-
User Guide for Cisco Secure Access Control Server 4.1
-
Preface
-
Overview
-
Using the Web Interface
-
Network Configuration
-
Shared Profile Components
-
User Group Management
-
User Management
-
System Configuration: Basic
-
System Configuration: Advanced
-
System Configuration: Authentication and Certificates
-
Logs and Reports
-
Administrators and Administrative Policy
-
User Databases
-
Posture Validation
-
Network Access Profiles
-
Unknown User Policy
-
User Group Mapping and Specification
-
Troubleshooting
-
TACACS+ Attribute-Value Pairs
-
RADIUS Attributes
-
CSUtil Database Utility
-
VPDN Processing
-
RDBMS Synchronization Import Definitions
-
Internal Architecture
-
Index
-
Feedback
Table Of Contents
Network Admission Control (NAC)
Identity-Based Networking Services (IBNS)
ACS Features, Functions and Concepts
AAA Protocols—TACACS+ and RADIUS
Additional Features in This Release
Authentication and User Databases
Authentication Protocol-Database Compatibility
Other Authentication-Related Features
Support for Cisco Device-Management Applications
Other Authorization-Related Features
Other Accounting-Related Features
Managing and Administrating ACS
Cisco Security Agent Integration (ACS Solution Engine Only)
Cisco Security Agent Service Management
Cisco Security Agent Restrictions
HTTP Port Allocation for Administrative Sessions
Uniform Resource Locator for the Web Interface
Online Help and Online Documentation
System Performance Specifications
Online Documentation Reference
Network Admission Control (NAC) documentation
Overview
This chapter contains an overview of the Cisco Secure Access Control Server Release 4.1, hereafter referred to as ACS.
The following topics are presented:
•
ACS Features, Functions and Concepts
•
•
Introduction to ACS
ACS is a scalable, high-performance Remote Access Dial-In User Service (RADIUS) and Terminal Access Controller Access Control System (TACACS+) security server. As the centralized control point for managing enterprise network users, network administrators, and network infrastructure resources, ACS provides a comprehensive identity-based network-access control solution for Cisco intelligent information networks.
ACS extends network-access security by combining traditional authentication, authorization, and accounting (AAA - pronounced "triple A") with policy control. ACS enforces a uniform network-access security policy for network administrators and other network users.
ACS supports a broad variety of Cisco and other network-access devices (NADs), also known as AAA clients, including:
•
•
•
•
•
•
•
Figure 1-1 illustrates the role of ACS as a traditional network access control/AAA server.
Figure 1-1 A Simple AAA Scenario
Network Admission Control (NAC)
ACS is a critical component of the Cisco Network Admission Control (NAC) framework. Cisco NAC is a Cisco Systems-sponsored industry initiative that uses the network infrastructure to enforce security-policy compliance on all machines seeking to access network computing resources, thereby limiting damage from viruses and worms. With NAC, network access to compliant and trusted PCs can be permitted, while the access of noncompliant devices can be restricted. See Figure 1-2.
Figure 1-2 ACS Extended to NAC
Identity-Based Networking Services (IBNS)
ACS is also an important component of the Cisco Identity-Based Networking Services (IBNS) architecture. Cisco IBNS is based on Extensible Authentication Protocol (EAP) and on port-security standards such as IEEE 802.1x (a standard for port-based network-access control) to extend security authentication, authorization, and accounting from the perimeter of the network to every connection point inside the LAN. New policy controls such as per-user quotas, virtual LAN (VLAN) assignments, and access-control lists (ACLs) can be deployed, due to the extended capabilities of Cisco switches and wireless access points to query ACS over the RADIUS protocol.
ACS Features, Functions and Concepts
ACS incorporates many technologies to render AAA services to network-access devices, and provides a central access-control function.
This section contains the following topics:
•
•
ACS as the AAA Server
ACS functions as an AAA server for one or more NADs. The NADs are AAA clients of the ACS server. You must configure each client NAD to direct end-user host access requests to the ACS by using the TACACS+ or RADIUS protocols.
TACACS+ is traditionally used to provide authorization for network administrative operations on the network infrastructure itself; RADIUS is universally used to secure the access of end-users to network resources.
