymen t Removin g Seco ndary S ervers T o p ermane ntly r emove a seconda ry ser ver from a depl oyment, you mu st first deregi ster t he seco ndary serv er and then delete it fr om the primary .
17-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 7 Configuring Syste m Operatio ns Understand ing Distributed Depl oyment When t he conn ecti on to t he pri mar y server r esume s, you can r econne ct th e disc onnect ed seco ndary instance in Local Mode to the prima ry serve r .
17-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 17 Configuring System Operations Scheduled B ackups Step 3 Y ou must acti va te the se condary ser ver on t he primary , eith er automa tically or by issuing a manua l request.
17-7 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 7 Configuring Syste m Operatio ns Scheduled Backups Step 2 Click Submit to schedule the bac kup.
17-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 17 Configuring System Operations Backing U p Primary and Seconda ry Instan ces Backing Up Primary and Secondary Insta nces A CS provides yo u the o ption to bac k up t he pri mary a nd se condary instan ces at any time apar t from the regular sch eduled backups.
17-9 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 7 Configuring Syste m Operatio ns Synchr onizing Primary and Sec ondary Inst ances Af ter Back up and Resto r e Sync.
17-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 17 Configuring System Operations Editing Ins tances T able 1 7 -4 Distr ibuted S ystem Ma nag ement P age Option Description Primary I nstance Name H ostna me o f th e prim ary ins tance .
17-11 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 7 Configuring Syste m Operatio ns Editing Instances Step 2 From the Pr imary I nstance t able, click t he primar y instance that yo u wan t to mod ify , or check th e Name check box a nd c lick Edit .
17-12 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 17 Configuring System Operations Editing Ins tances Step 4 Click Submit . The Prim ary In stance table on the Distri buted System Mana geme nt page app ears wi th the edit ed prim ary inst ance .
17-13 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 7 Configuring Syste m Operatio ns Editing Instances Viewing and Editing a Secondary Instance T o edit a secondary in stanc e: Step 1 Choose System Administra tion > O peratio ns > Dist ributed Syst em Management .
17-14 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 17 Configuring System Operations Activa ting a Secon dary In stance Activating a Sec ondary Instance T o acti vate a seco ndary ins tance: Step 1 Choose System Administra tion > O peratio ns > Dist ributed Syst em Management .
17-15 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 7 Configuring Syste m Operatio ns Registeri ng a Seco ndary In stance to a Primary In stance .
17-16 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 17 Configuring System Operations Registering a Secondar y Inst ance to a Pri mary Insta nce Step 3 Speci fy th e appro pria te values in th e Regist ratio n Sec tion. Step 4 Click Register to Primary .
17-17 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 7 Configuring Syste m Operatio ns Deregist ering Seco ndary Instances fr om the Distribute d System Managemen t Pag.
17-18 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 17 Configuring System Operations Promoting a Se condary Instanc e from the Di stribut ed System M anagem ent Page The syste m displays th e following warnin g mess age: This oper ation w ill de regist er this serve r as a sec ondary with t he pri mary s erver.
17-19 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 7 Configuring Syste m Operatio ns Promot ing a Sec ondary I nstance f rom the Depl oyment Operation s Page Promotin.
17-20 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 17 Configuring System Operations Replicating a Seconda ry Instan ce from a Prim ary Inst ance Replicating a Seco ndary Inst ance fro m the D istributed S ystem Mana geme nt Page Note All A CS appliances mu st be in sy nc with th e AD domain clo ck.
17-21 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 7 Configuring Syste m Operatio ns Replicating a Secondary Instance from a Primary Instance The Distr ibuted System Mana gement page appe ars. On th e Seconda ry Instanc e table, the Repli cation Status colu mn shows UPD A TED .
17-22 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 17 Configuring System Operations Replicating a Seconda ry Instan ce from a Prim ary Inst ance Failover A CS 5.4 allo ws you to conf igure multip le A CS instance s for a d eploym ent scenar io.
17-23 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 7 Configuring Syste m Operatio ns Using th e Deploym ent Opera tions Pa ge to Create a Loc al Mode In stance Cleanup.. ..... Starting ACS .... The database on the primary server is restored successfully .
