Cisco 3.3 User manual

Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
User Guide for Cisco Secure ACS for
Windows Server
Version 3.3
May 2004
Customer Order Number: DOC-7816592=
Text Part Number: 78-16592-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT
NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT
ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR
THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION
PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO
LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as
part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE
PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR
IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL
DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR
INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES.
User Guide for Cisco Secure ACS for Windows Server
Copyright © 2004 Cisco Systems, Inc. All rights reserved.
CCIP, CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of
Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST,
BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press,
Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherFast,
EtherSwitch, Fast Step, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard,
LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing,
ProConnect, RateMUX, Registrar, ScriptShare, SlideCast, SMARTnet, StrataView Plus, SwitchProbe, TeleRouter, The Fastest Way to Increase Your
Internet Quotient, TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other
countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a
partnership relationship between Cisco and any other company. (0403R)

iii
User Guide for Cisco Secure ACS for Windows Server
78-16592-01
CONTENTS
Preface xxix
Audience xxix
Organization xxix
Conventions xxxi
Product Documentation xxxii
Related Documentation xxxiii
Obtaining Documentation xxxv
Cisco.com xxxvi
Ordering Documentation xxxvi
Documentation Feedback xxxvi
Obtaining Technical Assistance xxxvii
Cisco Technical Support Website xxxvii
Submitting a Service Request xxxvii
Definitions of Service Request Severity xxxviii
Obtaining Additional Publications and Information xxxix
CHAPTER 1Overview 1-1
The Cisco Secure ACS Paradigm 1-2
Cisco Secure ACS Specifications 1-3
System Performance Specifications 1-3
Cisco Secure ACS Windows Services 1-4
AAA Server Functions and Concepts 1-5
Cisco Secure ACS and the AAA Client 1-6

Contents
iv
User Guide for Cisco Secure ACS for Windows Server
78-16592-01
AAA Protocols—TACACS+ and RADIUS 1-6
TACACS+ 1-7
RADIUS 1-7
Authentication 1-8
Authentication Considerations 1-9
Authentication and User Databases 1-10
Authentication Protocol-Database Compatibility 1-10
Passwords 1-11
Other Authentication-Related Features 1-16
Authorization 1-17
Max Sessions 1-18
Dynamic Usage Quotas 1-18
Shared Profile Components 1-19
Support for Cisco Device-Management Applications 1-19
Other Authorization-Related Features 1-21
Accounting 1-22
Other Accounting-Related Features 1-22
Administration 1-23
HTTP Port Allocation for Administrative Sessions 1-23
Network Device Groups 1-24
Other Administration-Related Features 1-24
Posture Validation 1-25
Cisco Secure ACS HTML Interface 1-25
About the Cisco Secure ACS HTML Interface 1-26
HTML Interface Security 1-26
HTML Interface Layout 1-27
Uniform Resource Locator for the HTML Interface 1-29
Network Environments and Administrative Sessions 1-30
Administrative Sessions and HTTP Proxy 1-30
Administrative Sessions through Firewalls 1-31

v
User Guide for Cisco Secure ACS for Windows Server
78-16592-01
Contents
Administrative Sessions through a NAT Gateway 1-31
Accessing the HTML Interface 1-32
Logging Off the HTML Interface 1-33
Online Help and Online Documentation 1-33
Using Online Help 1-34
Using the Online Documentation 1-34
CHAPTER 2Deployment Considerations 2-1
Basic Deployment Requirements for Cisco Secure ACS 2-2
System Requirements 2-2
Hardware Requirements 2-2
Operating System Requirements 2-2
Third-Party Software Requirements 2-3
Network and Port Requirements 2-4
Basic Deployment Factors for Cisco Secure ACS 2-6
Network Topology 2-6
Dial-Up Topology 2-6
Wireless Network 2-9
Remote Access using VPN 2-12
Remote Access Policy 2-14
Security Policy 2-15
Administrative Access Policy 2-15
Separation of Administrative and General Users 2-17
Database 2-18
Number of Users 2-18
Type of Database 2-18
Network Latency and Reliability 2-19
Suggested Deployment Sequence 2-19

Contents
vi
User Guide for Cisco Secure ACS for Windows Server
78-16592-01
CHAPTER 3Interface Configuration 3-1
Interface Design Concepts 3-2
User-to-Group Relationship 3-2
Per-User or Per-Group Features 3-2
User Data Configuration Options 3-3
Defining New User Data Fields 3-3
Advanced Options 3-4
Setting Advanced Options for the Cisco Secure ACS User Interface 3-6
Protocol Configuration Options for TACACS+ 3-7
Setting Options for TACACS+ 3-9
Protocol Configuration Options for RADIUS 3-11
Setting Protocol Configuration Options for IETF RADIUS Attributes 3-16
Setting Protocol Configuration Options for Non-IETF RADIUS Attributes 3-17
CHAPTER 4Network Configuration 4-1
About Network Configuration 4-1
About Distributed Systems 4-2
AAA Servers in Distributed Systems 4-3
Default Distributed System Settings 4-3
Proxy in Distributed Systems 4-4
Fallback on Failed Connection 4-5
Character String 4-6
Stripping 4-6
Proxy in an Enterprise 4-6
Remote Use of Accounting Packets 4-7
Other Features Enabled by System Distribution 4-8
Network Device Searches 4-8
Network Device Search Criteria 4-8
Searching for Network Devices 4-9