Basically, the NAD serves as the network gatekeeper, and sends an access request to ACS on behalf of the user. ACS verifies the username, password and possibly other data by using its internal database or one of the configured external identity directories. ACS ultimately responds to the NAD with an access denied or an access-accept message with a set of authorization attributes. When ACS is used in the context of the NAC architecture, additional machine data, known as posture, is validated as well, before the user is granted access to the network.
AAA Protocols—TACACS+ and RADIUS
ACS can use the TACACS+ and RADIUS AAA protocols.
Table 1-1 compares the two protocols.
TACACS+
ACS conforms to the TACACS+ protocol as defined by Cisco Systems in draft 1.78. For more information, refer to the Cisco IOS software documentation at http://www.cisco.com.
RADIUS
ACS conforms to the RADIUS protocol as defined in the draft of April 1997 and in the following Requests for Comments (RFCs):
•
•
•
•
•
•
•
•
The ports used for authentication and accounting have changed in RADIUS RFC documents. To support the older and newer RFCs, ACS accepts authentication requests on port 1645 and port 1812. For accounting, ACS accepts accounting packets on port 1646 and 1813.
In addition to support for standard Internet Engineering Task Force (IETF) RADIUS attributes, ACS includes support for RADIUS vendor-specific attributes (VSAs). We have predefined the following RADIUS VSAs in ACS:
•
•
•
•
•
•
•
•
•
ACS also supports up to 10 RADIUS VSAs that you define. After you define a new RADIUS VSA, you can use it as you would one of the RADIUS VSAs that come predefined in ACS. In the Network Configuration section of the ACS web interface, you can configure AAA clients to use a user-defined RADIUS VSA as the AAA protocol. In Interface Configuration, you can enable user-level and group-level attributes for user-defined RADIUS VSAs. In User Setup and Group Setup, you can configure the values for enabled attributes of a user-defined RADIUS VSA.
For more information about creating user-defined RADIUS VSAs, see Custom RADIUS Vendors and VSAs, page 8-19.
Platforms
ACS is available on two platforms, ACS for Windows and ACS for the Solution Engine. ACS for Windows is a software platform. The Solution Engine is a hardware and software platform that requires a network appliance.
The platforms are nearly identical. However, only Windows supports Open Database Connectivity (ODBC) databases, and the CSUtil.exe database utility. Support for the Solution Engine, which is not required for Windows, includes the Remote Agent, the Simple Network Management Protocol (SNMP), File Transfer Protocol (FTP) server support, a serial console, and support for the Cisco Security Agent.
This guide identifies information exclusively belonging to one platform as "ACS for Windows only" or "ACS Solution Engine only." All other text belongs to both platforms.
Additional Features in This Release
This release of ACS provides the following features that protect networked business systems:
•
Authentication:
–
–
–
–
–
–
–
Audit and Reporting:
–
–
–
Authorization: Providing a read-only privilege for users and groups.
•
•
•
•
•
•
•
•
–
–
•
–
–
•
•
•
Note
Authentication
Authentication determines user identity and verifies the information. Traditional authentication uses a name and a fixed password. More secure methods use technologies such as Challenge Authentication Handshake Protocol (CHAP) and One-time Passwords (OTPs). ACS supports a variety of these authentication methods.
A fundamental implicit relationship exists between authentication and authorization. The more authorization privileges granted to a user, the stronger the authentication should be. ACS supports this relationship by providing various methods of authentication.
This section contains the following topics:
•
•
•
•
Authentication Considerations
Username and password is the most popular, simplest, and least-expensive method of authentication. The disadvantage is that this information can be told to someone else, guessed, or captured. Simple unencrypted username and password is not considered a strong authentication mechanism but can be sufficient for low authorization or privilege levels such as Internet access.