17-24 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 17 Configuring System Operations Using th e Deploy ment Op erations Page to Create a Local Mode Inst ance Y o u can use the con f igura tion info rmation on t he A CS Configuration Audit repor t to manuall y restore the conf iguration information for this insta nce.
17-25 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 7 Configuring Syste m Operatio ns Using th e Deploym ent Opera tions Pa ge to Create a Loc al Mode In stance Step 4 Click Submit . The n ew so ftware repo sito ry i s sa ved.
17-26 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapter 17 Configuring System Operations Using th e Deploy ment Op erations Page to Create a Local Mode Inst ance.
CH A P T E R 18-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 18 Managing System Administration Configurations After y ou inst all Ci sco Secu re ACS, you must configure a nd a dminister it to mana ge your network eff icient ly .
18-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Configuring G lobal Sys tem Op tions Configuring EAP-TLS Settings Use the EAP-TLS Settings page to configure EAP-TLS runtime characteristics.
18-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Config uring Glo bal System Options Configuring PEAP Settings Use the PEAP Settings p age to conf igure PEAP runtime charact eristics.
18-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Configuring RSA SecurID Prom pts Generating EAP-FAST PAC Use the EAP-F AST Gener ate P A C page to ge nerate a us er or machi ne P A C.
18-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Ma naging Dict ionari es Step 3 Click Submit to conf igure the RSA SecurID Prompts.
18-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Managing Dictionari es • RADIUS (Cisc o BBSM) • RADIUS .
18-7 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Ma naging Dict ionari es • Click Cr eate . • Check t he check box next to t he R ADIUS VS A tha t you wa nt t o dupli cate , then clic k Duplicate .
18-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Managing Dictionari es T able 18-9 Cr eating, Dupl icating, and Editing RADIU S Subat tr ibutes Option Description General Attrib ute Name of the suba ttrib ute.
18-9 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Ma naging Dict ionari es Step 4 Click Submit to save the subattrib ute.
18-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Managing Dictionari es Related Topic Creatin g, Duplic ati.
18-11 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Ma naging Dict ionari es Configuring Internal Identity Attributes T able 18- 10 describes the f ields in the interna l < users | hosts > identity attrib utes.
18-12 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Managing Dictionari es Deleting an Internal Us er Identity.
18-13 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Ma naging Dict ionari es Creating, Duplicating, and Editing an I.
18-14 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Configuring L ocal Server Certificates Adding Static IP ad.
18-15 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Adding Local Server Certificates Step 2 Click Add .
18-16 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Adding L ocal Server Ce rtificates Step 4 Click Fini sh. The n ew certif icate is sa ve d. The Local Certifi cate Store pa ge app ears with the ne w ce rtif icate.
18-17 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Adding Local Server Certificates Step 4 Click Fini sh. The n ew certif icate is sa ve d. The Local Certifi cate Store pa ge app ears with the ne w ce rtif icate.
18-18 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Adding L ocal Server Ce rtificates Binding CA Sig ned Certific ates Use this page to bind a CA signed ce rtif icate to the request that was use d to obtain the c ertif icate f rom the CA.
18-19 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Adding Local Server Certificates Step 4 Click Submit to extend the e xisting certif icate’ s v alidity . The Local Certif icate Store page appears with the edited certi fica te.
18-20 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Adding L ocal Server Ce rtificates The Cert ificate Store page ap pears wit hout the deleted cert ificate( s).
18-21 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Confi guring Logs Step 2 Click Export to export the loc al certif icate to a client machi ne.
18-22 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Configuring L ogs Step 1 Select System Admi nist ration > Configuration > Log Configuration > Remote Log T argets .
18-23 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Confi guring Logs Step 4 Click Submit . The remo te log target co nfiguration i s sav e d. The Remote Log T argets pa ge appears w ith the new rem ote log target configurati on.
18-24 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Configuring L ogs Configuring th e Local Lo g Use the Local Conf iguration page to conf igure the maximum days to retai n your local log data.
18-25 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Confi guring Logs Configuring Global Logging Categorie s T o vie.
18-26 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Configuring L ogs Step 6 Click Submit . The Lo gging Cat egories pag e appe ars, with your co nfigured log ging cat egory .
