Step-by-Step Configuration

This chapter describes the basic operation of each of the configuration areas of the CiscoSecure ACS 2.1 for Windows NT. It also provides additional information about each function or attribute.

Note Your browser must be running either Microsoft Internet Explorer 3.02 or higher or Netscape Navigator 3.0 or higher. The Enable Java and Java Script functions must be enabled.

Before completing any of the tasks in this chapter, you must have:

CiscoSecure ACS 2.1 for Windows NT installed and running
Working knowledge of your network browser
One or more network access servers (NASes) configured and running

Navigation Bar

The navigation bar is a column of buttons at the far left of the CiscoSecure ACS display. Each of the buttons represents a particular area or function that you can configure. Depending on your access control requirements, you might not need to configure all of the areas. This chapter has a section for each of the areas of configuration or operation with step-by-step details of the general operation. The following software features correspond to the navigation bar buttons:

User Setup—Add/edit user profile configurations
Group Setup—Network services and protocol configuration for a group of users
Network Configuration—Add/edit network access devices and configure distributed systems
System Configuration—Database information and accounting configuration
Interface Configuration—Display or hide product features and options to be configured
Administration Control—Define and configure access policies
External User Databases—Configure external databases for authentication
Reports and Activity—Display accounting/logging information
Online Documentation—CiscoSecure ACS 2.1 for Windows NT User Guide

The order to follow for configuration depends on your preferences and needs.

User Setup

Select User Setup to perform the following tasks:

View a list of all users in the CiscoSecure database
Find a user
Add a user and assign the user to a group
Edit a user's account information
Change the user's authentication type
Set the user's Network Access Restrictions
Delete a user

List All Users

To view a list of all user accounts, follow these steps:

Step 1 In the navigation bar, click User Setup. The Select window opens.

Step 2 Click List All Users. A list of all existing user accounts, enabled and disabled, displays in the right window.

Step 3 (Optional) Click one user's name to view or edit the information for that individual user.

Find a User

To find a user account, follow these steps:

Step 1 In the navigation bar, click User Setup. The Select window opens.

Step 2 Enter the name in the User: field and click Find. You can use wildcard characters (*) in this field. The status (enabled or disabled) and group to which the user belongs display in the right window.

Step 3 (Optional) Click the user's name to view or edit the information for that user.

Add/Edit User Accounts

To add a user:

Step 1 In the navigation bar, click User Setup. The Select window opens.

Step 2 Enter a name in the User field.

Note Usernames must be 1 to 32 characters in length and cannot contain any of the following special characters: #~^*?,:;|"

Step 3 Click Add/Edit. The Edit window opens. The username being added or edited appears at the top of the window.

Supplementary User Information

Enter the following information for the user as applicable:

Account Disabled—Click the Account Disabled check box to deny access for this user.

Note You must click Submit to have this action take effect.

Supplementary User Information—(Optional) Enter the following information:

Real Name—If the username is not the user's real name, enter the real name here.
Description—Enter a detailed description of the user.

Note This item can contain up to five user-configurable fields. See the section "Interface Configuration" for information on how to display and configure these fields.

Password Authentication

Edit or enter the following information for the user:

Password Authentication—Select the authentication type from the drop down menu:

CiscoSecure Database—Authenticates a user from the local CiscoSecure ACS database.
CRYPTOCard Token Card—Authenticates a user from a CRYPTOCard token card server. The CiscoSecure ACS acts as a client to the token card server. This authentication type will appear in the user interface only if this external user database has been configured in External User Databases: Database Configuration.
Safe Word Token Card—Authenticates a user from a Safe Word token card server.
AXENT Token Card—Authenticates a user from an AXENT token card server. This authentication type will appear in the user interface only if this external user database has been configured in External User Databases: Database Configuration.
SDI SecurID Token Card—Authenticates a user from an SDI SecurID token card server. This authentication type will appear in the user interface only if this external user database has been configured in External User Databases: Database Configuration.
NDS Database Authentication—Authenticates a user using Novell Directory Services. This authentication type will appear in the user interface only if this external user database has been configured in External User Databases: Database Configuration.
Windows NT—Authenticates a user with an existing account in the Windows NT User Database located on the same machine as the CiscoSecure server. There is also an entry in the CiscoSecure ACS database used for other CiscoSecure ACS services. This authentication type will appear in the user interface only if this external user database has been configured in External User Databases: Database Configuration.