You should use encryption to reduce the risk of password capturing on the network. Client and server access-control protocols such as TACACS+ and RADIUS encrypt passwords to prevent them from being captured within a network. However, TACACS+ and RADIUS operate only between the AAA client and ACS. Before this point in the authentication process, unauthorized persons can obtain clear-text passwords, such as:
•
•
•
Authentication and User Databases
ACS supports a variety of user databases. It supports the ACS internal database and several external user databases, including:
•
•
•
•
•
•
Authentication Protocol-Database Compatibility
The various password protocols that ACS supports for authentication are supported unevenly by the various databases that ACS supports. For more information about the password protocols that ACS supports, see Passwords.
Table 1-2 specifies non-EAP authentication protocol support.
Table 1-3 specifies EAP authentication protocol support.
Passwords
ACS supports many common password protocols:
•
•
•
•
•
•
•
•
•
•
•
Passwords can be processed by using these password-authentication protocols based on the version and type of security-control protocol used (for example, RADIUS or TACACS+), and the configuration of the AAA client and end-user client. The following sections outline the different conditions and functions of password handling.
In the case of token servers, ACS acts as a client to the token server by using its proprietary API or its RADIUS interface, depending on the token server. For more information, see About Token Servers and ACS, page 12-50.
Different levels of security can be concurrently used with ACS for different requirements. The basic user-to-network security level is PAP. Although PAP provides unencrypted security, PAP does offer convenience and simplicity for the client. PAP allows authentication against the Windows database. With this configuration, users need to log in only once. CHAP allows a higher level of security for encrypting passwords when communicating from an end-user client to the AAA client. You can use CHAP with the ACS internal database. ARAP support is included to support Apple clients.
Comparing PAP, CHAP, and ARAP
PAP, CHAP, and ARAP are authentication protocols that encrypt passwords. However, each protocol provides a different level of security. Table 1-4 describes the security associated with each protocol.
MS-CHAP
ACS supports MS-CHAP for user authentication. Differences between MS-CHAP and standard CHAP are:
•
•
•
For more information on MS-CHAP, refer to RFC 2433 Microsoft PPP CHAP Extensions for RADIUS Attributes for MS-CHAP Support.
EAP Support
The EAP, based on IETF 802.1x, is an end-to-end framework that allows the creation of authentication types without changing AAA client configurations. For more information about EAP, see RFC 2284, PPP Extensible Authentication Protocol (EAP).
ACS supports several EAP protocols. Table 1-5 describes each supported protocol.
Table 1-5 EAP Protocol Support
EAP-MD5
An EAP protocol that does not support mutual authentication.
EAP-TLS
EAP incorporating Transport Layer Security. For more information, see EAP-TLS Deployment Guide for Wireless LAN Networks and EAP-TLS Authentication, page 9-2.
LEAP
An EAP protocol that Cisco Aironet wireless equipment uses; it supports mutual authentication.
PEAP
Protected EAP, which is implemented with EAP-Generic Token Card (GTC), EAP -TLS and EAP-MS-CHAPv2 protocols. For more information, see PEAP Authentication, page 9-5.
EAP-FAST
A faster means of encrypting EAP authentication, supports EAP-GTC authentication. For more information, see EAP-FAST Authentication, page 9-8.
The architecture of ACS is extensible with regard to EAP; additional varieties of EAP will be supported as those protocols mature.
Basic Password Configurations
Several basic password configurations are available:
Note
•
•
•
Advanced Password Configurations
ACS supports the following advanced password configurations:
•
•
•
The TACACS+ SENDAUTH feature enables AAA clients to authenticate themselves to other AAA clients or an end-user clients via outbound authentication. The outbound authentication can be PAP, CHAP, or ARAP. With outbound authentication, the ACS password is given out. By default, ASCII/PAP or CHAP/ARAP password is used, depending on how this has been configured; however, we recommend that you configure the separate SENDAUTH password for the user so that ACS inbound passwords are never compromised.
If you want to use outbound passwords and maintain the highest level of security, we recommend that you configure users in the ACS internal user database with an outbound password that is different from the inbound password.
Password Aging
With ACS you can choose whether and how to employ password aging. Control for password aging may reside in the ACS internal database, or in an external Windows user database. Each password-aging mechanism differs as to requirements and setting configurations.
You use the password aging feature the ACS internal database controls to force users to change their passwords under any of the following conditions:
•
•
•
For information on the requirements and configuration of the password aging feature that the ACS internal database controls, see Enabling Password Aging for the ACS Internal Database, page 5-15.