18-27 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Confi guring Logs Related Topic • Configuring Pe r-Instance L .
18-28 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Configuring L ogs Viewing A DE-OS Logs The log s listed in T able 1 8-22 are w ritten t o the A DE-OS logs.
18-29 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Confi guring Logs Sep 29 06:28:28 cd-acs5-13-103 MSGCAT58004/adm.
18-30 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Configuring L ogs Configuring Per-Instanc e Security and L.
18-31 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Confi guring Logs Configuring Per-Instanc e Remote Syslog Targets Use this page to conf igure remote syslog targets for logging cate gories.
18-32 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Configuring L ogs Displaying L ogging Ca tegories Y o u can view a tree of configured loggi ng categorie s for a speci fic A CS inst ance.
18-33 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Confi guring Logs Configuring th e Log C ollector Use the Log Collector page to selec t a log data coll ector and suspend or re sume log da ta transmissi on.
18-34 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Licensi ng Overv iew Licensing Overvi ew T o operate A C S, you mus t instal l a v alid li cense. A CS prompts y ou to install a valid bas e license wh en you first acc ess the we b interfac e.
18-35 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Installing a License File Related Topics • Licen sing Overview.
18-36 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Installin g a Licens e File Viewing the Base Lice nse T o u pgrad e t he bas e li cen se: Step 1 Select System Admi nist ration > Conf iguration > Licensing > Ba se Serve r License .
18-37 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Installing a License File Related Topic • Upgrad ing the Ba se Server Licens e, page 18- 37 Upgrading th e Base S erver Lice nse Y o u can upgra de the base server licens e.
18-38 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Viewing Licens e Feature Options Viewing License Feature Optio ns Y o u can add, upgra de, or delete existi ng depl oyment l icen ses.
18-39 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Adding De ployment Lic ense Files Adding Deployme nt License Files T o a dd a n ew base de ployment licen se file: Step 1 Select System Administration > Configuration > Licensing > F eature Options .
18-40 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Deleti ng Deploy men t License File s Related Topics • L.
18-41 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 8 Managing Syste m Adm inistration Configurat ions Available Downloads Downloading Migration Utility Files T o do wnload migration ap plication f iles and the m igration g uide for A CS 5.
18-42 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 18 Man agi ng Sy stem Ad minist rati on Co nfig urat ions Availa ble Do wnloads T o do wnload the s e sample scripts: Step 1 Choose System Administration > Downl o ads > Sample Python Script s .
CH A P T E R 19-1 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 19 Understanding Logging This c hapter d escrib es loggin g func tional ity in A C S 5.4. A dmini strators and u sers u se t he various managem ent i nterf aces of A CS to per form dif ferent tasks .
19-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 19 Un ders tand ing L og ging About Lo gging Using Log Targets Y ou can specify to send customer log informatio n to multip le cons umers or Log T ar gets and s pecify wheth er the lo g mes sages a re store d locall y in text form at or forwarde d to syslog se rvers.
19-3 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 9 Understan ding Loggi ng About Logging Note F or comple x configuratio n items or attrib utes, such as policy or D .
19-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 19 Un ders tand ing L og ging About Lo gging Each log message contains the follo wing information : • Event code— A unique message code. • Logging categor y—Iden tifies the catego ry to wh ich a log message belon gs.
19-5 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 9 Understan ding Loggi ng About Logging Local Store T arget Log messages in the local store ar e text f iles that are sent to one log file, located at /opt/CSCOacs/lo gs/localSto r e/ , regar dless of w hich lo gging ca tegory they be long to .
19-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 19 Un ders tand ing L og ging About Lo gging T able 19-2 Local Sto r e and S yslog Messag e F orma t Field Descriptio.
19-7 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 9 Understan ding Loggi ng About Logging Y o u can use the web in terface to con figure the numbe r of days to retain local store l og files; how ev er , the defa ult setting is to pur ge data when it excee d s 5 MB or each day , whichev er limit is f irst attained.
19-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 19 Un ders tand ing L og ging About Lo gging When you configure a critical log target, and a me ssage is sent to that critical log target, the messa ge is also se nt to the con figured noncriti cal log target on a best- effort basis.
