Cisco Acs 5x User Guide

							5-15
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 5      Understanding My Workspace
  Using the Web Interface
Figure 5-10 Transfer Box
Table 5-6 Transfer Box Fields and Buttons
Field or Button Description
Available List of available items for selection.
Selected Ordered list of selected items.
Right arrow (>) Click to move one selected item from the Available list to the Selected 
list.
Left arrow (>) Click to move all items from the Available list to the Selected list.
Double left arrow (
						

							5-16
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 5      Understanding My Workspace
  Using the Web Interface
Schedule Boxes
Schedule boxes are a common element in content area pages (see Figure 5-10). You use them to select 
active times for a policy element from a grid, where each row represents a day of the week and each 
square in a row represents an hour in a day. 
Click one square to make one hour active. Ta b l e 5 - 7 describes the Schedule box options.
Figure 5-11 Schedule Box
Rule Table Pages
Rule table pages display the rules that comprise policies. You can reorder rules within a rule table page 
and submit the policy that is associated with a table. You can access properties and customization pages 
from rule tables to configure your policies. 
For more information on specific rule table pages, and properties and customization pages, see 
Managing Access Policies. 
Table 5-7 Schedule Box Fields and Buttons
Field or Button Description
Mon Row that indicates Monday of every week of every year.
Tue Row that indicates Tuesday of every week of every year.
Wed Row that indicates Wednesday of every week of every year.
Thu Row that indicates Thursday of every week of every year.
Fri Row that indicates Friday of every week of every year.
Sat Row that indicates Saturday of every week of every year.
Sun Row that indicates Sunday of every week of every year.
0:00 to 24:00 Indicates the hours of a day in columns, where 0:00 = the hour that begins the 
second after midnight Eastern Standard Time (EST), and 24:00 = midnight to 
1:00 a.m., in the time zone in which your ACS instance is located.
Square (of the grid) Click one square to make one hour active.
Set All Click to select all squares (hours).
Clear All Click to deselect all squares (hours).
Undo All Click to remove your most recent selections. 
						

							5-17
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 5      Understanding My Workspace
  Using the Web Interface
Directly above the rule table are two display options:
Standard Policy—Click to display the standard policy rule table.
Exception Policy—Click to display the exception policy rule table, which takes precedence over the 
standard policy rule table content.
Ta b l e 5 - 8 describe the common options of standard and exception rule table pages:
Ta b l e 5 - 8 R u l e  Ta b l e  P a g e  O p t i o n s  
Option Description
# Ordered column of rules within the rule table. You can renumber the rules by reordering, adding, or 
deleting rules and then clicking Save Changes to complete the renumbering. 
New rules are added to the end of the ordered column, so you must reorder them if you want to move 
a new rule to a different position within the ordered list.
You cannot reorder the default (catch-all) rule, which remains at the bottom of the rule table.
Check box Click one or more check boxes to select associated rules on which to perform actions.
Status (Display only.) Indicates the status of rules within the rule table. The status can be:
Enabled—Indicated by a green (or light colored) circle with a white check mark.
Disabled—Indicated by a red (or dark colored circle) with a white x.
Monitor-only—Indicated by a gray circle with a black i.
Name Unique name for each rule (except the default, catch-all rule). Click a name to edit the associated rule. 
When you add a new rule, it is given a name in the format 
Rule-num, where num is the next available 
consecutive integer. 
You can edit the name to make it more descriptive. Cisco recommends that you name rules with 
concatenation of the rule name and the service and policy names.
Conditions Variable number of condition types are listed, possibly in subcolumns, dependent upon the policy 
type. 
Results Variable number of result types are listed, possibly in subcolumns, dependent upon the policy type.
Hit Counts column View the hits counts for rules, where hits indicate which policy rules are invoked.
Rules scroll bar Use the scroll bar at the right of the rules rows to scroll up and down the rules list.
Conditions and 
results scroll barUse the scroll bar beneath the Conditions and Results columns to scroll left and right through the 
conditions and results information.
Default rule Click to configure the catch-all rule. This option is not available for exception policy rule tables.
Customize Click to open a secondary window where you can determine the set and order of conditions and results 
used by the rule table.
Hit Counts button Click to open a secondary window where you can: 
View when the hit counters were last reset or refreshed.
View the collection period.
Request a reset or refresh of the hit counts.
See Displaying Hit Counts, page 10-10 for more information.
Move to... Use the ^ and v buttons to reorder selected rules within the rule table.
Save Changes Click to submit your configuration changes.
Discard Changes Click to discard your configuration changes prior to saving them. 
						