You use the Windows-based password aging feature to control the following password aging parameters:
•
•
The methods and functionality of Windows password aging differ according to the Windows operating system release. For information on the requirements and configuration of the Windows-based password aging feature, see Enabling Password Aging for Users in Windows Databases, page 5-19, and refer to your Windows system documentation.
User-Changeable Passwords
With ACS, you can install a separate program so that users can change their passwords by using a web-based utility. For more information about installing user-changeable passwords, see the Installation and User Guide for Cisco Secure ACS User-Changeable Passwords on http://www.cisco.com.
Other Authentication-Related Features
In addition to the authentication-related features discussed in this section, ACS provides additional features:
•
•
•
•
•
•
•
•
•
Authorization
Authorization determines what a user is allowed to do. ACS can send user profile policies to AAA clients to determine which network services the user can access. You can configure authorization to give different users and groups different levels of service. For example, standard dial-up users might not have the same access privileges as premium customers and users. You can also differentiate by levels of security, access times, and services.
You can use the ACS access restrictions feature to permit or deny logins based on time-of-day and day-of-week. For example, you could create a group for temporary accounts that you can disable on specified dates. A service provider could then offer a 30-day free trial. You could use the same authorization to create a temporary account for a consultant with login permission that is limited to Monday through Friday, 9 A.M. to 5 P.M.
You can also apply the following restrictions to users:
•
•
•
•
On a per-user or per-group basis, access lists can restrict the following user access:
•
•
One fast-growing service that providers offer and corporations adopt is a service authorization for Virtual Private Dial-Up Networks (VPDNs). ACS can provide information to the network device for a specific user to configure a secure tunnel through a public network, such as the Internet. The information can be for the access server (such as the home gateway for that user) or for the home gateway router to validate the user at the customer premises. In either case, ACS can be used for each end of the VPDN.
This section contains the following topics:
•
•
Max Sessions
Max Sessions is a useful feature for organizations that need to limit the number of concurrent sessions that are available to a user or a group:
•
•
In addition to enabling simple User and Group Max Sessions control, as an administrator you can use ACS to specify a Group Max Sessions value and a group-based User Max Sessions value; that is, a User Max Sessions value based on the group membership of the user. For example, an administrator can allocate a Group Max Sessions value of 50 to the group Sales and also limit each member of the Sales group to five sessions each. Therefore, no single member of a group account would be able to use more than five sessions at any one time, but the group could still have up to 50 active sessions.
For more information about the Max Sessions feature, see Setting Max Sessions for a User Group, page 5-9 and Setting Max Sessions Options for a User, page 6-11.
Dynamic Usage Quotas
You can use ACS to define network usage quotas for users. Using quotas, you can limit the network access of each user in a group or of individual users. You define quotas by duration of sessions or the total number of sessions. Quotas can be absolute; or based on daily, weekly, or monthly periods. To grant access to users who have exceeded their quotas, you can reset session quota counters as needed.
To support time-based quotas, we recommend enabling accounting update packets on all AAA clients. If update packets are not enabled, the quota is updated only when the user logs off and the accounting stop packet is received from the AAA client. If the AAA client through which the user is accessing your network fails, the session information is not updated. In the case of multiple sessions, such as with ISDN, the quota would not be updated until all sessions terminate, which means that a second channel will be accepted; even if the first channel has exhausted the quota that is allocated to the user.
For more information about usage quotas, see Setting Usage Quotas for a User Group, page 5-10 and Options for Setting User Usage Quotas, page 6-12.
Shared Profile Components
ACS provides a means for specifying authorization profile components that you can apply to multiple user groups and users. For example, you may have multiple user groups that have identical network-access restrictions. Rather than configuring the network-access restrictions several times, once per group, you can configure a network-access restriction set in the Shared Profile Components section of the web interface, and then configure each group to use the network-access restriction set that you created.
For information about the types of shared-profile components that ACS supports, see About Shared Profile Components, page 4-1.