19-9 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 9 Understan ding Loggi ng About Logging T able 19-3 Remote S yslog M essag e Header F orma t Field Description pri_nu m Priority v alue of the message; a combination of the fac ility va lue and the se verity v alue of the me ssage.
19-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 19 Un ders tand ing L og ging About Lo gging The syslog messag e data or pa yload is the same as the Loca l Store Me ssage Format , which i s describe d in T abl e 19-2 .
19-11 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 9 Understan ding Loggi ng About Logging The M onitori ng and R eport V iewer has t wo drawer o ptions: • Moni tori ng and R eports—Us e this dra wer to vie w and conf igure al arms , view l og repo rts, and perform trouble shoot ing tasks .
19-12 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 19 Un ders tand ing L og ging ACS 4.x Versus ACS 5.4 Loggi ng ACS 4.x Versus ACS 5.4 Logging If you are familiar with the logging f unctionality in A C S 4. x, ensure that you familiarize yourself with the loggin g func tionality of A CS 5.
19-13 User Guide for C isco Secur e Access Cont rol System 5.4 OL-26225-01 Chapter 1 9 Understan ding Loggi ng ACS 4 .x Vers us ACS 5.4 Loggi ng Configuration Use the Sy stem Configuration > Loggin.
19-14 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Chapt er 19 Un ders tand ing L og ging ACS 4.x Versus ACS 5.4 Loggi ng.
A- 1 Use r Guid e fo r Cis co S ecure Acce ss Co ntr ol Sy stem 5.4 OL-26225-01 APPENDIX A AAA Protocols This section con tains the follo wing topics: • T ypical Use Cases, page A-1 • Access Prot .
A- 2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix A AAA Protocol s Typical Us e Cases Session Access Requests (Device Administration [TACAC S+]) Note Th e numbe rs refer to Figur e A-1 on pa ge A-1 . For session reque st: 1.
A-3 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix A AAA Protoco ls Typical Use Cases – EAP proto cols that inv ol ve a TLS handshake and in whic h the clie nt uses t.
A- 4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix A AAA Protocol s Typical Us e Cases – EAP-F AST/EAP-MSCHAPv2 – EAP-F AST/EAP-GTC • EAP me thods that us e certi.
A-5 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix A AAA Protoco ls Access Protoco ls—TACACS+ and RADIUS Access Protocols—TACACS+ and RADIUS This section con tains the follo wing topics: • Overview of T A CACS+, page A-5 • Ove rvie w of RADIUS, page A- 6 A CS 5.
A- 6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix A AAA Protocol s Overvi ew of RADIU S Overview of RADIUS This section con tains the follo wing topics: • RADIUS VSAs, page A-6 • A CS 5.4 as t he AAA Server , page A-7 • RADIUS Att ribute Support in ACS 5.
A-7 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix A AAA Protoco ls Overview of RADIUS ACS 5.4 as the AAA Se rver A AAA serv er is a server program th at handle s user req uests for acc ess to computer res ourc es, and fo r an enterp rise, pro vides AAA services.
A- 8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix A AAA Protocol s Overvi ew of RADIU S RADIUS Attribute Support in ACS 5.
A-9 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix A AAA Protoco ls Overview of RADIUS Authentication A CS supports various aut hentica tion p rotocols transpor ted over RADI US.
A-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix A AAA Protocol s Overvi ew of RADIU S Admin istrator can co nfigure th e att ribute opera tion cl ause fo r a spe cific proxy access servic e.
A-11 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix A AAA Protoco ls Overview of RADIUS • If the Mu ltiple attrib utes are allo wed, then the update o peration remo ves all the occu rrences of th is attribute a nd adds one attribute with a new value.
A-12 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix A AAA Protocol s Overvi ew of RADIU S When th e RADI US serv er recei ves t h e acces s-req uest fro m the N AD, it se arches a database fo r the user name . Dependi ng on the r esul t of t he databa se qu ery , an acce pt or rejec t is sent .
B-1 Use r Guid e fo r Cis co S ecure Acce ss Co ntr ol Sy stem 5.4 OL-26225-01 APPENDIX B Auth enticat ion in ACS 5 .4 Authentic ation v erif ies user informa tion to c onfi rm the u ser's ide ntity . T r aditional a u thenticati o n uses a name a nd a fixed passwo rd.
