Installation Guide for Cisco Secure ACS for Windows Server Version 3.2

This document provides information about installing, reinstalling, and upgrading to Cisco Secure Access Control Server (Cisco Secure ACS) for Windows Server version 3.2. It contains the following sections:

Preparation for Installing or Upgrading Cisco Secure ACS

Before performing an installation or upgrade procedure, read this section and perform the recommended actions. This section includes the following topics:

Cisco Secure ACS System Description

Cisco Secure ACS network security software helps you authenticate users by controlling access to a AAA client—any one of many network devices that can be configured to defer authentication and authorization of network users to a AAA server. Cisco Secure ACS operates as a set of Windows services that control the authentication, authorization, and accounting of users accessing networks.

Cisco Secure ACS operates on Windows 2000 Server. Windows 2000 Advanced Server and Windows 2000 Datacenter Server are not supported. Cisco Secure ACS can run on a domain controller or a member server.

Note

If you install Cisco Secure ACS on a member server and want to authenticate users with a Windows Security Account Manager user database or an Active Directory user database, there is additional Windows configuration required after you have installed Cisco Secure ACS. For more information, see Windows Authentication from a Member Server.

For additional information about Cisco Secure ACS, refer to the User Guide for Cisco Secure ACS for Windows Server, version 3.2.

System Requirements

Your Cisco Secure ACS server must meet the minimum hardware, operating system, and third-party software requirements detailed in the following sections. Additionally, if you are upgrading from a previous version of Cisco Secure ACS, refer to Cisco Secure ACS Upgrade Requirements.

Cisco Secure ACS Upgrade Requirements

The setup program supports upgrades from previous versions of Cisco Secure ACS. For information about the versions of Cisco Secure ACS that we used to test the upgrade process, see the Release Notes. The latest version of the Release Notes are posted on Cisco.com, accessible from the following URL: http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/
csacs4nt/index.htm.

Hardware Requirements

The computer running Cisco Secure ACS must meet the following minimum hardware requirements:

•

At least 250 MB of free disk space. If you are running your database on the same computer, more disk space is required.

Operating System Requirements

The computer running Cisco Secure ACS use an English-language version of Windows 2000 Server with Service Pack 3 installed. Both the operating system and the applicable service pack must be English-language versions.

Note

Windows 2000 Advanced Server and Windows 2000 Datacenter Server are not supported.

Windows service packs can be applied before or after installing Cisco Secure ACS. If you do not install a required service pack before installing Cisco Secure ACS, the Cisco Secure ACS installation program may warn you that the required service pack is not present. If you receive a service pack message, continue the installation, and then install the required service pack before starting user authentication with Cisco Secure ACS.

For the most recent information about tested operating systems and service packs, see the Release Notes. The current version of the Release Notes are posted on Cisco.com, accessible from the following URL: http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/
csacs4nt/index.htm.

Third-Party Software Requirements

Note

The Release Notes provide information about third-party software products that we tested with Cisco Secure ACS and that we support. Other than the software products described in the Release Notes, we have not tested the interoperability of Cisco Secure ACS and other software products on the same computer. We only support interoperability issues of software products that are mentioned in the Release Notes. The most recent version of the Release Notes are posted on Cisco.com, accessible from the following URL: http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/
csacs4nt/index.htm.

The computer running Cisco Secure ACS must have a supported browser installed. We tested Cisco Secure ACS using English-language versions of the following browsers on Microsoft Windows operating systems:

Note

To use a web browser to access the Cisco Secure ACS HTML interface, you must enable both Java and JavaScript in the browser. Also, the web browser must not be configured to use a proxy server. For more information about other network environment factors that affect access to the HTML interface, see User Guide for Cisco Secure ACS for Windows Server, version 3.2.

For the most recent information about tested browsers and other third-party applications, such as Novell NDS clients and token-card clients, see the Release Notes. The most recent version of the Release Notes are posted on Cisco.com, accessible from the following URL: http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/
csacs4nt/index.htm.

Network and Port Requirements

Your network should meet the following requirements before you begin deploying Cisco Secure ACS.

•

For full TACACS+ and RADIUS support on Cisco IOS devices, AAA clients must run Cisco IOS Release 11.2 or later.

•

Dial-in, VPN, or wireless clients must be able to connect to the applicable AAA clients.

•

Gateway devices between Cisco Secure ACS and other network devices must permit communication over the ports needed to support the applicable feature or protocol. For information about ports listened to by Cisco Secure ACS, see Table 1.

•

A supported web browser must be installed on the computer running Cisco Secure ACS. For the most recent information about tested browsers, see the Release Notes. The most recent version of the Release Notes are posted on Cisco.com, accessible from the following URL: http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/
csacs4nt/index.htm.

•

All network cards in the computer running Cisco Secure ACS must be enabled. If there is a disabled network card on the computer running Cisco Secure ACS, installing Cisco Secure ACS may proceed slowly due to delays caused by Microsoft CryptoAPI.

Note

We tested Cisco Secure ACS on computers that only have one network interface card.

•

To have Cisco Secure ACS use the Grant Dial-in Permission to User feature in Windows when authorizing network users, this option must be selected in the Windows User Manager or Active Directory Users and Computers for the applicable user accounts.

Table 1 lists the ports that Cisco Secure ACS listens to for communications with AAA clients, other Cisco Secure ACSes and applications, and web browsers. Cisco Secure ACS uses other ports to communicate with external user databases; however, it initiates those communications rather than listening to specific ports. In some cases, these ports are configurable, such as with LDAP and RADIUS token server databases. For more information about ports that a particular external user database listens to, see the documentation for that database.