Support for Cisco Device-Management Applications
ACS supports Cisco device-management applications, such as by providing command authorization for network users who are using the management application to configure managed network devices. You provide support for command authorization for management application users by using unique command-authorization set types for each management application that is configured to use ACS for authorization.
ACS uses TACACS+ to communicate with management applications. For a management application to communicate with ACS, you must configure the management application in ACS as a AAA client that uses TACACS+. Also, you must provide the device-management application with a valid administrator name and password. When a management application initially communicates with ACS, these requirements ensure the validity of the communication.
Additionally, the administrator that the management application uses must have the Create New Device Command Set Type privilege enabled. When a management application initially communicates with ACS, it dictates to ACS the creation of a device command set type, which appears in the Shared Profile Components section of the web interface. It also dictates a custom service for TACACS+ to authorize. The custom service appears on the TACACS+ (Cisco IOS) page in the Interface Configuration section of the web interface. For information about enabling TACACS+ services, see Displaying TACACS+ Configuration Options, page 2-6. For information about device command-authorization sets for management applications, see Command Authorization Sets, page 4-25.
After the management application has dictated the custom TACACS+ service and device command-authorization set type to ACS, you can configure command-authorization sets for each role that the management application supports and apply those sets to user groups that contain network administrators or to individual users who are network administrators.
Other Authorization-Related Features
In addition to the authorization-related features discussed in this section, ACS provides these additional features:
•
•
•
•
•
•
•
•
•
•
•
•
•
Accounting
AAA clients use the accounting functions that the RADIUS and TACACS+ protocols provide to communicate relevant data for each user session to the AAA server for recording. You can import the accounting logs into popular database and spreadsheet applications for billing, security audits, and report generation. You can also use a third-party reporting tool to manage accounting data.
ACS writes accounting records to one or more of the following, depending on your configuration:
•
•
•
The types of accounting logs that you can generate include:
•
•
•
For more information about ACS logging capabilities, see Chapter 10, "Logs and Reports."
Other Accounting-Related Features
In addition to the accounting-related features in this section, ACS provides these additional features:
•
–
–
For more information, see Remote Logging for ACS for Windows, page 10-9.
•
•
Managing and Administrating ACS
ACS provides a flexible administration scheme to configure, maintain, and protect its AAA functionality. You can perform nearly all ACS administration tasks through the ACS web interface. You use the web interface to easily modify the ACS configuration from any connection on your LAN or WAN, and view it by using a web browser. For a list of supported browsers, see the latest version of the Release Notes for Cisco Secure ACS Release 4.1 on
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/release/notes/RNacs41.html.The web interface not only makes viewing and editing user and group information possible, you use it to restart services, add remote administrators, change AAA client information, back up the system, view reports from anywhere on the network, and more.
This section describes the ACS web interface and provides information about the following topics:
•
•
•
•
Web Interface Security
Accessing the web interface requires a valid administrator name and password. The ACS Login page encrypts the administrator credentials before sending them to ACS.
Administrative sessions time out after a configurable length of idle time. Regardless, we recommend that you log out of the web interface after each session. For information about configuring the idle timeout feature, see Configuring Access Policy, page 11-8 and Access Policy Setup Page, page 11-18.
You can enable a secure socket layer (SSL) for administrative sessions. This method ensures that all communication between the web browser and ACS is encrypted. Your browser must support SSL. You can enable this feature on the Access Policy Setup page in the Administration Control section. For more information about enabling the SSL for web interface security, see Configuring Access Policy, page 11-8 and Access Policy Setup Page, page 11-18.
Cisco Security Agent Integration (ACS Solution Engine Only)
Cisco Security Agent protects the ACS Solution Engine. Whether you have applied a Cisco Security Agent update to ACS or you are using an appliance base image that incorporates the Cisco Security Agent, the Cisco Security Agent helps to protect ACS from viruses, worms, and attacks. On the ACS Solution Engine, the Cisco Security Agent operates in standalone mode, which Cisco has configured to permit ACS to operate normally while providing protection.
Note
This section contains the following topics:
•
•
•
Cisco Security Agent Service Management
The Cisco Security Agent runs on the appliance as an additional service, named CSAgent.