B-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 PAP This ap pen dix d escr ibe s th e foll owing : • RADIUS-based authenticat ion that .
B-3 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix B Authent ication in ACS 5.4 EAP RADIUS PAP Authentication Y ou can use dif ferent le ve ls of security concurre ntly with A CS for dif ferent requiremen ts. P AP applies a tw o-w ay hand shaking pr ocedur e.
B-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 EAP In A CS 5.4 , EAP is en capsulate d in the RADIUS prot ocol . Incoming and outg oing EAP mes sages are stored in a RA DIUS EAP-M essage att ribute (79).
B-5 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix B Authent ication in ACS 5.4 EAP-MD5 A CS sup ports ful l EAP infrast ructu re, inclu ding EAP ty pe negotiati on, message s equenci ng and message r etransmi ssion. Al l protoc ols supp ort fr agme ntation of big message s.
B-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 EAP-TLS Overvi ew of EAP- TLS EAP-TL S is one of th e me thods in the EAP au thenti cation framework, and is base d on the 80 2.1x and EAP archi tecture.
B-7 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix B Authent ication in ACS 5.4 EAP- TLS • Using a third-par ty signature, usually from a CA, that v erifies the information in a certif icate. This third-pa rty bindin g is similar to the real-world eq uiv ale nt of the sta mp on a passport.
B-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 EAP-TLS Y ou can conf igure the timeo ut for each sessio n in the cac he, for eac h protocol indi vidually .
B-9 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix B Authent ication in ACS 5.4 EAP- TLS For HTTPS, SFTP , SSH and Acti veM Q, an auto-generate d self-si gned certif icates can be use d as the means fo r serv er authenticati on.
B-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 EAP-TLS • Initial Sel f-Signed Certific ate Generation, page B-10 • Certificate Gene.
B-11 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix B Authent ication in ACS 5.4 EAP- TLS There are tw o types of certif icate gener ation : • Self-sign ing c ertificat e gene ration— A C S sup ports ge nerat ion of an X.
B-12 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 EAP-TLS Credentia ls Distributio n All certif icates are kept in the A CS database which is distrib uted and shared between all A CS nodes.
B-13 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix B Authent ication in ACS 5.4 EAP- TLS Private Keys an d Passwords Backup The entir e A CS database is dist rib uted and ba cked-up on the prim ary A CS along with all the ce rtif icates, priv at e-keys and the en crypte d priv a te-key-pass words.
B-14 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 PEAPv0/1 Note All co mmuni cation between t he host and A CS goes thro ugh the net work device. EAP-TLS authentic ation fails if the: • Serv er fails to v erify the cl ient’ s certif icate, an d reje cts EAP- TLS au thenticat ion.
B-15 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix B Authent ication in ACS 5.4 PEAPv 0/1 • Cisco AC 3.x • Funk Ody ssey Access C lient 4 .
B-16 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 PEAPv0/1 • Fast Reconnect, page B-16 • Session R esume, page B- 16 • Protecte d Ex.
B-17 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix B Authent ication in ACS 5.4 PEAPv 0/1 Protected E xchange of Arbitrar y Parame ters TL V tuples pro vide a way to e xchange ar bitrary informat ion betwee n the peer and A CS within a secure ch annel.
B-18 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 PEAPv0/1 Figur e B-3 PEAP Pr ocessin g Flo w Creating the TLS Tunnel The fo llowing describes th e process for creatin g the TLS tun nel: 271629 Phase 1 Phase 2 User authentication credentials are sent through TLS Tunnel again using EAP .
B-19 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix B Authent ication in ACS 5.4 EAP-F AST Authenticatin g with MS CHAP v2 After the TLS tunnel is created, follo w thes.
B-20 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 EAP-FAST EAP-F AST is a c lient-server security architec ture that encrypts EAP tran sactions with a TLS tunnel.
B-21 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix B Authent ication in ACS 5.4 EAP-F AST EAP-F AST can protect the username in all EAP-F AST transac tions.
