Cisco Acs 5x User Guide

							Contents
xxi
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
EAP Authentication with RADIUS Key WrapB-29
EAP-MSCHAPv2B-30
Overview of EAP-MSCHAPv2B-30
MSCHAPv2 for User AuthenticationB-30
MSCHAPv2 for Change PasswordB-30
Windows Machine Authentication Against ADB-31
EAP- MSCHAPv2 Flow in ACS 5.3B-31
CHAPB-31
LEAPB-31
Certificate AttributesB-32
Certificate Binary ComparisonB-32
Rules Relating to Textual AttributesB-33
Certificate RevocationB-33
Machine AuthenticationB-34
Authentication Protocol and Identity Store CompatibilityB-35
APPENDIX COpen Source License AcknowledgementsC-1
NoticesC-1
OpenSSL/Open SSL ProjectC-1
License IssuesC-1
C-3
GLOSSARY
INDEX 
						

							Contents
xxii
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01 
						

							1
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Preface
Revised: September 8, 2016
This guide describes how to use Cisco Secure Access Control System (ACS) 5.3.
Audience
This guide is for security administrators who use ACS, and who set up and maintain network and 
application security.
Document Conventions
This guide uses the convention whereby the symbol ^ represents the key labeled Control. For example, 
the key combination ^z means hold down the Control key while you press the zkey. 
Command descriptions use these conventions:
•Examples that contain system prompts denote interactive sessions, indicating the commands that 
you should enter at the prompt. The system prompt indicates the current level of the EXEC 
command interpreter. For example, the prompt 
Router> indicates that you should be at the user 
level, and the prompt 
Router# indicates that you should be at the privileged level. Access to the 
privileged level usually requires a password.
Commands and keywords are in boldface font.
Arguments for which you supply values are in italic font.
Elements in square brackets ([ ]) are optional.
Alternative keywords of which you must choose one are grouped in braces ({}) and separated by 
vertical bars (|).
Examples use these conventions:
Terminal sessions and sample console screen displays are in screen font.
Information you enter is in boldface screen font.
Nonprinting characters, such as passwords, are in angle brackets (< >).
Default responses to system prompts are in square brackets ([]).
An exclamation point (!) at the beginning of a line indicates a comment line. 
						

							2
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Preface
  
CautionMeans reader be careful. You are capable of doing something that might result in equipment damage or 
loss of data.
TimesaverMeans the described action saves time. You can save time by performing the action described in the 
paragraph.
NoteMeans reader take note. Notes identify important information that you should reflect upon before 
continuing, contain helpful suggestions, or provide references to materials not contained in the 
document.
Documentation Updates
Ta b l e 1 lists the updates to the User Guide for the Cisco Secure Access Control System 5.3.
Related Documentation
Ta b l e 2 lists a set of related technical documentation available on Cisco.com. To find end-user 
documentation for all products on Cisco.com, go to: http://www.cisco.com/go/techdocs.
Select Network Management > Security and Identity Management > Cisco Secure Access Control 
Server Products > Cisco Secure Access Control System.
Table 1 Updates to the User Guide for the Cisco Secure Access Control System 5.3
Date Description
9/27/2013 Fixed the following bugs:
CSCuh90646
CSCuj24445
09/17/2012 Updated theViewing and Editing Alarms in Your Inbox, page 3 with list of all 
alarm messages. 
08/28/2012 The complete behaviour of Configuring Data Purging and Incremental Backup and 
database compress operations has been changed. Updated the documents with the 
respective changes. 
04/02/2012 Updated the Attribute type with the ACS Reserved attributes in Table 18-10.
02/09/2012 Added a note in the section Understanding Distributed Deployment to fix the bug 
CSCtx03270.
02/02/2012 Fixed the bug CSCtw41634 by updating the section Configuring an AD Identity 
Store.
01/05/2012 Updated the Property Data Type of the content for the Object Downloadable ACLs 
in the Ta b l e 5 - 9. 
10/04/2011 Cisco Secure Access Control System, Release 5.3.  
						