							5-18
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 5      Understanding My Workspace
  Importing and Exporting ACS Objects through the Web Interface
Related Topic
ACS 5.x Policy Model
Importing and Exporting ACS Objects through the Web Interface
You can use the import functionality in ACS to add, update, or delete multiple ACS objects at the same 
time. ACS uses a comma-separated values (CSV) file to perform these bulk operations. This .csv file is 
called an import file. ACS provides a separate .csv template for add, update, and delete operations for 
each ACS object. 
The first record in the .csv file is the header record from the template that contains column (field) names. 
You must download these templates from the ACS web interface. The header record from the template 
must be included in the first row of any .csv file that you import.
NoteYou cannot use the same template to import all the ACS objects. You must download the template that 
is designed for each ACS object and use the corresponding template while importing the objects. 
However, you can use the export file of a particular object, retain the header and update the data, and use 
it as the import file of the same object.
You can use the export functionality to create a .csv file that contains all the records of a particular object 
type that are available in the ACS internal store.
You must have CLI administrator-level access to perform import and export operations. Additionally:
To import ACS configuration data, you need CRUD permissions for the specific configuration 
object.
To export data to a remote repository, you need read permission for the specific configuration object.
This functionality is not available for all ACS objects. This section describes the supported ACS objects 
and how to create the import files.
This section contains:
Supported ACS Objects, page 5-18
Creating Import Files, page 5-20
Supported ACS Objects
While ACS 5.3 allows you to perform bulk operations (add, update, delete) on ACS objects using the 
import functionality, you cannot import all ACS objects. The import functionality in ACS 5.3 supports 
the following ACS objects:
Users
Hosts
Network Devices
Identity Groups
NDGs
Downloadable ACLs
Command Sets 
						

							5-19
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 5      Understanding My Workspace
  Importing and Exporting ACS Objects through the Web Interface
Ta b l e 5 - 9 lists the ACS objects, their properties, and the property data types. The import template for 
each of the objects contains the properties described in this table.
NoteThe limitations given in Ta b l e 5 - 9 is applicable only to the internal database users and not applicable to 
the external database (AD, LDAP, or RSA) users.
Table 5-9 ACS Objects – Property Names and Data Types
Property Name Property Data Type
Object Type: User
Username (Required in create, edit, and delete) String. Maximum length is 64 characters.
Description (Optional) String. Maximum length is 1024 characters.
Enabled (Required in create) Boolean.
Change Password (Required in create) Boolean.
Password (Required in create) String. Maximum length is 32 characters. Not available in 
Export.
Enable Password (Optional) String. Maximum length is 32 characters.
User Identity Group (Optional) String. Maximum length is 256 characters.
List of attributes (Optional) String and other data types.
Object Type: Hosts
MAC address (Required in create, edit, delete) String. Maximum length is 64 characters.
Description (Optional) String. Maximum length is 1024 characters.
Enabled (Optional) Boolean.
Host Identity Group (Optional) String. Maximum length is 256 characters.
List of attributes (Optional) String.
Object Type: Network Device
Name (Required in create, edit, delete) String. Maximum length is 64 characters.
Description (Optional) String. Maximum length is 1024 characters.
Subnet (Required in create) String.
Support RADIUS (Required in create) Boolean.
RADIUS secret (Optional) String. Maximum length is 32 characters.
Support TACACS (Required in create) Boolean.
TACACS secret (Optional) String. Maximum length is 32 characters.
Single connect (Optional) Boolean.
Legacy TACACS (Optional) Boolean.
Support SGA (Required in create) Boolean.
SGA Identity (Optional) String. Maximum length is 32 characters.
SGA trusted (Optional) Boolean.
Password (Optional) String. Maximum length is 32 characters.
sgACLTTL (Optional) Integer. 
						