B-22 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 EAP-FAST • A CS- Supported Fea tures for P A Cs, pag e B-25 • Master Key Genera tion.
B-23 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix B Authent ication in ACS 5.4 EAP-F AST Provisioning Modes A CS sup ports out- of-band and in-ban d provisioning mo des. The in -band provision ing mod e operate s inside a TLS tunnel raised by Anonymous DH or Authenticate d DH or RSA algorithm for k ey agre eme nt.
B-24 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 EAP-FAST The v arious means b y whi ch an end- user client can r eceiv e P A Cs are : • P A C provisioning —Requ ired w hen an e nd-user c lient has no P AC.
B-25 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix B Authent ication in ACS 5.4 EAP-F AST T o con trol whet her A CS perform s Automa tic In- Band P A C Provisioni ng, use t he options on th e Globa l System Options pages in the System Administration drawer .
B-26 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 EAP-FAST The proac tive P AC update time is con figured for th e A CS se rver in the Allowed Protocols Page. Th is mecha nism all ows the client to be always updated wi th a valid P A C.
B-27 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix B Authent ication in ACS 5.4 EAP-F AST Master Key Generation and PAC TTLs The values for master key genera tion and P A C TTLs deter mine their states, as d escrib ed in About Master-Ke ys, page B-22 and T ypes of P ACs, page B-23 .
B-28 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 EAP-FAST For informat ion about how master key generatio n and P AC TTL v a lues det ermin e wheth er P A C provisioning or P A C re fresh ing is requ ired, see Ma ster Key Genera tion and P A C TT Ls, page B- 27 .
B-29 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix B Authent ication in ACS 5.4 EAP-F AST • P A C M igrat ion fr om A CS 4.x, pag e B-29 Key Distribution Algorithm The comm on seed- key is a rela tiv e ly la rge and a com plete ly ra ndom buffer th at is genera ted by t he primar y A CS server .
B-30 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 EAP Authe ntication wi th RADIUS Key Wrap • A list of retire d A C S 4.x master-keys. The list is taken fro m the A CS 4. x configurati on and plac ed in a ne w table in A CS 5.
B-31 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix B Authent ication in ACS 5.4 EAP-M SCHAPv 2 Overview of EAP-MSCHAPv2 Some of the specif ic members of the EAP family of authen tication proto cols, specif ically EAP-F AST and PEAP , support th e notion of an “EAP inner method.
B-32 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 CHAP EAP- MS CHAPv2 Flo w in ACS 5.4 Components in vo lve d in the 802.1x and MSCHAPv2 authentication process a re the: • Host—The e nd entity , or en d user’ s machine.
B-33 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix B Authent ication in ACS 5.4 Certificate Attributes • Subject ’ s ST attr ibut e (State Pro vince) • Subject .
B-34 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 Cert ific ate At tr ibute s • Subject 's ST attrib ute (State Provi nce) • Subj.
B-35 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix B Authent ication in ACS 5.4 Machine Authentication The conf iguration of URLs an d their association to CA's is distrib uted to the entire A CS domain. The downloaded CRLs are not dist ributed and are autono mously populate d in parallel i n each A CS server .
B-36 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 Authent ication Proto col and Ide ntity Store Comp atibility Related Topics • Micr oso.
B-37 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix B Authent ication in ACS 5.4 Authentication Protocol and Identity Store Compatibility.
B-38 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendix B Authenti cation in ACS 5.4 Authent ication Proto col and Ide ntity Store Comp atibility.
C-1 Use r Guid e fo r Cis co S ecure Acce ss Co ntr ol Sy stem 5.4 OL-26225-01 APPENDIX C Open Source License Acknowledgements See http://www .ci sco.co m/en/U S/produc ts/ps991 1/produc ts_lic ensing_i nforma tion_li sting.ht ml for all the Ope n Source and T hird Party L icens es use d in Cisc o Sec ure Acc ess Cont rol Syste m, 5.
C-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendi x C Open Source Lice nse Acknow ledgement s Notices 4. The name s “OpenSSL T oolki t” and “Ope nSSL Projec t” must not be us ed to endor se or prom ote products derived from this software without pr ior written permission.