From the appliance console, you can use the start, stop, and restart commands to manage CSAgent. For more information about these commands, see the Installation Guide for Cisco Secure ACS Solution Engine Release 4.1.
From the HTML interface, you can use the Appliance Configuration page in the System Configuration section of the web interface to enable or disable CSAgent. For more information, see Appliance Configuration (ACS Solution Engine Only), page 7-20.
Cisco Security Agent Logging
The Cisco Security Agent writes two logs to the appliance hard drive, CSALog and CSASecurityLog. The size of each log is limited to 1 MB. When a Cisco Security Agent log exceeds 1 MB, the Cisco Security Agent begins a new log file. ACS retains the three most recent files for each Cisco Security Agent log.
From the appliance console, you can use the exportlogs command to retrieve the Cisco Security Agent logs. For more information about the exportlogs command or using the console, see the Installation Guide for Cisco Secure ACS Solution Engine Release 4.1.
From the web interface, you can view the Cisco Security Agent logs by clicking the links on the View Diagnostic Logs page in the System Configuration section.
Cisco Security Agent Restrictions
The protection that the Cisco Security Agent provides to the appliance imposes the following restrictions when CSAgent is enabled:
•
•
For information about disabling CSAgent, see Cisco Security Agent Service Management.
Cisco Security Agent Policies
The Cisco Security Agent is configured with the following policies:
•
•
•
–
–
–
–
–
–
–
–
–
–
•
•
•
•
–
–
–
–
–
–
HTTP Port Allocation for Administrative Sessions
You use the HTTP port allocation feature to configure the range of TCP ports that ACS uses for administrative HTTP sessions. Narrowing this range with the HTTP port allocation feature reduces the risk of unauthorized access to your network through a port that is open for administrative sessions.
We do not recommend that you administer ACS through a firewall. Doing so requires that you configure the firewall to permit HTTP traffic over the range of HTTP administrative session ports that ACS uses. While narrowing this range reduces the risk of unauthorized access, a greater risk of attack remains if you allow administration of ACS from outside a firewall. A firewall that is configured to permit HTTP traffic over the ACS administrative port range must also permit HTTP traffic through port 2002, because a web browser must address this port to initiate an administrative session.
Note
For information about configuring the HTTP port allocation feature, see Configuring Access Policy, page 11-8 and Access Policy Setup Page, page 11-18.
Web Interface Layout
The web interface has three vertical partitions, known as frames:
•
–
–
–
–
–
–
–
–
–
–
–
–
•
Note
•
–
–
–
Uniform Resource Locator for the Web Interface
You can access the ACS web interface by using one of the following uniform resource locators (URLs):
•
•
where IP address is the dotted decimal IP address and hostname is the hostname of the server that is running ACS. If you use the hostname, DNS must be functioning properly on your network or the hostname must be listed in the local hosts file of the computer that is running the browser.
If ACS is configured to use SSL to protect administrative sessions, you must specify the HTTPS protocol in the URLs:
•
•
If SSL is enabled and you do not specify HTTPS, ACS redirects the initial request to HTTPS for you. Using SSL to access the login page protects administrator credentials. For more information about enabling SSL to protect administrative sessions, see Configuring Access Policy, page 11-8 and Access Policy Setup Page, page 11-18.
From the computer that is running ACS, you can also use the following URLs:
•
•
If SSL is enabled, you can specify the HTTP protocol in the URLs:
•
•
Online Help and Online Documentation
We provide two sources of information in the web interface:
•
•
Using Online Help
Each page in the Web interface includes a corresponding online help page. Each online help page contains a list of topics that correspond to the current web page.
The two help icons that appear on pages in ACS are:
•
•
Using the Online User Guide
The user guide provides information about the configuration, operation, and concepts of ACS. The information in the online documentation version of the user guide is as current as the release date of the ACS version that you are using. For the latest documentation about ACS, click http://www.cisco.com.