Table 1 Ports that Cisco Secure ACS Listens To
Feature/Protocol	UDP or TCP?	Ports
RADIUS authentication and authorization	UDP	1645, 1812
RADIUS accounting	UDP	1646, 1813
TACACS+	TCP	49
CiscoSecure Database Replication	TCP	2000
RDBMS Synchronization with synchronization partners	TCP	2000
User-Changeable Password web application	TCP	2000
Logging	TCP	2001
Administrative HTTP port for new sessions	TCP	2002
Administrative HTTP port range	TCP	Configurable; default 1024 through 65535

Back Up Data

Before you install or upgrade Cisco Secure ACS, we strongly recommend that you back up the computer that you will install Cisco Secure ACS on, using a Windows backup utility of your choice. Include the Windows Registry in the backup.

If you are upgrading or reinstalling Cisco Secure ACS, use the Cisco Secure ACS Backup feature to back up the Cisco Secure ACS configuration and database, and then copy the backup file to a drive other than one local to the computer running Cisco Secure ACS.

For information about backing up Cisco Secure ACS, see the User Guide for Cisco Secure ACS for Windows Server, version 3.2.

Gathering Answers for the Installation Questions

During new installations, or upgrades and reinstallations that do not preserve the existing configuration, the installation requires specific information about the computer you want to install Cisco Secure ACS on and a AAA client on your network. To facilitate the installation, collect the applicable information before beginning the installation.

Note

If you are upgrading or reinstalling Cisco Secure ACS and intend to keep the existing configuration and database, you do not need to perform the following procedure, which requires information already recorded in your Cisco Secure ACS installation.

To collect information that is required during the installation of Cisco Secure ACS, follow these steps:

Step 1

Determine whether the computer that you will install Cisco Secure ACS on is a domain controller or a member server. If you are installing Cisco Secure ACS on a member server and want Cisco Secure ACS to authenticate users with a Windows domain user database, be aware that after you install Cisco Secure ACS you must perform the additional Windows configuration discussed in Windows Authentication from a Member Server.

Step 2

For the first AAA client that you want to configure to use AAA services provided by Cisco Secure ACS, determine which AAA protocol and vendor-specific attribute you want to implement:

Step 5

Record the IP address of the computer that you want to install Cisco Secure ACS on.

What You Can Do

This document provides detailed procedures for installing, reinstalling, and upgrading Cisco Secure ACS. You must select the right procedure for your situation. Table 2 lists the five possible installation and upgrade scenarios. See Table 2 to determine which procedure applies to your situation.

Table 2 Installation and Upgrade Scenarios
If your installation scenario is a:	Refer to. . .
New installation	Creating a Cisco Secure ACS Installation
Reinstallation, preserving the CiscoSecure user database and Cisco Secure ACS configuration	Reinstalling or Upgrading Cisco Secure ACS and Preserving Existing Configuration
Reinstallation, overwriting the CiscoSecure user database and Cisco Secure ACS configuration	Reinstalling or Upgrading Cisco Secure ACS without Preserving Existing Configuration
Upgrade, preserving the CiscoSecure user database and Cisco Secure ACS configuration	Reinstalling or Upgrading Cisco Secure ACS and Preserving Existing Configuration
Upgrade, overwriting the CiscoSecure user database and Cisco Secure ACS configuration	Reinstalling or Upgrading Cisco Secure ACS without Preserving Existing Configuration

Creating a Cisco Secure ACS Installation

Note

For information about upgrading or reinstalling an existing Cisco Secure ACS installation, see Table 2.

If you are installing Cisco Secure ACS on a member server and want Cisco Secure ACS to authenticate users with a Windows domain user database, be aware that after you install Cisco Secure ACS you must perform the additional Windows configuration discussed in Windows Authentication from a Member Server.

Step 1

Using a local administrator account, log in to the computer you want to install Cisco Secure ACS on.

Note

We only support installations performed at computer you are installing Cisco Secure ACS on. Remote installations, performed using Windows Terminal Services or products such as Virtual Network Computing (VNC), are not tested and are not supported.

Result: If the CD-ROM drive supports the Windows autorun feature, the Cisco Secure ACS for Windows Server dialog box appears.

Note

If the computer does not have a required service pack installed, a dialog box appears. Windows service packs can be applied either before or after installing Cisco Secure ACS. You can continue with the installation, but the required service pack must be applied after the installation is complete; otherwise, Cisco Secure ACS may not function reliably.

If the Cisco Secure ACS for Windows Server dialog box appears, click Install.

If the Cisco Secure ACS for Windows Server dialog box does not appear, run setup.exe, located in the root directory of the Cisco Secure ACS CD.

Note

If the computer does not have a required service pack installed, a dialog box appears. Windows service packs can be applied before or after installing Cisco Secure ACS. You can continue with the installation, but the required service pack must be applied after the installation is complete; otherwise, Cisco Secure ACS may not function reliably.

Result: The CiscoSecure ACS Setup dialog box displays the software license agreement.

Step 4

Read the software license agreement. If you accept the software license agreement, click ACCEPT.

Result: The Welcome dialog box displays basic information about the setup program.

Step 5

After you have read the information in the Welcome dialog box, click Next >.

Result: The Before You Begin dialog box lists items that you must complete before continuing with the installation. These are the same items discussed in Gathering Answers for the Installation Questions.

Step 6

If you have completed all items listed in the Before You Begin dialog box, select the corresponding check box for each item, and then click Next >.

Note

If you have not completed all items listed in the Before You Begin dialog box, click Cancel, and then click Exit Setup. After completing all items listed in the Before You Begin dialog box, restart the installation. For more information, see Preparation for Installing or Upgrading Cisco Secure ACS.