C-3 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 Append ix C Open Sourc e License Acknow ledg ements 4. If you incl ude any W indows specific co de (or a derivati ve th ereo f).
C-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Appendi x C Open Source Lice nse Acknow ledgement s.
GL-1 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 GLOSSAR Y A AAA Authentic ation, authorization , and accountin g (AAA) is a term for a fr ame work for intell igently contro lling access to comp uter res ources, e nforcin g policie s, auditi ng usage, an d providing t he informatio n necessary to bill for service s.
Glos sary GL-2 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 accounts The cap ability of A CS to record user sessions in a log file. ACS System Administrators Ad m in i st r a to r s w i th di ff er en t access pri v ileges d efined u nder the System Conf iguration section o f the A CS web interface.
Glossary GL-3 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 authenticity The validity and conf orman ce of the or igin al info rmati on. authorization The approval, p ermissi on, or empowerm ent fo r so meone or som ethin g to do some thing.
Glos sary GL-4 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 certificate-based authentication The u se of Secure Sockets La yer (SSL) an d certif icate s to au thenticate and en crypt HTTP t r af fic.
Glossary GL-5 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 configuration manageme nt The proce ss of establi shing a kno wn baselin e condit ion and ma naging it.
Glos sary GL-6 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 D daemon A program wh ich i s often starte d at the time the sys tem bo ots and runs conti nuously wi thout intervent ion from a ny of the users o n the system. The daem on progr am forward s the re quests to other program s (or proc esses) as a ppropriat e.
Glossary GL-7 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 digital envelop e An en crypted message with the encry p ted sess ion ke y . digital signature A hash of a message tha t uniquely identifies the sender of the messag e and proves the message hasn't chan ged s ince t ran smissi on.
Glos sary GL-8 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 dumpsec A security tool that dumps a variety of information a bout a sy stem's users, file system, registry , permis sions, passwor d policy , and services . DLL Dynamic Link Librar y .
Glossary GL-9 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 EAP Extens ible Aut hentic ation Protoc ol. A p rotoco l for w ireless networks that expand s on A uthenti cation methods used by the PPP ( Point-to-Point Protocol) , a protocol often used wh en connecting a computer to the I nternet.
Glos sary GL-10 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 G gateway A n etwork point tha t acts as an entrance to anot her netwo rk. global system options Conf igur ing T A CA CS+, EAP-T TLS, PEAP , and EAP-F AST ru ntime cha racteris tic s and ge neratin g EAP-F AST P A C.
Glossary GL-11 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 I I18N Int ernationaliza tion and localizatio n are m eans of adapting sof tware for non- nati ve en vironments, especi ally other nations and cultur es.
Glos sary GL-12 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 ISO Interna tional Or ganization for Standardizat ion, a volu ntary , non-treaty , non-go vernment o rg anization, .
Glossary GL-13 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 M MAC Address A physical addres s; a numeri c value tha t uni quely ident ifies that network device from every other device on the plane t. matchingRul e (LDAP) The m ethod b y which an attri bute is c o mpar ed in a sear ch opera tion.
Glos sary GL-14 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 PI (Programma tic Interface) The A CS PI is a prog rammatic in terface that provides e xternal ap plicati ons the a.
Glossary GL-15 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 R RDN (LDAP) Th e Relative Distinguished N ame (freque ntly but incorre ctly writte n as Relatively Distinguish ed Name). The name gi ven to an attrib ute(s) that is unique at its le vel in the hierarchy .
Glos sary GL-16 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 Schema (LDAP) A package o f attrib utes and object clas ses that ar e someti mes (nomi n ally) re lated.
Glossary GL-17 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 SOAP (Simple Object Acce ss Prot oc ol) A lightw eight X ML- based p rotocol for excha nge o f infor mation in a decent ralized , distr ibuted en viro nment.
Glos sary GL-18 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01 U UDP User D atagram Prot ocol. A com munica tions pro tocol that o ffers a li mited a mount of se rvice when messag es ar e e xchang ed betw een comput ers in a networ k that uses t h e Int ernet Protoc ol (IP) URL Unifor m Resource Locat or .
Glossary GL-19 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 X X.509 A standard for public key infrastruct ure. X .509 specifies, am ongst ot her things, standar d format s for public k ey ce rtif icates and a certif ication path v alidation algorithm.
