Cisco 2509 - Router - EN User manual

Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
User Guide for Cisco Secure ACS
for Windows Server
Customer Order Number: DOC-7814696=
Text Part Number: 78-14696-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT
NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT
ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR
THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION
PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO
LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as
part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE
PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED
OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL
DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR
INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES.
User Guide for Cisco Secure ACS for Windows Server
Copyright © 2002, Cisco Systems, Inc.
All rights reserved.
CCIP, the Cisco Arrow logo, the Cisco Powered Network mark, the Cisco SystemsVerified logo, Cisco Unity, Follow Me Browsing, FormShare, Internet
Quotient, iQ Breakthrough, iQ Expertise, iQ FastTrack, the iQ Logo, iQ Net Readiness Scorecard, Networking Academy, ScriptShare, SMARTnet,
TransPath, and Voice LAN are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, Discover All That’s Possible, The
Fastest Way to IncreaseYour Internet Quotient, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA,
CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco
Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack,
IOS, IP/TV, LightStream, MGX, MICA, the Networkers logo, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar,
SlideCast, StrataView Plus, Stratm, SwitchProbe, TeleRouter, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S.
and certain other countries.
All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a
partnership relationship between Cisco and any other company. (0206R)

iii
User Guide for Cisco Secure ACS for Windows Server
78-14696-01, Version 3.1
CONTENTS
Preface xxv
Document Objective xxv
Audience xxv
Organization xxvi
Conventions xxviii
Related Documentation xxix
Obtaining Documentation xxx
World Wide Web xxx
Documentation CD-ROM xxx
Ordering Documentation xxx
Documentation Feedback xxxi
Obtaining Technical Assistance xxxi
Cisco.com xxxi
Technical Assistance Center xxxii
Cisco TAC Web Site xxxii
Cisco TAC Escalation Center xxxiii
CHAPTER 1Overview of Cisco Secure ACS 1-1
The Cisco Secure ACS Paradigm 1-1
Cisco Secure ACS Specifications 1-2
System Performance Specifications 1-3
Cisco Secure ACS Windows Services 1-4
AAA Server Functions and Concepts 1-5
Cisco Secure ACS and the AAA Client 1-5

Contents
iv
User Guide for CiscoSecure ACS for Windows Server 78-14696-01, Version 3.1
AAA Protocols—TACACS+ and RADIUS 1-6
TACACS+ 1-6
RADIUS 1-6
Authentication 1-7
Authentication Considerations 1-8
Authentication and User Databases 1-8
Authentication Protocol-Database Compatibility 1-9
Passwords 1-10
Other Authentication-Related Features 1-15
Authorization 1-15
Max Sessions 1-16
Dynamic Usage Quotas 1-17
Shared Profile Components 1-17
Support for Cisco Device-Management Applications 1-18
Other Authorization-RelatedFeatures 1-19
Accounting 1-20
Other Accounting-Related Features 1-20
Administration 1-21
HTTP Port Allocation for Remote Administrative Sessions 1-21
Network Device Groups 1-22
Other Administration-Related Features 1-22
Cisco Secure ACS HTML Interface 1-23
About the Cisco Secure ACS HTML Interface 1-23
HTML Interface Security 1-24
HTML Interface Layout 1-25
Uniform Resource Locatorfor the HTML Interface 1-26
Network Environments and Remote Administrative Sessions 1-27
Remote Administrative Sessions and HTTP Proxy 1-27
Remote Administrative Sessions through Firewalls 1-28
Remote Administrative Sessions through a NAT Gateway 1-28

v
User Guide for Cisco Secure ACS for Windows Server
78-14696-01, Version 3.1
Contents
Accessing the HTML Interface 1-29
Logging Off the HTML Interface 1-29
Online Help and Online Documentation 1-30
Using Online Help 1-30
Using the Online Documentation 1-31
CHAPTER 2Deploying Cisco Secure ACS 2-1
Basic Deployment Requirements for Cisco Secure ACS 2-2
System Requirements 2-2
Hardware Requirements 2-2
Operating System Requirements 2-2
Third-Party Software Requirements 2-3
Network Requirements 2-4
Basic Deployment Factors for Cisco Secure ACS 2-5
Network Topology 2-5
Dial-Up Topology 2-5
Wireless Network 2-8
Remote Access using VPN 2-11
Remote Access Policy 2-13
Security Policy 2-14
Administrative Access Policy 2-14
Separation ofAdministrative and General Users 2-16
Database 2-17
Number of Users 2-17
Type of Database 2-17
Network Latency and Reliability 2-18
Suggested Deployment Sequence 2-18