Result: The Choose Destination Location dialog box appears. Under Destination Folder, the installation location appears. This is the drive and path where the setup program installs Cisco Secure ACS.

Result: The Choose Folder dialog box appears. The Path box contains the installation location.

Change the installation location. You can either type the new location in the Path box or use the Drives and Directories lists to select a new drive and directory.

Note

If you specified a folder that does not exist, the setup program displays a dialog box to confirm the creation of the folder. To continue, click Yes.

Result: In the Choose Destination Location dialog box, the new installation location appears under Destination Folder.

Result: The Authentication Database Configuration dialog box lists options for authenticating users. You can authenticate with the CiscoSecure user database only, or with a Windows user database also.

Note

After you have installed Cisco Secure ACS, you can configure authentication support for all external user database types in addition to Windows user databases.

Step 9

If you want to authenticate users with the CiscoSecure user database only, select the Check the CiscoSecure ACS database only option.

Step 10

If you want to authenticate users with a Windows Security Access Manager (SAM) user database or Active Directory user database in addition to the CiscoSecure user database, follow these steps:

Result: The Yes, refer to "Grant dialin permission to user" setting check box becomes available.

Note

The Yes, refer to "Grant dialin permission to user" setting check box applies to all forms of access controlled by Cisco Secure ACS, not just dial-in access. For example, a user accessing your network through a VPN tunnel is not dialing into a network access server; however, if the Yes, refer to "Grant dialin permission to user" setting check box is selected, Cisco Secure ACS applies the Windows user dial-in permissions to determine whether to grant the user access to your network.

If you want to allow access by users who are authenticated by a Windows domain user database only when they have dial-in permission in their Windows account, select the Yes, refer to "Grant dialin permission to user" setting check box.

Result: The CiscoSecure ACS Network Access Server Details dialog box appears. The information you provide in this dialog box has two uses:

•

The setup program creates the AAA client definition in the Network Configuration section of Cisco Secure ACS.

•

If you specify TACACS+ (Cisco IOS) or RADIUS (Cisco IOS/PIX) in the Authenticate Users Using list, the setup program uses this information in Step 19, in which you can configure a Cisco IOS network device to use this Cisco Secure ACS for AAA services.

Note

You are not limited to defining a network access server in this dialog box. You can define any network device that can act as a AAA client.

Step 12

Complete the following items in the CiscoSecure ACS Network Access Server Details dialog box:

•

Authenticate Users Using—Select the AAA protocol used by the AAA client you are defining. If you specify TACACS+ (Cisco IOS) or RADIUS (Cisco IOS/PIX), in Step 19 you can configure the network device specified in this dialog box.

•

Access Server Name—Type the name of the AAA client that will use Cisco Secure ACS for AAA services.

•

Access Server IP Address—Type the IP address of the AAA client that will use Cisco Secure ACS for AAA services.

•

Windows Server IP Address—Type the IP address of the computer that you are installing Cisco Secure ACS on.

•

TACACS+ or RADIUS Key—Type the shared secret of the AAA client and Cisco Secure ACS. To ensure proper function and communication between the AAA client and Cisco Secure ACS, the key must be identical to the AAA client key. Shared secrets are case sensitive.

Result: The setup program installs Cisco Secure ACS and updates the Windows Registry.

The Advanced Options dialog box lists several features of Cisco Secure ACS that are not enabled by default. For more information about these features, see the User Guide for Cisco Secure ACS for Windows Server, version 3.2.

Note

The listed features appear in the Cisco Secure ACS HTML interface only if you enable them. After installation, you can enable or disable them on the Advanced Options page in the Interface Configuration section.

Step 14

For each feature you want to enable, select the corresponding check box.

Note

After installation, you can configure active service monitoring features on the Active Service Management page in the System Configuration section.

Step 16

If you want Cisco Secure ACS to monitor user authentication services, select the Enable Log-in Monitoring check box. From the Script to execute list, select the option you want applied in the event of authentication service failure:

•

Reboot—Cisco Secure ACS runs a script that reboots the computer that runs Cisco Secure ACS.

•

Restart RADIUS/TACACS+—Cisco Secure ACS restarts only the RADIUS and TACACS+ services.

Step 17

If you want Cisco Secure ACS to send an e-mail message when service monitoring detects an event, select the Mail Notification check box.

Result: If, in Step 12, you specified TACACS+ (Cisco IOS) or RADIUS (Cisco IOS/PIX) as the AAA protocol for your first AAA client, the Network Access Server Configuration dialog box appears.

If, in Step 12, you specified a AAA protocol other than TACACS+ (Cisco IOS) or RADIUS (Cisco IOS/PIX), the CiscoSecure ACS Service Initiation dialog box appears.

Step 19

If the Network Access Server Configuration dialog box appears and you want to configure AAA functionality on a Cisco IOS network device, follow these steps:

Select the Yes, I want to configure Cisco IOS software now check box and click Next >.

In the Enable Secret Password box, type an enable secret password for the Cisco IOS network device.

Note

You must type the shared secret exactly the same as it is configured on the Cisco IOS device, including whether the characters are uppercase or lowercase.

Result: The Access Server Configuration dialog box displays information about configuring a Cisco IOS network device.

After reading the text in the Access Server Configuration dialog box, click Next >.

Result: The NAS Configuration dialog box displays the minimum Cisco IOS configuration needed for the network device you specified in Step 12. The minimum configuration includes information you have provided during installation, including the IP address of the computer you are installing Cisco Secure ACS on, the TACACS+ or RADIUS key, and the enable secret password.