To access online documentation:
Step 1
ACS Specifications
Note
This section contains the following topics:
•
System Performance Specifications
The performance capabilities of ACS are depend mostly on the Windows server it is installed on, your network topology and network management, the selection of user databases, and other factors. For example, ACS can perform many more authentications per second if it is using its internal user database and running on a computer that is using the fastest processor and network interface card available than if it is using external user databases and running on a computer that complies with the minimum system requirements. (See the Installation Guide for Cisco Secure ACS for Windows Release 4.1 or Installation Guide for Cisco Secure ACS Solution Engine Release 4.1.)
The following items are general answers to common system-performance questions. The performance of ACS in your network depends on your specific environment and AAA requirements.
•
•
•
If your network comprises tens of thousands of AAA clients, we recommend using multiple ACSs and assigning a manageable number of AAA clients to each ACS. For example, if you have 80,000 AAA clients, you could use four ACS servers and divide the AAA client load among them so that no single ACS manages more than 40,000 AAA client configurations. Then you can have overlapping AAA client support for backup AAA servers and not exceed the 50,000 AAA client limit. If you use replication to propagate configuration data among ACSs, limit replication of AAA client data to ACSs that serve the same set of AAA clients.
ACS Windows Services
ACS operates as a set of Microsoft Windows services. When you install ACS, the installation adds these Windows services to the server. These services provide the core of ACS functionality.
The ACS services on the computer running ACS include:
•
•
•
•
•
•
•
For a full description of each service, see Appendix G, "Internal Architecture."
You can start and stop each module individually from within the serial console and Microsoft Windows Service Control Panel or as a group from within the serial console or the ACS web interface. For information about stopping and starting ACS services by using the serial console, see the Installation Guide for Cisco Secure ACS Solution Engine Release 4.1. For information about stopping and starting ACS services by using the web interface, see Service Control, page 7-1. For information on service logs and gathering data for troubleshooting, see Service Logs, page 10-12.
Network administrators who offer increased levels of security services and corporations that want to lessen the chance of intruder access resulting from password capturing can use an OTP. ACS supports several types of OTP solutions, including PAP for Point-to-Point Protocol (PPP) remote-node login. Token cards are considered one of the strongest OTP authentication mechanisms.
Online Documentation Reference
Table 1-6 describes the options in the online documentation interface.
Related Documentation
Note
The following sections list various categories of documents on ACS and related topics.
TACACS+ Documents
For a general description of the Cisco TACACS+ protocol, see:
http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a0080094e99.shtml
Network Admission Control (NAC) documentation
For general information about NAC and links to additional web pages about NAC, see:
http://www.cisco.com/en/US/netsol/ns466/
For information on technical documentation for NAC, see:
http://www.cisco.com/en/US/products/ps6128/tsd_products_support_series_home.html
Requests for Comments (RFCs)
The following RFCs describe several of the security protocols used by ACS:
•
http://www.rfc-archive.org/getrfc.php?rfc=2865
•
http://www.rfc-archive.org/getrfc.php?rfc=3748
•
http://www.rfc-archive.org/getrfc.php?rfc=4346
•
http://www.rfc-archive.org/getrfc.php?rfc=2716
Technology White Papers
Cisco.com and Cisco Connection Online (CCO) contain a number of White Papers that present basic network security concepts and information about planning and configuring ACS installations:
A list of white papers specifically related to ACS available at:
http://www.cisco.com/en/US/partner/products/sw/secursw/ps2086/prod_white_papers_list.html
Additional white papers on related topics are available:
•
http://www.cisco.com/en/US/tech/tk869/tk769/
technologies_white_paper09186a008014f945.shtml•
http://www.cisco.com/en/US/docs/ios/12_1/security/configuration/guide/scdoverv.html
•
http://www.cisco.com/en/US/products/hw/wireless/ps430/
products_white_paper09186a008009256b.shtmlQuestion and Answer Pages
For answers to common questions about Cisco EAP-FAST, see the Cisco EAP-FAST Q&A page:
http://www.cisco.com/en/US/products/hw/wireless/ps430/
products_qanda_item09186a00802030dc.shtmlTutorials
The ACS Primer is a training course on ACS 4.0:
Software Download
To download Cisco software that is mentioned in this manual, such as Cisco Authentication Agent, go to the Cisco Software Center at:
http://www.cisco.com/cisco/web/download/index.html.