							3
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Preface
  
NoteWe sometimes update the printed and electronic documentation after original publication. Therefore, 
you should also review the documentation on Cisco.com for any updates.
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional 
information, see the monthly What’s New in Cisco Product Documentation, which also lists all new and 
revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What’s New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed 
and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free 
service and Cisco currently supports RSS version 2.0. 
Table 2 Product Documentation
Document Title Available Formats
Open Source and Third Party Licenses used in 
Cisco Secure Access Control System, 5.3http://www.cisco.com/en/US/products/ps9911/
products_licensing_information_listing.html
License and Documentation Guide for the Cisco 
Secure Access Control System 5.3http://www.cisco.com/en/US/products/ps9911/
products_documentation_roadmaps_list.html
Release Notes for the Cisco Secure Access 
Control System 5.3http://www.cisco.com/en/US/products/ps9911/
prod_release_notes_list.html
Migration Guide for the Cisco Secure Access 
Control System 5.3http://www.cisco.com/en/US/products/ps9911/
prod_installation_guides_list.html
CLI Reference Guide for the Cisco Secure 
Access Control System 5.3http://www.cisco.com/en/US/products/ps9911/
prod_command_reference_list.html
Supported and Interoperable Devices and 
Softwares for the Cisco Secure Access Control 
System 5.3http://www.cisco.com/en/US/products/ps9911/
products_device_support_tables_list.html
Installation and Upgrade Guide for the Cisco 
Secure Access Control System 5.3http://www.cisco.com/en/US/products/ps9911/
prod_installation_guides_list.html
Software Developer’s Guide for the Cisco 
Secure Access Control System 5.3http://www.cisco.com/en/US/products/ps9911/
products_programming_reference_guides_list.html
Regulatory Compliance and Safety Information 
for Cisco Identity Services Engine, Cisco 1121 
Secure Access Control System, Cisco NAC 
Appliance, Cisco NAC Guest Server, and Cisco 
NAC Profilerhttp://www.cisco.com/en/US/docs/net_mgmt/cisco_
secure_access_control_system/5.1/regulatory/comp
liance/csacsrcsi.html 
						

							4
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Preface
   
						

							CH A P T E R
1-1
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
1
Introducing ACS 5.3
This section contains the following topics:
Overview of ACS, page 1-1
ACS Distributed Deployment, page 1-2
ACS Management Interfaces, page 1-3
Overview of ACS
ACS is a policy-based security server that provides standards-compliant Authentication, Authorization, 
and Accounting (AAA) services to your network. ACS facilitates the administrative management of 
Cisco and non-Cisco devices and applications. 
As a dominant enterprise network access control platform, ACS serves as an integration point for 
network access control and identity management.
ACS 5.x provides a rule-based policy model that allows you to control network access based on dynamic 
conditions and attributes. The rule-based policy is designed to meet complex access policy needs. For 
more information on the rule-based policy model in ACS, see Chapter 3, “ACS 5.x Policy Model.”
Within the greater context of two major AAA protocols—RADIUS and TACACS+—ACS provides the 
following basic areas of functionality:
Under the framework of the RADIUS protocol, ACS controls the wired and wireless access by users 
and host machines to the network and manages the accounting of the network resources used. 
ACS supports multiple RADIUS-based authentication methods that includes PAP, CHAP, 
MSCHAPv1, MSCHAPv2. It also supports many members of the EAP family of protocols, such as 
EAP-MD5, LEAP, PEAP, EAP-FAST, and EAP-TLS. 
In association with PEAP or EAP-FAST, ACS also supports EAP-MSCHAPv2 and EAP-GTC. For 
more information on authentication methods, see Appendix B, “Authentication in ACS 5.3”.
Under the framework of the TACACS+ protocol, ACS helps to manage Cisco and non-Cisco 
network devices such as switches, wireless access points, routers, and gateways. It also helps to 
manage services and entities such as dialup, Virtual Private Network (VPN), and firewall.
ACS is the point in your network that identifies users and devices that try to connect to your network. 
This identity establishment can occur directly by using the ACS internal identity repository for local user 
authentication or by using external identity repositories. 
For example, ACS can use Active Directory as an external identity repository, to authenticate a user to 
grant the user access to the network. For more information about creating identities and supported 
identity services, see Chapter 8, “Managing Users and Identity Stores.” 
						

							1-2
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 1      Introducing ACS 5.3
  ACS Distributed Deployment
ACS provides advanced monitoring, reporting, and troubleshooting tools that help you administer and 
manage your ACS deployments. For more information on the monitoring, reporting, and troubleshooting 
capabilities of ACS, see Chapter 11, “Monitoring and Reporting in ACS.”.
For more information about using ACS for device administration and network access scenarios, see 
Chapter 4, “Common Scenarios Using ACS.”
Cisco Secure ACS:
Enforces access policies for VPN and wireless users.
Provides simplified device administration.
Provides advanced monitoring, reporting, and troubleshooting tools.
There are several changes and enhancements in ACS 5.3 compared to ACS 5.2. For a complete list of 
new and changed features, see 
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.3/release/notes/
acs_53_rn.html.
Related Topics
ACS Distributed Deployment, page 1-2
ACS Management Interfaces, page 1-3
ACS Distributed Deployment
ACS 5.3 is delivered preinstalled on a standard Cisco Linux-based appliance, and supports a fully 
distributed deployment.
An ACS deployment can consist of a single instance, or multiple instances deployed in a distributed 
manner, where all instances in a system are managed centrally. One ACS instance becomes the primary 
instance and you can register additional ACS instances to the primary instance as secondary instances. 
All instances have the configuration for the entire deployment, which provides redundancy for 
configuration data. 
The primary instance centralizes the configuration of the instances in the deployment. Configuration 
changes made in the primary instance are automatically replicated to the secondary instance. 
You can force a full replication to the secondary instance. Full replication is used when a new secondary 
instance is registered and in other cases when the replication gap between the secondary instance and 
the primary instance is significant.
Related Topic
ACS 4.x and 5.3 Replication, page 1-2
ACS 4.x and 5.3 Replication
In ACS 4.x, you must select the database object types (or classes) you wish to replicate from primary 
instance to the secondary instance. When you replicate an object, a complete configuration copy is made 
on the secondary instance. 
In ACS 5.3, any configuration changes made in the primary instance are immediately replicated to the 
secondary instance. Only the configuration changes made since the last replication are propagated to the 
secondary instance.  
						