Note

When using the Cisco IOS aaa new-model command, always provide for a local login method. This guards against the slight risk of being locked out of a Cisco IOS device should the administrative Telnet session fail while you are in the process of enabling a new AAA paradigm. For more information about the Cisco IOS aaa command, refer to Cisco IOS documentation.

Note

Especially if you intend to implement the minimum configuration provided by the setup program, we recommend that you print the configuration now.

Result: The setup program prints the configuration using the server's default printer.

To telnet to the network device you specified in Step 12, click Telnet Now.

Result: The setup program opens a Telnet window. You can log in to the Cisco IOS device and update the device configuration, as applicable. The setup program copies the minimum configuration it provides to the Windows clipboard. If you want to use the minimum configuration, you can paste it in the Telnet window after you have entered the applicable configuration mode.

After you finish with the options in the NAS Configuration dialog box, click Next >.

Step 20

If the Network Access Server Configuration dialog box appears and you want to skip configuring a Cisco IOS network device, clear the Yes, I want to configure Cisco IOS software now check box, and then click Next >.

Step 21

For each option you want, select the corresponding check box. The actions associated with the options occur after the setup program finishes.

•

Yes, I want to start the CiscoSecure ACS Service now—Starts the Windows services that compose Cisco Secure ACS. If you do not select this option, the Cisco Secure ACS HTML interface is not available unless you reboot the computer or start the CSAdmin service.

•

Yes, I want Setup to launch the CiscoSecure ACS Administrator from my browser following installation—Opens the Cisco Secure ACS HTML interface in the default web browser for the current Windows user account.

•

Yes, I want to view the Readme file—Opens the README.TXT file in Windows Notepad.

Result: If you so chose, the Cisco Secure ACS services start. The Setup Complete dialog box displays information about the Cisco Secure ACS HTML interface.

Result: The setup program exits. If, in Step 21, you chose the options to view the HTML interface or README.TXT file, those options occur now.

On the computer running Cisco Secure ACS, you can access the Cisco Secure ACS HTML interface using the ACS Admin desktop icon or you can use the following URL in a supported web browser:

Note

The Cisco Secure ACS HTML interface is available only if you chose to start Cisco Secure ACS services in Step 21. If you did not, to make the HTML interface available, you can either reboot the computer or type net start csadmin at a DOS prompt.

Step 24

If you have installed Cisco Secure ACS on a member server and want Cisco Secure ACS to authenticate users with a Windows domain user database, you must perform the additional Windows configuration discussed in Windows Authentication from a Member Server.

Reinstalling or Upgrading Cisco Secure ACS and Preserving Existing Configuration

Use this procedure to reinstall or upgrade Cisco Secure ACS if you want to preserve all existing configuration and database information.

Note

For information about installing Cisco Secure ACS the first time, see Table 2.

Close all applications or command windows that are accessing any directory contained in the Cisco Secure ACS directory. The installation cannot succeed if another process is using the CiscoSecure ACS directory or any of its subdirectories. For example, if Windows Explorer is displaying the contents of an Cisco Secure ACS directory, installation fails.

If you are installing Cisco Secure ACS on a member server and want Cisco Secure ACS to authenticate users with a Windows domain user database, be aware that after you have installed Cisco Secure ACS you must perform the additional Windows configuration discussed in Windows Authentication from a Member Server.

To reinstall or upgrade Cisco Secure ACS and preserve the existing configuration and CiscoSecure user database, follow these steps:

Step 1

Using a local administrator account, log in to the computer you want to install Cisco Secure ACS on.

Note

Result: If the CD-ROM drive supports the Windows autorun feature, the Cisco Secure ACS for Windows Server dialog box appears.

Note

If the computer does not have a required service pack installed, a dialog box may appear. Windows service packs can be applied either before or after installing Cisco Secure ACS. You can continue with the installation, but the required service pack must be applied after the installation is complete; otherwise, Cisco Secure ACS may not function reliably.

If the Cisco Secure ACS for Windows Server dialog box appears, click Install.

If the Cisco Secure ACS for Windows Server dialog box does not appear, run setup.exe, located in the root directory of the Cisco Secure ACS CD.

Note

Result: The CiscoSecure ACS Setup dialog box displays the software license agreement.

Step 4

Read the software license agreement. If you accept the software license agreement, click ACCEPT.

Result: The Welcome dialog box displays basic information about the setup program.

Step 5

After you have read the information in the Welcome dialog box, click Next >.

Step 6

If you have completed all items listed in the Before You Begin dialog box, select the corresponding check box for each item, and then click Next >.

Note

Result: The Choose Folder dialog box appears. The Path box contains the installation location.

Change the installation location. You can either type the new location in the Path box or you can use the Drives and Directories lists to select a new drive and directory.

Note

If you specified a folder that does not exist, the setup program displays a dialog box to confirm the creation of the folder. To continue, click Yes.

Result: In the Choose Destination Location dialog box, the new installation location appears under Destination Folder.

Result: The setup program installs Cisco Secure ACS and updates the Windows Registry.

Step 11

For each option you want, select the corresponding check box. The actions associated with each option occur after the setup program finishes.

•

Yes, I want to view the Readme file—Opens the README.TXT file in Windows Notepad.

Result: If you so chose, the Cisco Secure ACS services start. The Setup Complete dialog box displays information about the Cisco Secure ACS HTML interface.

Result: The setup program exits. If, in Step 11, you chose the options to view the HTML interface or README.TXT file, those options occur now.

On the computer running Cisco Secure ACS, you can access the Cisco Secure ACS HTML interface using the ACS Admin desktop icon or you can use the following URL in a supported web browser:

Note

The Cisco Secure ACS HTML interface is available only if you chose to start Cisco Secure ACS services in Step 11. If you did not and you want to make the HTML interface available, you can either reboot the computer or type net start csadmin at a DOS prompt.