Contents
vi
User Guide for CiscoSecure ACS for Windows Server 78-14696-01, Version 3.1
CHAPTER 3Setting Up the Cisco Secure ACS HTML Interface 3-1
Interface Design Concepts 3-2
User-to-Group Relationship 3-2
Per-User or Per-Group Features 3-2
User Data Configuration Options 3-3
Defining New User Data Fields 3-3
Advanced Options 3-4
Setting Advanced Options for the Cisco Secure ACS User Interface 3-6
Protocol Configuration Options for TACACS+ 3-7
Setting Options for TACACS+ 3-9
Protocol Configuration Options for RADIUS 3-10
Setting Protocol Configuration Options for IETF RADIUS Attributes 3-15
SettingProtocolConfigurationOptionsforNon-IETFRADIUSAttributes 3-16
CHAPTER 4Setting Up and Managing Network Configuration 4-1
AboutNetwork Configuration 4-2
AboutDistributed Systems 4-3
AAA Servers in Distributed Systems 4-3
Default Distributed System Settings 4-4
Proxy in Distributed Systems 4-4
Fallback on Failed Connection 4-6
Character String 4-6
Stripping 4-6
Proxy in an Enterprise 4-7
Remote Use of Accounting Packets 4-7
Other Features Enabled bySystem Distribution 4-8
Network Device Searches 4-8
Network Device Search Criteria 4-9
Searching for Network Devices 4-10

vii
User Guide for Cisco Secure ACS for Windows Server
78-14696-01, Version 3.1
Contents
AAA ClientConfiguration 4-11
AAA ClientConfiguration Options 4-11
Adding a AAA Client 4-15
Editing a AAA Client 4-18
Deleting a AAA Client 4-19
AAA Server Configuration 4-20
AAA Server Configuration Options 4-21
Adding a AAA Server 4-23
Editing a AAA Server 4-25
Deleting a AAA Server 4-27
Network Device Group Configuration 4-27
Adding a Network Device Group 4-28
Assigning an Unassigned AAA Client or AAA Server to an NDG 4-29
Reassigning a AAA Client or AAA Server to an NDG 4-30
Renaming a Network Device Group 4-31
Deleting a Network Device Group 4-31
Proxy Distribution Table Configuration 4-32
Aboutthe Proxy Distribution Table 4-32
Adding a New Proxy Distribution Table Entry 4-33
Sorting the Character StringMatch Order of Distribution Entries 4-35
Editing a Proxy Distribution Table Entry 4-35
Deleting a Proxy Distribution Table Entry 4-36
CHAPTER 5Setting Up and Managing Shared Profile Components 5-1
AboutShared Profile Components 5-1
Downloadable PIX ACLs 5-2
AboutDownloadable PIX ACLs 5-2
Downloadable PIX ACL Configuration 5-4
Adding a Downloadable PIX ACL 5-4

Contents
viii
User Guide for CiscoSecure ACS for Windows Server 78-14696-01, Version 3.1
Editing a Downloadable PIX ACL 5-5
Deleting a Downloadable PIX ACL 5-5
Network Access Restrictions 5-6
AboutNetwork Access Restrictions 5-6
Shared Network Access Restrictions Configuration 5-8
Adding a Shared Network Access Restriction 5-9
Editing a Shared Network Access Restriction 5-11
Deleting a Shared Network Access Restriction 5-13
Command Authorization Sets 5-13
AboutCommand Authorization Sets 5-14
AboutPattern Matching 5-15
Command Authorization Sets Configuration 5-16
Adding a Command Authorization Set 5-16
Editing a Command Authorization Set 5-19
Deleting a Command Authorization Set 5-20
CHAPTER 6Setting Up and Managing UserGroups 6-1
User Group Setup Features and Functions 6-2
Default Group 6-2
Group TACACS+ Settings 6-2
Common User Group Settings 6-3
Enabling VoIP Support for a User Group 6-4
Setting Default Time-of-Day Access for a User Group 6-5
Setting Callback Options for a UserGroup 6-6
Setting Network Access Restrictions fora User Group 6-7
Setting Max Sessions for a User Group 6-11
Setting Usage Quotas for a User Group 6-13
Configuration-specific User Group Settings 6-15
Setting Token Card Settings for a User Group 6-16

