Summary of the content on the page No. 1
User Guide for Cisco Secure Access
Control System 5.4
November 2013
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: 408 526-4000
800 553-NETS (6387)
Fax: 408 527-0883
Text Part Number: OL-26225-01
Summary of the content on the page No. 2
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE IN
Summary of the content on the page No. 3
CONTENTS Preface xxiii Audience xxiii Document Conventions xxiii Documentation Updates xxiv Related Documentation xxiv Obtaining Documentation and Submitting a Service Request xxv CHAPTER 1 Introducing ACS 5.4 1-1 Overview of ACS 1-1 ACS Distributed Deployment 1-2 ACS 4.x and 5.4 Replication 1-2 ACS Licensing Model 1-3 ACS Management Interfaces 1-3 ACS Web-based Interface 1-4 ACS Command Line Interface 1-4 ACS Programmatic Interfaces 1-5 Hardware Models Supported by ACS 1-5 CHAPTER 2 Migrating f
Summary of the content on the page No. 4
Contents Policy Terminology 3-3 Simple Policies 3-4 Rule-Based Policies 3-4 Types of Policies 3-5 Access Services 3-6 Identity Policy 3-9 Group Mapping Policy 3-11 Authorization Policy for Device Administration 3-11 Processing Rules with Multiple Command Sets 3-11 Exception Authorization Policy Rules 3-12 Service Selection Policy 3-12 Simple Service Selection 3-12 Rules-Based Service Selection 3-13 Access Services and Service Selection Scenarios 3-13 First-Match Rule Tables 3-14 Policy Condition
Summary of the content on the page No. 5
Contents Agentless Network Access 4-12 Overview of Agentless Network Access 4-12 Host Lookup 4-13 Authentication with Call Check 4-14 Process Service-Type Call Check 4-15 PAP/EAP-MD5 Authentication 4-15 Agentless Network Access Flow 4-16 Adding a Host to an Internal Identity Store 4-17 Configuring an LDAP External Identity Store for Host Lookup 4-17 Configuring an Identity Group for Host Lookup Network Access Requests 4-18 Creating an Access Service for Host Lookup 4-18 Configuring an Identity P
Summary of the content on the page No. 6
Contents My Account Page 5-2 Login Banner 5-3 Using the Web Interface 5-3 Accessing the Web Interface 5-4 Logging In 5-4 Logging Out 5-5 Understanding the Web Interface 5-5 Web Interface Design 5-6 Navigation Pane 5-7 Content Area 5-8 Importing and Exporting ACS Objects through the Web Interface 5-18 Supported ACS Objects 5-18 Creating Import Files 5-21 Downloading the Template from the Web Interface 5-21 Understanding the CSV Templates 5-22 Creating the Import File 5-22 Common Errors 5-25 Concu
Summary of the content on the page No. 7
Contents Viewing and Performing Bulk Operations for Network Devices 7-6 Exporting Network Devices and AAA Clients 7-7 Performing Bulk Operations for Network Resources and Users 7-8 Exporting Network Resources and Users 7-10 Creating, Duplicating, and Editing Network Devices 7-10 Configuring Network Device and AAA Clients 7-11 Displaying Network Device Properties 7-14 Deleting Network Devices 7-17 Configuring a Default Network Device 7-17 Working with External Proxy Servers 7-19 Creating, Duplica
Summary of the content on the page No. 8
Contents Viewing and Performing Bulk Operations for Internal Identity Store Hosts 8-18 Management Hierarchy 8-19 Attributes of Management Hierarchy 8-19 Configuring AAA Devices for Management Hierarchy 8-19 Configuring Users or Hosts for Management Hierarchy 8-20 Configuring and Using UserIsInManagement Hierarchy Attribute 8-20 Configuring and Using HostIsInManagement Hierarchy Attributes 8-21 Managing External Identity Stores 8-22 LDAP Overview 8-22 Directory Service 8-23 Authentication Using L
Summary of the content on the page No. 9
Contents Configuring an AD Identity Store 8-49 Selecting an AD Group 8-53 Configuring AD Attributes 8-54 Configuring Machine Access Restrictions 8-56 RSA SecurID Server 8-57 Configuring RSA SecurID Agents 8-58 Creating and Editing RSA SecurID Token Servers 8-59 RADIUS Identity Stores 8-63 Supported Authentication Protocols 8-63 Failover 8-64 Password Prompt 8-64 User Group Mapping 8-64 Groups and Attributes Mapping 8-64 RADIUS Identity Store in Identity Sequence 8-65 Authentication Failure Messa
Summary of the content on the page No. 10
Contents Managing Authorizations and Permissions 9-17 Creating, Duplicating, and Editing Authorization Profiles for Network Access 9-18 Specifying Authorization Profiles 9-19 Specifying Common Attributes in Authorization Profiles 9-19 Specifying RADIUS Attributes in Authorization Profiles 9-22 Creating and Editing Security Groups 9-24 Creating, Duplicating, and Editing a Shell Profile for Device Administration 9-24 Defining General Shell Profile Properties 9-26 Defining Common Tasks 9-26 Definin
Summary of the content on the page No. 11
Contents Configuring a Group Mapping Policy 10-27 Configuring Group Mapping Policy Rule Properties 10-29 Configuring a Session Authorization Policy for Network Access 10-30 Configuring Network Access Authorization Rule Properties 10-32 Configuring Device Administration Authorization Policies 10-33 Configuring Device Administration Authorization Rule Properties 10-34 Configuring Device Administration Authorization Exception Policies 10-34 Configuring Shell/Command Authorization Policies for Devic