							5-20
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 5      Understanding My Workspace
  Importing and Exporting ACS Objects through the Web Interface
Fields that are optional can be left empty and ACS substitutes the default values for those fields. 
For example, when fields that are related to a hierarchy are left blank, ACS assigns the value of the root 
node in the hierarchy. For network devices, if Security Group Access is enabled, all the related 
configuration fields are set to default values.
Creating Import Files
This section describes how to create the .csv file for performing bulk operations on ACS objects. You 
can download the appropriate template for each of the objects from the ACS web interface. This section 
contains the following:
Downloading the Template from the Web Interface, page 5-21
Understanding the CSV Templates, page 5-21
Creating the Import File, page 5-22 peerAZNTTL (Optional) Integer.
envDataTTL (Optional) Integer.
Session timeout (Optional) Integer.
List of NDG names (Optional) String.
Object Type: Identity Group
Name (Required in create, edit, delete) String. Maximum length is 64 characters.
Description (Optional) String. Maximum length is 1024 characters.
Object Type: NDG
Name (Required in create, edit, delete) String. Maximum length is 64 characters.
Description (Optional) String. Maximum length is 1024 characters.
Object Type: Downloadable ACLs
Name (Required in create, edit, delete) String. Maximum length is 64 characters.
Description (Optional) String. Maximum length is 1024 characters.
Content (Required in create, edit, delete) String. The ACL content is split into 
permit/deny statements separated by a semicolon (;). Maximum length for each 
statement is 256 characters. There is no limit for ACL content.
Object Type: Command Set
Name (Required in create, edit, delete) String. Maximum length is 64 characters.
Description (Optional) String. Maximum length is 1024 characters.
Commands (in the 
form of 
grant:command:arg
uments)(Optional) String.
This is a list with semi separators (:) between the values that you supply for 
grant.
Table 5-9 ACS Objects – Property Names and Data Types (continued)
Property Name Property Data Type 
						

							5-21
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 5      Understanding My Workspace
  Importing and Exporting ACS Objects through the Web Interface
Downloading the Template from the Web Interface
Before you can create the import file, you must download the import file templates from the ACS web 
interface.
To download the import file templates for adding internal users:
Step 1Log into the ACS 5.3 web interface.
Step 2Choose Users and Identity Stores > Internal Identity Stores > Users.
The Users page appears.
Step 3Click File Operations.
The File Operations wizard appears.
Step 4Choose any one of the following:
Add—Adds users to the existing list. This option does not modify the existing list. Instead, it 
performs an append operation.
Update—Updates the existing internal user list.
Delete—Deletes the list of users in the import file from the internal identity store.
Step 5Click Next.
The Template page appears.
Step 6Click Download Add Te m p l a t e.
Step 7Click Save to save the template to your local disk.
The following list gives you the location from which you can get the appropriate template for each of 
the objects:
User—Users and Identity Stores > Internal Identity Stores > Users
Hosts—Users and Identity Stores > Internal Identity Stores > Hosts
Network Device—Network Resources > Network Devices and AAA Clients
Identity Group—Users and Identity Stores > Identity Groups
NDG
–Location—Network Resources > Network Device Groups > Location
–Device Type—Network Resources > Network Device Groups > Device Type
Downloadable ACLs—Policy Elements > Authorization and Permissions > Named Permission 
Objects > Downloadable ACLs
Command Set—Policy Elements > Authorization and Permissions > Device Administration > 
Command Sets
Follow the procedure described in this section to download the appropriate template for your object.
Understanding the CSV Templates
You can open your CSV template in Microsoft Excel or any other spreadsheet application and save the 
template to your local disk as a .csv file. The .csv template contains a header row that lists the properties 
of the corresponding ACS object. 
						