ix
User Guide for Cisco Secure ACS for Windows Server
78-14696-01, Version 3.1
Contents
Setting Enable Privilege Options for a UserGroup 6-18
Enabling Password Aging for the CiscoSecure User Database 6-20
Enabling Password Aging for Users in Windows Databases 6-25
Setting IP Address Assignment Method for a User Group 6-27
Assigning a Downloadable PIX ACL to a Group 6-28
Configuring TACACS+ Settings for a User Group 6-29
Configuring a Shell Command Authorization Set for a User Group 6-31
Configuring a PIX Command Authorization Set for a User Group 6-33
Configuring Device-Management Command Authorization for a User
Group 6-35
Configuring IETF RADIUS Settings for a User Group 6-37
Configuring Cisco IOS/PIX RADIUS Settings for a User Group 6-38
Configuring Cisco Aironet RADIUS Settings for a User Group 6-39
Configuring Ascend RADIUS Settings for a UserGroup 6-41
Configuring Cisco VPN 3000 Concentrator RADIUS Settings fora User
Group 6-42
Configuring Cisco VPN 5000 Concentrator RADIUS Settings fora User
Group 6-43
Configuring Microsoft RADIUS Settings for a User Group 6-45
Configuring Nortel RADIUS Settings for a User Group 6-46
Configuring Juniper RADIUS Settings for a User Group 6-48
Configuring BBSM RADIUS Settings for a User Group 6-49
Configuring Custom RADIUS VSA Settings for a User Group 6-50
Group Setting Management 6-51
Listing Users in a User Group 6-52
Resetting Usage Quota Counters for a User Group 6-52
Renaming a User Group 6-53
Saving Changes to User Group Settings 6-53

Contents
x
User Guide for CiscoSecure ACS for Windows Server 78-14696-01, Version 3.1
CHAPTER 7Setting Up and Managing UserAccounts 7-1
User Setup Features and Functions 7-2
AboutUser Databases 7-2
Basic User Setup Options 7-4
Adding a Basic User Account 7-5
Setting Supplementary User Information 7-7
Setting a Separate CHAP/MS-CHAP/ARAP Password 7-8
Assigning a Userto a Group 7-9
Setting User Callback Option 7-10
Assigning a Userto a ClientIP Address 7-11
Setting Network Access Restrictions fora User 7-12
Setting Max Sessions Options for a User 7-16
Setting User Usage Quotas Options 7-18
Setting Options for User AccountDisablement 7-20
Assigning a PIX ACL to a User 7-21
Advanced User Authentication Settings 7-22
TACACS+ Settings(User) 7-22
Configuring TACACS+ Settings for a User 7-23
Configuring a Shell Command Authorization Set for a User 7-25
Configuring a PIX Command Authorization Set for a User 7-28
Configuring Device Management Command Authorization for a User 7-30
Configuring the Unknown Service Setting for a User 7-32
Advanced TACACS+Settings (User) 7-33
Setting Enable Privilege Options for a User 7-33
Setting TACACS+ Enable Password Options for a User 7-35
Setting TACACS+ Outbound Password for a User 7-36
RADIUS Attributes 7-37
Setting IETF RADIUS Parameters for a User 7-38
Setting Cisco IOS/PIX RADIUS Parameters for a User 7-39
Setting Cisco Aironet RADIUS Parameters for a User 7-40

xi
User Guide for Cisco Secure ACS for Windows Server
78-14696-01, Version 3.1
Contents
Setting Ascend RADIUS Parameters for a User 7-42
Setting Cisco VPN 3000 ConcentratorRADIUS Parameters for a
User 7-43
Setting Cisco VPN 5000 ConcentratorRADIUS Parameters for a
User 7-45
Setting Microsoft RADIUS Parameters for a User 7-46
Setting Nortel RADIUS Parameters fora User 7-48
Setting Juniper RADIUS Parameters for a User 7-49
Setting BBSM RADIUS Parameters for a User 7-51
Setting Custom RADIUS Attributes for a User 7-52
User Management 7-53
Listing All Users 7-54
Finding a User 7-54
Disabling a User Account 7-55
Deleting a User Account 7-56
Resetting UserSession Quota Counters 7-57
Resetting a UserAccount after Login Failure 7-58
Saving User Settings 7-59
CHAPTER 8Establishing Cisco Secure ACS System Configuration 8-1
Service Control 8-2
Determining the Status ofCisco Secure ACS Services 8-2
Stopping, Starting,or Restarting Services 8-2
Logging 8-3
Date Format Control 8-3
Setting the Date Format 8-4
Local Password Management 8-5
Configuring Local Password Management 8-7