Summary of the content on the page No. 12
Contents Adding Tabs to the Dashboard 11-6 Adding Applications to Tabs 11-7 Renaming Tabs in the Dashboard 11-7 Changing the Dashboard Layout 11-8 Deleting Tabs from the Dashboard 11-8 CHAPTER 12 Managing Alarms 12-1 Understanding Alarms 12-1 Evaluating Alarm Thresholds 12-2 Notifying Users of Events 12-3 Viewing and Editing Alarms in Your Inbox 12-3 Understanding Alarm Schedules 12-9 Creating and Editing Alarm Schedules 12-9 Assigning Alarm Schedules to Thresholds 12-10 Deleting Alarm Schedules
Summary of the content on the page No. 13
Contents CHAPTER 13 Managing Reports 13-1 Working with Favorite Reports 13-3 Adding Reports to Your Favorites Page 13-3 Viewing Favorite-Report Parameters 13-4 Editing Favorite Reports 13-5 Running Favorite Reports 13-5 Deleting Reports from Favorites 13-6 Sharing Reports 13-6 Working with Catalog Reports 13-7 Available Reports in the Catalog 13-7 Running Catalog Reports 13-11 Deleting Catalog Reports 13-12 Running Named Reports 13-13 Understanding the Report_Name Page 13-14 Enabling RADIUS CoA
Summary of the content on the page No. 14
Contents Formatting String Data 13-33 Formatting Custom String Data 13-33 Formatting Date and Time 13-35 Formatting Custom Date and Time 13-35 Formatting Boolean Data 13-36 Applying Conditional Formats 13-37 Setting Conditional Formatting for Columns 13-38 Deleting Conditional Formatting 13-40 Setting and Removing Page Breaks in Detail Columns 13-40 Setting and Removing Page Breaks in a Group Column 13-41 Organizing Report Data 13-41 Displaying and Organizing Report Data 13-42 Reordering Columns
Summary of the content on the page No. 15
Contents Hiding or Displaying Detail Rows in Groups or Sections 13-68 Working with Filters 13-69 Types of Filter Conditions 13-70 Setting Filter Values 13-71 Creating Filters 13-72 Modifying or Clearing a Filter 13-73 Creating a Filter with Multiple Conditions 13-73 Deleting One Filter Condition in a Filter that Contains Multiple Conditions 13-75 Filtering Highest or Lowest Values in Columns 13-75 Understanding Charts 13-76 Modifying Charts 13-77 Filtering Chart Data 13-77 Changing Chart Subtype
Summary of the content on the page No. 16
Contents Viewing Scheduled Jobs 15-12 Viewing Process Status 15-14 Viewing Data Upgrade Status 15-15 Viewing Failure Reasons 15-15 Editing Failure Reasons 15-15 Specifying E-Mail Settings 15-16 Configuring SNMP Preferences 15-16 Understanding Collection Filters 15-17 Creating and Editing Collection Filters 15-17 Deleting Collection Filters 15-18 Configuring System Alarm Settings 15-18 Configuring Alarm Syslog Targets 15-18 Configuring Remote Database Settings 15-18 Changing the Port Numbers for
Summary of the content on the page No. 17
Contents Configuring Identity Policy Rule Properties 16-18 Administrator Authorization Policy 16-19 Configuring Administrator Authorization Policies 16-19 Configuring Administrator Authorization Rule Properties 16-20 Administrator Login Process 16-21 Resetting the Administrator Password 16-22 Changing the Administrator Password 16-22 Changing Your Own Administrator Password 16-22 Resetting Another Administrator’s Password 16-23 CHAPTER 17 Configuring System Operations 17-1 Understanding Distribu
Summary of the content on the page No. 18
Contents Creating, Duplicating, Editing, and Deleting Software Repositories 17-24 Managing Software Repositories from the Web Interface and CLI 17-25 CHAPTER 18 Managing System Administration Configurations 18-1 Configuring Global System Options 18-1 Configuring TACACS+ Settings 18-1 Configuring EAP-TLS Settings 18-2 Configuring PEAP Settings 18-3 Configuring EAP-FAST Settings 18-3 Generating EAP-FAST PAC 18-4 Configuring RSA SecurID Prompts 18-4 Managing Dictionaries 18-5 Viewing RADIUS and TAC
Summary of the content on the page No. 19
Contents Configuring Global Logging Categories 18-25 Configuring Per-Instance Logging Categories 18-29 Configuring Per-Instance Security and Log Settings 18-30 Configuring Per-Instance Remote Syslog Targets 18-31 Displaying Logging Categories 18-32 Configuring the Log Collector 18-33 Viewing the Log Message Catalog 18-33 Licensing Overview 18-34 Types of Licenses 18-34 Installing a License File 18-35 Viewing the Base License 18-36 Upgrading the Base Server License 18-37 Viewing License Feature O
Summary of the content on the page No. 20
Contents Session Access Requests (Device Administration [TACACS+]) A-2 Command Authorization Requests A-2 Network Access (RADIUS With and Without EAP) A-2 RADIUS-Based Flow Without EAP Authentication A-3 RADIUS-Based Flows with EAP Authentication A-3 Access Protocols—TACACS+ and RADIUS A-5 Overview of TACACS+ A-5 Overview of RADIUS A-6 RADIUS VSAs A-6 ACS 5.4 as the AAA Server A-7 RADIUS Attribute Support in ACS 5.4 A-8 RADIUS Attribute Rewrite Operation A-9 RADIUS Access Requests A-11 APPENDIX