							5-22
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 5      Understanding My Workspace
  Importing and Exporting ACS Objects through the Web Interface
For example, the internal user Add template contains the fields described in Ta b l e 5 - 1 0:
Each row of the .csv file corresponds to one internal user record. You must enter the values into the .csv 
file and save it before you can import the users into ACS. See Creating the Import File, page 5-22 for 
more information on how to create the import file.
This example is based on the internal user Add template. For the other ACS object templates, the header 
row contains the properties described in Ta b l e 5 - 9 for that object.
Creating the Import File
After you download the import file template to your local disk, enter the records that you want to import 
into ACS in the format specified in the template. After you enter all the records into the .csv file, you 
can proceed with the import function. The import process involves the following:
Adding Records to the ACS Internal Store, page 5-22
Updating the Records in the ACS Internal Store, page 5-23
Deleting Records from the ACS Internal Store, page 5-24
Adding Records to the ACS Internal Store
When you add records to the ACS internal store, you add the records to the existing list. This is an 
append operation, in which the records in the .csv file are added to the list that exists in ACS.
To add internal user records to the Add template:
Step 1Download the internal user Add template. See Downloading the Template from the Web Interface, 
page 5-21 for more information.
Step 2Open the internal user Add template in Microsoft Excel or any other spreadsheet application. See 
Ta b l e 5 - 9 for a description of the fields in the header row of the template.
Step 3Enter the internal user information. Each row of the .csv template corresponds to one user record.
Figure 5-12 shows a sample Add Users import file.
Table 5-10 Internal User Add Template
Header Field Description
name:String(64):Required Username of the user.
description:String(1024) Description of the user.
enabled:Boolean 
(True,False):RequiredBoolean field that indicates whether the user must be enabled or disabled.
changePassword:Boolean 
(True,False):RequiredBoolean field that indicates whether the user must change password on first login.
password:String(32):Required Password of the user.
enablePassword:String(32) Enable password of the user.
UserIdentityGroup:String(256) Identity group to which the user belongs.
All the user attributes that you have specified would appear here. 
						

							5-23
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 5      Understanding My Workspace
  Importing and Exporting ACS Objects through the Web Interface
Figure 5-12 Add Users – Import File
Step 4
Save the add users import file to your local disk.
Updating the Records in the ACS Internal Store
When you update the records in the ACS store, the import process overwrites the existing records in the 
internal store with the records from the .csv file. This operation replaces the records that exist in ACS 
with the records from the .csv files.
The update operation is similar to the add operation except for one additional column that you can add 
to the Update templates. The Update template can contain an Updated name column for internal users 
and other ACS objects, and an Updated MAC address column for the internal hosts. The Updated Name 
replaces the name.
TimesaverInstead of downloading the update template for each of the ACS objects, you can use the export file of 
that object, retain the header row, and update the data to create your update .csv file.
To add an updated name or MAC address to the ACS objects, you have to download and use the particular 
update template. Also, for the NDGs, the export template contains only the NDG name, so in order to 
update any other property, you must download and use the NDG update template.
For example, Figure 5-13 shows a sample import file that updates existing user records. 
						

							5-24
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 5      Understanding My Workspace
  Importing and Exporting ACS Objects through the Web Interface
Figure 5-13 Update Users–Import File
NoteThe second column, Updated name, is the additional column that you can add to the Update template.
Deleting Records from the ACS Internal Store
You can use this option to delete a subset of records from the ACS internal store. The records that are 
present in the .csv file that you import are deleted from the ACS internal store. The Delete template 
contains only the key column to identify the records that must be deleted.
For example, to delete a set of internal users from the ACS internal identity store, download the internal 
user Delete template and add the list of users that you want to delete to this import file. Figure 5-14 
shows a sample import file that deletes internal user records.
TimesaverTo delete all users, you can export all users and then use the same export file as your import file to delete 
users.
Figure 5-14 Delete Users – Import File