Step 14

Note

If you previously configured Cisco Secure ACS services to run using a specific username, that configuration was lost during the reinstallation. For more information, see Windows Authentication from a Member Server.

Reinstalling or Upgrading Cisco Secure ACS without Preserving Existing Configuration

Use this procedure to reinstall or upgrade Cisco Secure ACS if you do not intend to preserve the existing configuration and database information.

To reinstall or upgrade Cisco Secure ACS without preserving the existing configuration or CiscoSecure user database, follow these steps:

Step 1

Using a local administrator account, log in to the computer you want to install Cisco Secure ACS on.

Note

Result: If the CD-ROM drive supports the Windows autorun feature, the Cisco Secure ACS for Windows Server dialog box appears.

Note

If computer does not have a required service pack installed, a dialog box appears. Windows service packs can be applied before or after installing Cisco Secure ACS. You can continue with the installation, but the required service pack must be applied after the installation is complete; otherwise, Cisco Secure ACS may not function reliably.

If the Cisco Secure ACS for Windows Server dialog box appears, click Install.

If the Cisco Secure ACS for Windows Server dialog box does not appear, run setup.exe, located in the root directory of the Cisco Secure ACS CD.

Note

Result: The CiscoSecure ACS Setup dialog box displays the software license agreement.

Step 4

Read the software license agreement. If you accept the software license agreement, click ACCEPT.

Result: The Welcome dialog box displays basic information about the setup program.

Step 5

After you have read the information in the Welcome dialog box, click Next >.

Step 6

If you have completed all items listed in the Before You Begin dialog box, select the corresponding check box for each item, and then click Next >.

Note

Be sure that the Yes, import the existing configuration check box is cleared, not checked; otherwise, the existing configuration and CiscoSecure user database are preserved.

Result: The setup program removes the previous installation of Cisco Secure ACS.

If Cisco Secure ACS services are running, the CiscoSecure ACS Uninstall dialog box appears.

Step 9

If the CiscoSecure ACS Uninstall dialog box appears, click Continue.

Result: The setup program finishes removing the previous installation of Cisco Secure ACS.

The Choose Destination Location dialog box appears. Under Destination Folder, the installation location appears. This is the drive and path where the setup program installs Cisco Secure ACS.

Result: The Choose Folder dialog box appears. The Path box contains the installation location.

Change the installation location. You can either type the new location in the Path box or you can use the Drives and Directories lists to select a new drive and directory.

Note

If you specified a folder that does not exist, the setup program displays a dialog box to confirm the creation of the folder. To continue, click Yes.

Result: In the Choose Destination Location dialog box, the new installation location appears under Destination Folder.

Note

After you have installed Cisco Secure ACS, you can configure authentication support for all external user database types in addition to Windows user databases.

Step 12

If you want to authenticate users with the CiscoSecure user database only, select the Check the CiscoSecure ACS database only option.

Step 13

If you want to authenticate users with a Windows Security Access Manager (SAM) user database or Active Directory user database in addition to the CiscoSecure user database, follow these steps:

Result: The Yes, refer to "Grant dialin permission to user" setting check box becomes available.

Note

If you want to allow access to users who are authenticated by a Windows domain user database only when they have dial-in permission in their Windows account, select the Yes, refer to "Grant dialin permission to user" setting check box.

Result: The CiscoSecure ACS Network Access Server Details dialog box appears. The information you provide in this dialog box has two uses:

•

The setup program creates the AAA client definition in the Network Configuration section of Cisco Secure ACS.

•

If you specify TACACS+ (Cisco IOS) or RADIUS (Cisco IOS/PIX) in the Authenticate Users Using list, the setup program uses this information in Step 22, in which you can configure a Cisco IOS network device to use this Cisco Secure ACS for AAA services.

Note

You are not limited to defining a network access server in this dialog box. You can define any network device that can act as a AAA client.

Step 15

Complete the following items in the CiscoSecure ACS Network Access Server Details dialog box:

•

Authenticate Users Using—Select the AAA protocol used by the AAA client you are defining. If you specify TACACS+ (Cisco IOS) or RADIUS (Cisco IOS/PIX), in Step 22 you can configure the network device specified in this dialog box.

•

Access Server Name—Type the name of the AAA client that will use Cisco Secure ACS for AAA services.

•

Access Server IP Address—Type the IP address of the AAA client that will use Cisco Secure ACS for AAA services.

•

Windows Server IP Address—Type the IP address of the computer you are installing Cisco Secure ACS on.

•

TACACS+ or RADIUS Key—Type the shared secret of the AAA client and Cisco Secure ACS. These passwords must be identical to ensure proper function and communication between the AAA client and Cisco Secure ACS. Shared secrets are case sensitive.

Result: The setup program installs Cisco Secure ACS and updates the Windows Registry.

The Advanced Options dialog box lists several features of Cisco Secure ACS that are not enabled by default. For more information about these features, refer to the User Guide for Cisco Secure ACS for Windows Server, version 3.2.

Note

Step 17

For each feature you want to enable, select the corresponding check box.

Note

After installation, you can configure active service monitoring features on the Active Service Management page in the System Configuration section.

Step 19

•

Reboot—Cisco Secure ACS runs a script that reboots the computer that runs Cisco Secure ACS.

•

Restart RADIUS/TACACS+—Cisco Secure ACS restarts only the RADIUS and TACACS+ services.

Step 20

If you want Cisco Secure ACS to send an e-mail message when service monitoring detects an event, select the Mail Notification check box.