Contents
xii
User Guide for CiscoSecure ACS for Windows Server 78-14696-01, Version 3.1
CiscoSecure Database Replication 8-9
About CiscoSecure Database Replication 8-9
Replication Process 8-12
Replication Frequency 8-14
Important Implementation Considerations 8-15
Database Replication Versus Database Backup 8-16
Database Replication Logging 8-17
Replication Options 8-17
Replication Components Options 8-17
Outbound Replication Options 8-18
Inbound Replication Options 8-20
Implementing Primary and Secondary Replication Setups on
Cisco Secure ACSes 8-20
Configuring a Secondary Cisco Secure ACS 8-21
Replicating Immediately 8-24
Scheduling Replication 8-26
Disabling CiscoSecure Database Replication 8-29
Database Replication Event Errors 8-29
RDBMS Synchronization 8-29
AboutRDBMS Synchronization 8-30
Users 8-31
User Groups 8-32
Network Configuration 8-32
Custom RADIUS Vendors and VSAs 8-33
RDBMS Synchronization Components 8-33
AboutCSDBSync 8-33
About the accountActions Table 8-34
Cisco Secure ACS Database Recovery Using theaccountActions Table 8-36
Reports and Event (Error) Handling 8-37
Preparing to Use RDBMS Synchronization 8-37

xiii
User Guide for Cisco Secure ACS for Windows Server
78-14696-01, Version 3.1
Contents
Considerations for Using CSV-Based Synchronization 8-38
Preparing for CSV-Based Synchronization 8-39
Configuring a System Data Source Name for RDBMS Synchronization 8-40
RDBMS Synchronization Options 8-41
RDBMS Setup Options 8-41
Synchronization Scheduling Options 8-42
Synchronization Partners Options 8-42
Performing RDBMS Synchronization Immediately 8-43
Scheduling RDBMS Synchronization 8-44
Disabling Scheduled RDBMS Synchronizations 8-46
Cisco Secure ACS Backup 8-47
About Cisco Secure ACS Backup 8-47
Backup File Locations 8-48
Directory Management 8-48
Components Backed Up 8-48
Reports of Cisco Secure ACS Backups 8-49
Backup Options 8-49
Performing a Manual Cisco Secure ACS Backup 8-50
Scheduling Cisco Secure ACS Backups 8-50
Disabling Scheduled Cisco Secure ACS Backups 8-51
Cisco Secure ACS System Restore 8-52
About Cisco Secure ACS System Restore 8-52
Backup File Names and Locations 8-53
Components Restored 8-54
Reports of Cisco Secure ACS Restorations 8-54
Restoring Cisco Secure ACS from a Backup File 8-54
Cisco Secure ACS Active Service Management 8-55
System Monitoring 8-56
System Monitoring Options 8-56
Setting Up System Monitoring 8-57

Contents
xiv
User Guide for CiscoSecure ACS for Windows Server 78-14696-01, Version 3.1
Event Logging 8-58
Setting Up EventLogging 8-58
IP Pools Server 8-59
AboutIP Pools Server 8-60
Allowing Overlapping IP Pools or Forcing Unique Pool Address Ranges 8-61
Refreshing the AAA Server IP Pools Table 8-62
Adding a New IP Pool 8-63
Editing an IP Pool Definition 8-64
Resetting an IP Pool 8-65
Deleting an IP Pool 8-66
IP Pools Address Recovery 8-67
Enabling IP Pool AddressRecovery 8-67
VoIP Accounting Configuration 8-68
Configuring VoIP Accounting 8-68
Cisco Secure ACS Certificate Setup 8-69
Background on Protocols and Certification 8-69
Digital Certificates 8-69
About the EAP-TLS Protocol 8-70
About the PEAP Protocol 8-72
Installing a Cisco Secure ACS Server Certificate 8-74
Adding a Certificate Authority Certificate 8-76
Editing the Certificate Trust List 8-77
Generating a Certificate Signing Request 8-78
Updating or Replacing a Cisco Secure ACS Certificate 8-80
Global Authentication Setup 8-81
Configuring Authentication Options 8-81