vii
User Guide for Cisco Secure ACS for Windows Server
78-16592-01
Contents
AAA Client Configuration 4-11
AAA Client Configuration Options 4-11
Adding a AAA Client 4-16
Editing a AAA Client 4-19
Deleting a AAA Client 4-21
AAA Server Configuration 4-21
AAA Server Configuration Options 4-22
Adding a AAA Server 4-24
Editing a AAA Server 4-26
Deleting a AAA Server 4-28
Network Device Group Configuration 4-28
Adding a Network Device Group 4-29
Assigning an Unassigned AAA Client or AAA Server to an NDG 4-30
Reassigning a AAA Client or AAA Server to an NDG 4-31
Renaming a Network Device Group 4-32
Deleting a Network Device Group 4-32
Proxy Distribution Table Configuration 4-34
About the Proxy Distribution Table 4-34
Adding a New Proxy Distribution Table Entry 4-35
Sorting the Character String Match Order of Distribution Entries 4-36
Editing a Proxy Distribution Table Entry 4-37
Deleting a Proxy Distribution Table Entry 4-38
CHAPTER 5Shared Profile Components 5-1
About Shared Profile Components 5-1
Network Access Filters 5-2
About Network Access Filters 5-2
Adding a Network Access Filter 5-3
Editing a Network Access Filter 5-5

Contents
viii
User Guide for Cisco Secure ACS for Windows Server
78-16592-01
Deleting a Network Access Filter 5-7
Downloadable IP ACLs 5-7
About Downloadable IP ACLs 5-8
Adding a Downloadable IP ACL 5-10
Editing a Downloadable IP ACL 5-13
Deleting a Downloadable IP ACL 5-14
Network Access Restrictions 5-14
About Network Access Restrictions 5-15
About IP-based NAR Filters 5-17
About Non-IP-based NAR Filters 5-18
Adding a Shared Network Access Restriction 5-19
Editing a Shared Network Access Restriction 5-23
Deleting a Shared Network Access Restriction 5-24
Command Authorization Sets 5-25
About Command Authorization Sets 5-26
Command Authorization Sets Description 5-26
Command Authorization Sets Assignment 5-28
Case Sensitivity and Command Authorization 5-29
Arguments and Command Authorization 5-29
About Pattern Matching 5-30
Adding a Command Authorization Set 5-31
Editing a Command Authorization Set 5-33
Deleting a Command Authorization Set 5-35
CHAPTER 6User Group Management 6-1
About User Group Setup Features and Functions 6-2
Default Group 6-2
Group TACACS+ Settings 6-2

ix
User Guide for Cisco Secure ACS for Windows Server
78-16592-01
Contents
Basic User Group Settings 6-3
Group Disablement 6-4
Enabling VoIP Support for a User Group 6-4
Setting Default Time-of-Day Access for a User Group 6-5
Setting Callback Options for a User Group 6-7
Setting Network Access Restrictions for a User Group 6-8
Setting Max Sessions for a User Group 6-12
Setting Usage Quotas for a User Group 6-14
Configuration-specific User Group Settings 6-16
Setting Token Card Settings for a User Group 6-18
Setting Enable Privilege Options for a User Group 6-19
Enabling Password Aging for the CiscoSecure User Database 6-21
Enabling Password Aging for Users in Windows Databases 6-26
Setting IP Address Assignment Method for a User Group 6-28
Assigning a Downloadable IP ACL to a Group 6-30
Configuring TACACS+ Settings for a User Group 6-31
Configuring a Shell Command Authorization Set for a User Group 6-33
Configuring a PIX Command Authorization Set for a User Group 6-35
Configuring Device-Management Command Authorization for a User
Group 6-37
Configuring IETF RADIUS Settings for a User Group 6-38
Configuring Cisco IOS/PIX RADIUS Settings for a User Group 6-40
Configuring Cisco Aironet RADIUS Settings for a User Group 6-41
Configuring Ascend RADIUS Settings for a User Group 6-43
Configuring Cisco VPN 3000 Concentrator RADIUS Settings for a User
Group 6-44
Configuring Cisco VPN 5000 Concentrator RADIUS Settings for a User
Group 6-46
Configuring Microsoft RADIUS Settings for a User Group 6-47
Configuring Nortel RADIUS Settings for a User Group 6-49
Configuring Juniper RADIUS Settings for a User Group 6-50

Contents
x
User Guide for Cisco Secure ACS for Windows Server
78-16592-01
Configuring BBSM RADIUS Settings for a User Group 6-51
Configuring Custom RADIUS VSA Settings for a User Group 6-53
Group Setting Management 6-54
Listing Users in a User Group 6-54
Resetting Usage Quota Counters for a User Group 6-55
Renaming a User Group 6-55
Saving Changes to User Group Settings 6-56
CHAPTER 7User Management 7-1
About User Setup Features and Functions 7-1
About User Databases 7-2
Basic User Setup Options 7-3
Adding a Basic User Account 7-4
Setting Supplementary User Information 7-6
Setting a Separate CHAP/MS-CHAP/ARAP Password 7-7
Assigning a User to a Group 7-8
Setting User Callback Option 7-9
Assigning a User to a Client IP Address 7-10
Setting Network Access Restrictions for a User 7-11
Setting Max Sessions Options for a User 7-16
Setting User Usage Quotas Options 7-18
Setting Options for User Account Disablement 7-20
Assigning a Downloadable IP ACL to a User 7-21
Advanced User Authentication Settings 7-22
TACACS+ Settings (User) 7-23
Configuring TACACS+ Settings for a User 7-24
Configuring a Shell Command Authorization Set for a User 7-26
Configuring a PIX Command Authorization Set for a User 7-29