Result: If, in Step 15, you specified TACACS+ (Cisco IOS) or RADIUS (Cisco IOS/PIX) as the AAA protocol for your first AAA client, the Network Access Server Configuration dialog box appears.

If, in Step 15, you specified a AAA protocol other than TACACS+ (Cisco IOS) or RADIUS (Cisco IOS/PIX), the CiscoSecure ACS Service Initiation dialog box appears.

Step 22

If the Network Access Server Configuration dialog box appears and you want to configure AAA functionality on a Cisco IOS network device, follow these steps:

Select the Yes, I want to configure Cisco IOS software now check box and click Next >.

In the Enable Secret Password box, type an enable secret password for the Cisco IOS network device.

Note

You must type the shared secret exactly the same as it is configured on the Cisco IOS device, including whether the characters are uppercase or lowercase.

Result: The Access Server Configuration dialog box displays information about configuring a Cisco IOS network device.

After reading the text in the Access Server Configuration dialog box, click Next >.

Result: The NAS Configuration dialog box displays the minimum Cisco IOS configuration needed for the network device you specified in Step 15. The minimum configuration includes information you provided during the installation, including the IP address of the computer running Cisco Secure ACS, the TACACS+ or RADIUS key, and the enable secret password.

Note

Especially if you intend to implement the minimum configuration provided by the setup program, we recommend that you print the configuration now.

Result: The setup program uses the server's default printer to print the configuration.

To telnet to the network device you specified in Step 15, click Telnet Now.

After you finish with the options in the NAS Configuration dialog box, click Next >.

Step 23

Step 24

For each option you want, select the corresponding check box. The actions associated with each option occur after the setup program finishes.

•

Yes, I want to view the Readme file—Opens the README.TXT file in Windows Notepad.

Result: If you so chose, the Cisco Secure ACS services start. The Setup Complete dialog box displays information about the Cisco Secure ACS HTML interface.

Result: The setup program exits. If, in Step 24, you chose the options to view the HTML interface or README.TXT file, those options occur now.

On the computer running Cisco Secure ACS, you can access the Cisco Secure ACS HTML interface using the ACS Admin desktop icon or you can use the following URL in a supported web browser:

Note

The Cisco Secure ACS HTML interface is available only if you chose to start Cisco Secure ACS services in Step 24. If you did not, to make the HTML interface available, you can either reboot the computer or type net start csadmin at a DOS prompt.

Step 27

Note

Windows Authentication from a Member Server

Cisco Secure ACS can authenticate users against both types of Windows domain user databases: Security Accounts Manager (SAM) user databases and Active Directory user databases. For either type of Windows domain user database, Cisco Secure ACS submits authentication requests to the Windows operating system of the server on which Cisco Secure ACS is installed. If you have installed Cisco Secure ACS on a member server and you plan to use a Windows domain user database to authenticate users, you must perform additional Windows configuration to ensure that Windows permits authentication to occur from the member server. To do so, complete the steps in the following procedures:

Verifying Domain Membership

One common configuration error that prevents Windows authentication is the erroneous assignment of the member server to a workgroup with the same name as the Windows domain that you want to use to authenticate users. While this may seem obvious, we recommend that you verify that the computer running Cisco Secure ACS is a member server of the correct domain.

To verify domain membership for your Cisco Secure ACS computer, follow these steps:

Step 1

From the Windows desktop of the computer running Cisco Secure ACS, right-click My Computer and from the shortcut menu, select Properties.

Step 3

Verify that the Domain box displays the name of the domain that the computer running Cisco Secure ACS should be a member of.

Note

If the Workgroup box appears instead of the Domain box, the member server is not a member of a domain.

Step 4

If the computer running Cisco Secure ACS is not a member of the correct domain, change the server identification, as applicable.

Configuring Cisco Secure ACS Services

If you have installed Cisco Secure ACS on a member server, the member server must pass Windows authentication requests to a domain controller. For these requests to succeed, the member server must submit them using a user account that has certain security privileges enabled on the member server.

Note

If you use Active Directory to authenticate users, determine whether Active Directory is configured to use Pre-Windows 2000 Compatible Mode. If all Active Directory trees containing users that will be authenticated by Cisco Secure ACS are configured to use this mode, the steps in this procedure are not required.

If you have upgraded or reinstalled Cisco Secure ACS and you completed this procedure previously, Step 1 through Step 6 apply to you only if you want to use a different user account to run Cisco Secure ACS services.

Step 1

In the domain that the computer running Cisco Secure ACS is a member of, create a domain user account. This is the user account that you will use to run Cisco Secure ACS services. The user account does not require any particular group membership in the domain. To determine which domain the computer running Cisco Secure ACS belongs to, see Verifying Domain Membership.

Tip

Give the user account an easily recognizable name, like "CSACS". If you enable audit policies, Event Viewer entries with this username will make it easier to diagnose permissions problems related to failed Cisco Secure ACS authentication attempts.

Step 2

Using the local administrator account, log in to the computer running Cisco Secure ACS.

Step 3

Add the user account you created in Step 1 to the local Administrators group. To do so, follow these steps:

Choose Start > Settings > Control Panel > Administrative Tools > Computer Management.

Tip

If Control Panel is not expanded on the Start menu, choose Start > Settings > Control Panel, double-click Administrative Tools, and then double-click Computer Management.

Under the Tree tab, double-click Local Users and Groups, and then click Groups.

Tip

If Local Groups and Users does not appear under the Tree tab, double-click System Tools.

Result: The Name column lists the local groups available on the computer running Cisco Secure ACS.

In the box below the Add button, type the username for the user account you created in Step 1.

Note

The username must be in domain-qualified format. For example, if you created a user named "CSACS" in the "CORPORATE" domain, type "CORPORATE\CSACS".