xv
User Guide for Cisco Secure ACS for Windows Server
78-14696-01, Version 3.1
Contents
CHAPTER 9Working with Logging and Reports 9-1
Logging Formats 9-1
Special Logging Attributes 9-2
Update Packets In Accounting Logs 9-4
About Cisco Secure ACS Logs and Reports 9-4
Accounting Logs 9-5
Dynamic Administration Reports 9-7
Viewing the Logged-in Users Report 9-8
Deleting Logged-in Users 9-9
Viewing the Disabled Accounts Report 9-10
Cisco Secure ACS System Logs 9-11
Configuring the Administration Audit Log 9-12
Working with CSV Logs 9-13
CSV Log File Names 9-13
CSV Log File Locations 9-13
Enabling or Disabling a CSV Log 9-14
Viewing a CSV Report 9-15
Configuring a CSV Log 9-16
Working with ODBC Logs 9-19
Preparing for ODBC Logging 9-19
Configuring a System Data Source Name for ODBC Logging 9-20
Configuring an ODBC Log 9-20
Remote Logging 9-23
AboutRemote Logging 9-23
Implementing Centralized Remote Logging 9-24
Remote Logging Options 9-25
Enabling and Configuring Remote Logging 9-26
Disabling Remote Logging 9-28

Contents
xvi
User Guide for CiscoSecure ACS for Windows Server 78-14696-01, Version 3.1
Service Logs 9-28
Services Logged 9-29
Configuring Service Logs 9-30
CHAPTER 10 Setting Up and Managing Administrators and Policy 10-1
Administrator Accounts 10-1
AboutAdministrator Accounts 10-2
Administrator Privileges 10-3
Adding an Administrator Account 10-6
Editing an AdministratorAccount 10-8
Unlocking a Locked Out Administrator Account 10-10
Deleting an Administrator Account 10-11
Access Policy 10-11
Access Policy Options 10-12
Setting Up Access Policy 10-14
Session Policy 10-16
Session Policy Options 10-16
Setting Up Session Policy 10-17
Audit Policy 10-18
CHAPTER 11 Working with User Databases 11-1
CiscoSecure User Database 11-2
Aboutthe CiscoSecure User Database 11-2
User Import andCreation 11-3
AboutExternalUser Databases 11-4
Authenticating with External User Databases 11-5
External User Database Authentication Process 11-6
Windows NT/2000 UserDatabase 11-7
What’s Supported with Windows NT/2000 User Databases 11-8

xvii
User Guide for Cisco Secure ACS for Windows Server
78-14696-01, Version 3.1
Contents
The Cisco Secure ACS Authentication Processwith Windows NT/2000 User
Databases 11-9
Trust Relationships 11-9
Windows Dial-up Networking Clients 11-10
Windows Dial-up Networking Clients with a Domain Field 11-10
Windows Dial-up Networking Clients without a Domain Field 11-11
Windows Authentication 11-11
User-ChangeablePasswordswithWindowsNT/2000 UserDatabases 11-13
Preparing Users for Authenticating with Windows NT/2000 11-14
Configuring a Windows NT/2000 External User Database 11-14
Generic LDAP 11-16
Cisco Secure ACS Authentication Process with a Generic LDAP User
Database 11-17
Multiple LDAP Instances 11-17
LDAP Organizational Units and Groups 11-18
Domain Filtering 11-18
LDAP Failover 11-20
Successful PreviousAuthentication with the PrimaryLDAP Server 11-21
Unsuccessful PreviousAuthentication with the Primary LDAP
Server 11-21
LDAP Configuration Options 11-22
Configuring a Generic LDAP External User Database 11-28
Novell NDS Database 11-33
AboutNovell NDS User Databases 11-34
User Contexts 11-35
Novell NDS ExternalUser Database Options 11-36
Configuring a Novell NDS External User Database 11-37
ODBC Database 11-39
What is Supported with ODBC User Databases 11-40
Cisco Secure ACS Authentication Process with an ODBC External User
Database 11-41