							1-3
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 1      Introducing ACS 5.3
  ACS Licensing Model
ACS 4.x did not provide incremental replication, only full replication, and there was service downtime 
for replication. ACS 5.3 provides incremental replications with no service downtime. 
You can also force a full replication to the secondary instance if configuration changes do not replicate 
it. Full replication is used when a new secondary instance is registered and other cases when the 
replication gap between the secondary instance and the primary instance is significant.
Ta b l e 1 - 1 lists some of the differences between ACS 4.x and 5.3 replication.
For more information about setting up a distributed deployment, see Configuring System Operations, 
page 17-1.
NoteNetwork Address Translation (NAT) is not supported in ACS distributed deployment environment. That 
is, if a primary or secondary instance’s network address is translated then the database replication may 
not work properly, and displays a shared secret mismatch error. 
ACS Licensing Model
You must have a valid license to operate ACS; ACS prompts you to install a valid base license when you 
first access the web interface. Each server requires a unique base license in a distributed deployment.
For information about the types of licenses you can install, see Types of Licenses, page 18-34. For more 
information about licenses, see Licensing Overview, page 18-34.
Related Topic
ACS Distributed Deployment, page 1-2
ACS Management Interfaces
This section contains the following topics:
ACS Web-based Interface, page 1-4
ACS Command Line Interface, page 1-4
ACS Programmatic Interfaces, page 1-5
Table 1-1 Differences Between ACS 4.x and 5.3 Replication
ACS 4.x ACS 5.3
You can choose the data items to be  replicated. You cannot choose the data items to be replicated. 
All data items, by default are replicated.
Supports multi-level or cascading replication. Supports only a fixed flat replication. Cascading 
replication is not supported.
Some data items such as, the external database 
configurations are not replicated.All data items are replicated except Database key, 
Database certificate and Master keys.  The server 
certificates, CSRs, and private keys are replicated 
but they are not shown in the interface. 
						

							1-4
User Guide for Cisco Secure Access Control System 5.3
OL-24201-01
Chapter 1      Introducing ACS 5.3
  ACS Management Interfaces
ACS Web-based Interface
You can use the ACS web-based interface to fully configure your ACS deployment, and perform 
monitoring and reporting operations. The web interface provides a consistent user experience, regardless 
of the particular area that you are configuring. 
The ACS web interface is supported on HTTPS-enabled Microsoft Internet Explorer, versions 7.x, 8.x, 
and 9.x and Firefox version 3.x and 4.x.
The new web interface design and organization:
Reflects the new policy model, which is organized around the user’s view of policy administration. 
The new policy model is easier to use, as it separates the complex interrelationships that previously 
existed among policy elements. 
For example, user groups, network device groups (NDGs), network access filters, network access 
profiles, and so on.
Presents the configuration tasks in a logical order that you can follow for many common scenarios.
For example, first you configure conditions and authorizations for policies in the Policy Elements 
drawer, and then you move on to the Policies drawer to configure the policies with the defined policy 
elements. 
Provides new page functionality, such as sorting and filtering lists of items.
See “Using the Web Interface” section on page 5-3 for more information.
Related Topics
ACS Command Line Interface, page 1-4
ACS Command Line Interface
You can use the ACS command-line interface (CLI), a text-based interface, to perform some 
configuration and operational tasks and monitoring. Access to the ACS-specific CLI requires 
administrator authentication by ACS 5.3. 
You do not need to be an ACS administrator or log into ACS 5.3 to use the non-ACS configuration mode. 
ACS configuration mode command sessions are logged to the diagnostics logs.
ACS 5.3 is shipped on the Cisco 1121 Secure Access Control System (CSACS 1121). The ADE-OS 
software supports these command modes:
EXEC—Use these commands to perform system-level operation tasks. For example, install, start, 
and stop application; copy files and installations; restore backups; and display information. 
In addition, certain EXEC mode commands have ACS-specific abilities. For example, start an ACS 
instance, display and export ACS logs, and reset an ACS configuration to factory default settings. 
Such commands are specifically mentioned in the documentation 
ACS configuration—Use these commands to set the debug log level (enable or disable) for the ACS 
management and runtime components, and show system settings. 
Configuration—Use these commands to perform additional configuration tasks for the appliance 
server in an ADE-OS environment.
NoteThe CLI includes an option to reset the configuration that, when issued, resets all ACS configuration 
information, but retains the appliance settings such as network configuration.