Glos sary GL-20 User Guide f or Cisco S ecure Access Contro l System 5.4 OL-26225-01.
IN-1 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 INDEX Symbols ! format ting symb ol 13-34 % operat or 13-61 & formatt ing symbol 13-34 & operator 13-61 * operator 13-.
Index IN-2 User Guide f or Cisco S e cure Acce ss Control System 5. 4 OL-26225-01 Arrang e Columns di alog 13-42 ascendin g sort order 13-47 AVERAGE functio n 13-54 Averag e functi on 13-64 aver ages .
Inde x IN-3 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 formatti n g data and 13-37 conte xt m enus 13-21 conversi ons 13-34 COUNT_DI STINCT function 13-54 COUNT fu nction 13-.
Index IN-4 User Guide f or Cisco S e cure Acce ss Control System 5. 4 OL-26225-01 download s 18-40 duplicat e values 13-67, 13-68 E EAP-FAST enab lin g B-27 identity pro tection B-21 logging B- 20 mas.
Inde x IN-5 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 G General D a te format o ption 13-31 General N u mber f ormat optio n 13-31 Go to page pick list 13-22 Greater Than co.
Index IN-6 User Guide f or Cisco S e cure Acce ss Control System 5. 4 OL-26225-01 locales creat ing ch arts and 13-78 customiz ing forma ts for 13-30, 13-32, 13-35 locating text valu es 13-55, 13-59 l.
Inde x IN-7 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 numeric da ta types 13-31 numeric expr essions 13-61, 13-62 numeric va lues 13-24, 13-33 O opening exported data files .
Index IN-8 User Guide f or Cisco S e cure Acce ss Control System 5. 4 OL-26225-01 report viewer s 13-21 resizing colu mns 13-24, 13-29 RIGHT functi o n 13-58 ROUNDDOWN fu nction 13-59 ROUND fu nction .
Inde x IN-9 User Guide f or Cisco Se cure Access C ontrol System 5.4 OL-26225-01 time data types 13-31 time form ats 13-31, 13-35 timesav er, descr iption of ii-xxi v time stamps 13-57, 13-59 time val.
Index IN- 10 User Guide f or Cisco S e cure Acce ss Control System 5. 4 OL-26225-01 X x-axis va lues 13-7 6 Y y-axis va lues 13-7 6 YEAR fu nction 13-60.
Un punto importante, dopo l’acquisto del dispositivo (o anche prima di acquisto) è quello di leggere il manuale. Dobbiamo farlo per diversi motivi semplici:
Se non hai ancora comprato il Cisco Systems CSACS3415K9 è un buon momento per familiarizzare con i dati di base del prodotto. Prime consultare le pagine iniziali del manuale d’uso, che si trova al di sopra. Dovresti trovare lì i dati tecnici più importanti del Cisco Systems CSACS3415K9 - in questo modo è possibile verificare se l’apparecchio soddisfa le tue esigenze. Esplorando le pagine segenti del manuali d’uso Cisco Systems CSACS3415K9 imparerai tutte le caratteristiche del prodotto e le informazioni sul suo funzionamento. Le informazioni sul Cisco Systems CSACS3415K9 ti aiuteranno sicuramente a prendere una decisione relativa all’acquisto.
In una situazione in cui hai già il Cisco Systems CSACS3415K9, ma non hai ancora letto il manuale d’uso, dovresti farlo per le ragioni sopra descritte. Saprai quindi se hai correttamente usato le funzioni disponibili, e se hai commesso errori che possono ridurre la durata di vita del Cisco Systems CSACS3415K9.
Tuttavia, uno dei ruoli più importanti per l’utente svolti dal manuale d’uso è quello di aiutare a risolvere i problemi con il Cisco Systems CSACS3415K9. Quasi sempre, ci troverai Troubleshooting, cioè i guasti più frequenti e malfunzionamenti del dispositivo Cisco Systems CSACS3415K9 insieme con le istruzioni su come risolverli. Anche se non si riesci a risolvere il problema, il manuale d’uso ti mostrerà il percorso di ulteriori procedimenti – il contatto con il centro servizio clienti o il servizio più vicino.