Result: The Enter Network Password dialog box appears. This is because the local administrator account of the member server running Cisco Secure ACS should not have permission to access user account information on the domain controller.

Note

The username provided must exist in the domain specified in Step e. For example, if the domain specified is "CORPORATE" and "echamberlain" is a valid user in that domain, type "CORPORATE\echamberlain".

In the Password box, type the password for the user account specified in Step e.

Result: Windows verifies the existence of the username provided in Step e. The Enter Network Password dialog box closes.

Windows adds the username to the Members list in the Administrators Properties dialog box.

Result: The user account you created in Step 1 is assigned to the local Administrators group.

Step 4

Choose Start > Settings > Control Panel > Administrative Tools > Local Security Policy.

Tip

If Control Panel is not expanded on the Start menu, choose Start > Settings > Control Panel, double-click Administrative Tools, and then double-click Local Security Policy.

Step 5

In the Name column, double-click Local Policies, and then double-click User Rights Assignment.

Result: The Local Security Settings window displays a list of policies with their associated settings. The two policies that you must configure are:

Step 6

For the Act as part of the operating system policy and again for the Log on as a service policy, follow these steps:

In the box below the Add button, type the username for the user account you created in Step 1.

Note

The username must be in domain-qualified format. For example, if you created a user named "CSACS" in the "CORPORATE" domain, type "CORPORATE\CSACS".

Note

The username provided must exist in the domain specified in Step c. For example, if the domain specified is "CORPORATE" and "echamberlain" is a valid user in that domain, type "CORPORATE\echamberlain".

In the Password box, type the password for the user account specified in Step e.

Result: Windows verifies the existence of the username provided in Step c. The Enter Network Password dialog box closes.

Windows adds the username to the Assign To list in the Local Policy Setting dialog box.

Result: The Local Policy Setting dialog box closes. The domain-qualified username specified in Step c appears in the settings associated with the policy you have configured.

Verify that the username specified in Step c appears in the Local Setting column for the policy you modified. If it does not, repeat these steps.

Tip

To see the username you added, you may have to widen the Local Setting column.

Note

The Effective Setting column does not dynamically update. This procedure includes later verification steps for ensuring that the Effective Setting column contains the required information.

Result: After you have configured both the Act as part of the operating system policy and the Log on as a service policy, the user account created in Step 1 appears in the Local Setting column for the policy you configured.

Step 7

Verify that the security policy settings you changed are in effect on the computer running Cisco Secure ACS. To do so, follow these steps:

Result: The window closes. This is the only way to refresh the information in the Effective Setting column.

Open the Local Security Settings window again. To do so, choose Start > Programs > Administrative Tools > Local Security Policy.

In the Name column, double-click Local Policies, and then double-click User Rights Assignment.

Result: The Local Security Settings window displays an updated list of policies with their associated settings.

For the Act as part of the operating system policy and again for the Log on as a service policy, verify that the username you added to the policy in Step 6 appears in the Effective Setting column.

Note

If the username you configured the policies to include in Step 6 does not appear in the Effective Setting column for both policies, there may be security policy settings on the domain controller that conflict with the local setting. Resolve the conflict by configuring security policies on the domain controller to allow the local settings to be the effective settings for these two policies. For more information about configuring security policies on the domain controller, see your Microsoft documentation.

Result: The user account created in Step 1 has the required privileges to run Cisco Secure ACS services and support Windows authentication.

Step 9

Continuing as the local administrator on the computer running Cisco Secure ACS, choose Start > Settings > Control Panel > Administrative Tools > Services.

Tip

If Control Panel is not expanded on the Start menu, choose Start > Settings > Control Panel, double-click Administrative Tools, and then double-click Services.

Result: The Services window displays a list of service groups and a list of all registered services for the current group. The list of service groups is labeled Tree. The registered services for the current group appear in the list to the right of the Tree list.

Step 11

The Windows services installed by Cisco Secure ACS are the following:

In the list of services, right-click a Cisco Secure ACS service, and from the shortcut menu, choose Properties.

In the box next to the This account option, type the username for the account created in Step 1.

Note

The username must be in domain-qualified format. For example, if you created a user named "CSACS" in the "CORPORATE" domain, type "CORPORATE\CSACS".

In the Password box and in the Confirm Password box, type the password for the user account created in Step 1.

Result: All Cisco Secure ACS services are configured to run using the privileges of the user account created in Step 1.

Step 12

Restart all Cisco Secure ACS services. To do so, follow these steps:

Click System Configuration, click Service Control, and then, at the bottom of the browser window, click Restart.

Wait until Cisco Secure ACS finishes restarting services. This usually takes a minute or two.

Continuing as the local administrator on the computer running Cisco Secure ACS, choose Start > Programs Administrative Tools > Services.

Result: The Cisco Secure ACS services run using the privileges of the user account created in Step 1.

Configuring Active Directory for EAP-TLS

If Cisco Secure ACS runs on a member server and any user is to be authenticated using EAP-TLS, you must complete additional configuration in Active Directory of the domain containing Cisco Secure ACS. The username that you configured to run all Cisco Secure ACS services must also have permission to read user properties in Active Directory, else EAP-TLS authentication fails. To the username you created in Configuring Cisco Secure ACS Services, you must grant "Read all properties" permission for all Active Directory folders containing users that will authenticate with EAP-TLS. This must be the same username that you configured Cisco Secure ACS services to run as. Granting permissions for Active Directory folders is done by accessing Active Directory using the Microsoft Management Console and configuring the security properties for the folders containing users who are to be authenticated by EAP-TLS.