Contents
xviii
User Guide for CiscoSecure ACS for Windows Server 78-14696-01, Version 3.1
Preparing to Authenticate Users with an ODBC-Compliant Relational
Database 11-42
Implementation of Stored Procedures forODBC Authentication 11-43
Type Definitions 11-44
Microsoft SQL Server and Case-Sensitive Passwords 11-44
Sample Routine for Generating a PAP Authentication SQL Procedure 11-45
Sample Routine for Generating an SQL CHAP Authentication
Procedure 11-46
PAP Authentication Procedure Input 11-46
PAP Procedure Output 11-47
CHAP/MS-CHAP/ARAP Authentication Procedure Input 11-48
CHAP/MS-CHAP/ARAP Procedure Output 11-48
Result Codes 11-49
Configuring a System Data Source Name for an ODBC External User
Database 11-50
Configuring an ODBC External UserDatabase 11-51
LEAP Proxy RADIUS Server Database 11-54
Configuring a LEAP Proxy RADIUS Server External UserDatabase 11-55
Token Server User Databases 11-57
AboutToken Servers and Cisco Secure ACS 11-57
Token Servers and ISDN 11-58
RADIUS-Enabled Token Servers 11-59
AboutRADIUS-Enabled Token Servers 11-59
Token Server RADIUS Authentication Requestand Response
Contents 11-60
Configuring a RADIUS Token Server External User Database 11-60
RSA SecurID Token Servers 11-64
ConfiguringanRSASecurIDTokenServerExternalUserDatabase 11-65
Deleting an External User Database Configuration 11-66

xix
User Guide for Cisco Secure ACS for Windows Server
78-14696-01, Version 3.1
Contents
CHAPTER 12 Administering External User Databases 12-1
Unknown User Processing 12-1
Known, Unknown, and Discovered Users 12-2
General Authentication Request Handling and Rejection Mode 12-3
Authentication Request Handling and Rejection Mode with the
Windows NT/2000 User Database 12-4
Windows Authentication with a Domain Specified 12-5
WindowsAuthentication with Domain Omitted 12-6
Performance of Unknown User Authentication 12-7
Added Latency 12-7
Authentication Timeout Value on AAA clients 12-7
Network Access Authorization 12-8
Unknown User Policy 12-8
Database SearchOrder 12-9
Configuring the Unknown User Policy 12-9
Turning off External User Database Authentication 12-11
Database Group Mappings 12-11
Group Mapping by External User Database 12-12
Creating a Cisco Secure ACS Group Mapping for a Token Server, ODBC
Database, or LEAP Proxy RADIUS Server Database 12-13
Group Mapping by Group Set Membership 12-14
Group Mapping Order 12-15
No Access Group for Group Set Mappings 12-15
Default Group Mapping for Windows NT/2000 12-16
Creating a Cisco Secure ACS Group Mapping for Windows NT/2000,
Novell NDS, or Generic LDAP Groups 12-16
Editing a Windows NT/2000, Novell NDS, or Generic LDAP Group Set
Mapping 12-18
Deleting a Windows NT/2000, Novell NDS, or Generic LDAP Group Set
Mapping 12-20

Contents
xx
User Guide for CiscoSecure ACS for Windows Server 78-14696-01, Version 3.1
Deleting a Windows NT/2000 Domain Group Mapping
Configuration 12-20
Changing Group Set Mapping Order 12-21
RADIUS-Based Group Specification 12-22
APPENDIX ATroubleshooting Information for Cisco Secure ACS A-1
Administration Issues A-2
Browser Issues A-3
Cisco IOS Issues A-3
Database Issues A-5
Dial-in Connection Issues A-6
Debug Issues A-10
Proxy Issues A-11
Installation and Upgrade Issues A-11
MaxSessions Issues A-12
Report Issues A-12
Third-Party Server Issues A-13
PIX Firewall Issues A-13
User Authentication Issues A-14
TACACS+ and RADIUS Attribute Issues A-16
APPENDIX BTACACS+ Attribute-Value Pairs B-1
Cisco IOS AV Pair Dictionary B-1
TACACS+ AV Pairs B-2
TACACS+ Accounting AV Pairs B-4
APPENDIX CRADIUS Attributes C-1
Cisco IOS Dictionary of RADIUS AV Pairs C-2