Tip

You can access the security properties of an Active Directory folder containing users by right-clicking the folder, selecting Properties, and clicking the Security tab. Click Add to include the username that is used to run Cisco Secure ACS services.

For more information about configuring Active Directory permissions, see Microsoft Active Directory documentation for Windows 2000 Server.

Migrating to a Cisco Secure ACS Appliance

Migrating from Cisco Secure ACS for Windows Server to Cisco Secure ACS Appliance uses the backup and restore features of Cisco Secure ACS. Backup files produced by Cisco Secure ACS for Windows Server are compatible with Cisco Secure ACS Appliance, provided that both are using the same version of Cisco Secure ACS software.

Depending upon what version of Cisco Secure ACS for Windows Server is used and the operating system that it runs on, the migration process varies. For example, if Cisco Secure ACS runs on Windows NT 4.0, the procedure below will advise you when it is necessary to upgrade to Windows 2000 Server. Because the use of the backup and restore features is only supported between Cisco Secure ACSes of the same version, you must use Cisco Secure ACS for Windows Server, version 3.2, to transfer data from Cisco Secure ACS for Windows Server and Cisco Secure ACS Appliance. Cisco Secure ACS for Windows Server, version 3.2, only supports Windows 2000 Server, not Windows NT 4.0. See the following procedure for more details.

Before upgrading or transferring data, back up your original Cisco Secure ACS and save the backup file in a location on a drive that is not local to the computer running Cisco Secure ACS.

To migrate from a Windows version of Cisco Secure ACS to a Cisco Secure ACS Appliance, follow these steps:

Step 1

Set up the appliance, following the steps in Installation and Configuration Guide for Cisco Secure ACS Appliance.

Step 2

If you are using Cisco Secure ACS for Windows Server version 3.1 or earlier, upgrade to version 3.2. If you do not have a license for version 3.2, you can use the trial version, available at http://www.cisco.com/cgi-bin/tablebuild.pl/acs-win-3des.

If you run Cisco Secure ACS on Windows NT 4.0, upgrade to Cisco Secure ACS version 3.0, then migrate to Windows 2000 Server before upgrading to Cisco Secure ACS version 3.2. Cisco Secure ACS version 3.2 does not support Windows NT 4.0 and Cisco Secure ACS version 3.0 is the most recent version of Cisco Secure ACS that supports Windows NT 4.0. For information about upgrading to Cisco Secure ACS version 3.0 or about migrating to Windows 2000 Server, see Installing Cisco Secure ACS 3.0 for Windows 2000/NT Servers. You can acquire the trial version of Cisco Secure ACS version 3.0 at http://www.cisco.com/cgi-bin/tablebuild.pl/acs-win-3des.

Note

For information about the versions of Cisco Secure ACS that we used to test the upgrade process, see the Release Notes. The most recent version of the Release Notes are posted on Cisco.com, accessible from the following URL: http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/
csacs4nt/index.htm.

Step 3

In the HTML interface of Cisco Secure ACS for Windows Server, version 3.2, use the Cisco Secure ACS Backup feature to back up the database. For more information about the Cisco Secure ACS Backup feature, see the User Guide for Cisco Secure ACS for Windows Server, version 3.2.

Step 4

Copy the backup file from the computer running Cisco Secure ACS for Windows Server, version 3.2, to a directory on an FTP server. The directory must be accessible from the FTP root directory. The Cisco Secure ACS Appliance must be able to contact the FTP server. Any gateway devices must permit FTP communication between the appliance and the FTP server.

Step 5

In the HTML interface of the Cisco Secure ACS Appliance, use the Cisco Secure ACS Restore feature to restore the database. For more information about restoring databases, see the User Guide for Cisco Secure ACS Appliance, version 3.2.

Result: The Cisco Secure ACS Appliance contains the original configuration of the Windows version Cisco Secure ACS that you migrated from.

Step 6

If you want to replace the computer running Cisco Secure ACS for Windows Server with Cisco Secure ACS Appliance, you must change the IP address of the appliance to that of the computer running Cisco Secure ACS for Windows.

Note

If you do not change the IP address of the Cisco Secure ACS Appliance to the address of the computer running Cisco Secure ACS for Windows Server, you must reconfigure all AAA clients to use the IP address of the Cisco Secure ACS Appliance.

Record the IP address of the computer running Cisco Secure ACS for Windows Server.

Change the IP address of the computer running Cisco Secure ACS with Windows Server to a different IP address.

Change the IP address of the Cisco Secure ACS Appliance to the IP address previously used by the computer running Cisco Secure ACS for Windows Server. This is the IP address you recorded in Step a. For detailed steps, see Installation and Configuration Guide for Cisco Secure ACS Appliance.

Uninstalling Cisco Secure ACS

You can remove Cisco Secure ACS software from the computer it is installed on using the standard Windows Control Panel feature, Add/Remove Programs. Of course, when Cisco Secure ACS is removed, the AAA services it provided are no longer available from the computer that ran it.

Step 1

Using the local administrator account, log in to the computer that you want to uninstall Cisco Secure ACS from.

Tip

If Control Panel is not expanded on the Start menu, choose Start > Settings > Control Panel, and then double-click Add/Remove Programs.

Step 3

From the Currently installed programs list, select CiscoSecure ACS vx.x, where x.x is the version of Cisco Secure ACS installed on the computer.

Note

If you click Abort Uninstall, the uninstallation stops and Cisco Secure ACS remains installed on the computer.

Result: The uninstallation continues. Cisco Secure ACS services stop. A dialog box appears.

•

If you want to preserve the CiscoSecure user database, including all group data, click Keep Database.

•

If you do not want to preserve the CiscoSecure user database, click Delete Database.

Table Of Contents