CiscoSecure PAP (also used for CHAP/ARAP if the separate CHAP/ARAP field is not checked)—Authenticates using a PAP password.

You can configure the NAS to ask for a PAP password first, and then a CHAP password. Then if a user dials in using a PAP password, they will authenticate. To do this, enter the following line in the NAS configuration file:

 
ppp authentication pap chap

Password and Confirm Password—Enter and confirm the PAP password to be used.
Separate CHAP/ARAP—Click this check box to allow the user to authenticate using a CHAP or ARAP password instead of the PAP password in the CiscoSecure User Database. This adds a level of security on top of the CiscoSecure authentication.
Password and Confirm Password—Enter and confirm the CHAP/ARAP password to be used.

Note The Password and Confirm Password fields are required for all authentication methods except the Windows NT User Database.

Group that the user is assigned to—From the drop-down menu, select the group to which to assign the user. The user inherits the attributes and operations assigned to the group. By default, users are assigned to the group Default Group.
Static IP address—Enter the IP address assigned to this user. If the user's IP address is dynamically assigned from an address pool, leave this field blank.
Callback string—Enter a numeric or command string to be sent back to the modem to enable a specific user to be called back.

Note The dial-up user must have configured software that supports callback.

User Network Access Restrictions

Network Access Restrictions lets you permit or deny a user access to a specified server or specified ports on the server. If you are using NAS access, the NAS (Telnet/Login/Exec) Access Control window displays. Select either Permitted Calling/Point of Access Locations or Denied Calling/Point of Access Locations.

Access Server—Select All NASes or the name of the NAS to allow or deny the user's access.
Port—Enter the name of the port to which to permit or deny access. You can use the wildcard asterisk (*) to permit or deny access to all ports on the selected NAS.
Address—Enter the IP address from which to filter permit or deny access.

If you are using dial-up, the Dial-up (PPP/ARAP) Access Control window displays.

Select either Permitted Calling/Point of Access Locations or Denied Calling/Point of Access Locations.

Type—Select one of the following:

CLID—Select CLID if the connection is ISDN and the user is using is a Calling Line Identification number.
DNIS—Select to filter access on the number into which the user will be dialing.
CLID/DNIS—Select to filter on both CLID and dial-in numbers.
NAS/PORT—Select to filter user access when accessing a NAS; for example, during a Telnet session.

Value—Enter the value that applies to the type you selected. For example, for CLID, enter the CLID number; for DNIS, enter the telephone number. You can use the wildcard asterisk (*). For example, to restrict or allow access whenever the user is dialing in from a certain area code, enter the area code followed by the asterisk (for example, 555*).

Max Sessions

For CiscoSecure ACS purposes, a session is any type of user connection supported by RADIUS or TACACS+; for example, PPP, NAS prompt, Telnet, ARAP, and IPX/SLIP. All counts are based on user and group names only. The CiscoSecure ACS 2.1 for Windows NT does not support any differentiation by type of session—all sessions are counted as the same. To illustrate, a user with a Max Session count of one who is dialed in to a NAS with a PPP session, will be refused a connection if that user then tries to Telnet to a location whose access is controlled by the same ACS.

Note Each CiscoSecure ACS server holds its own individual Max Session counts. There is no mechanism for the CiscoSecure ACS 2.1 for Windows NT to share Max Session counts across multiple servers. Thus, if two CiscoSecure ACSes are set up as a mirror pair with the workload distributed between them, they will have completely independent views of the Max Sessions totals.

If the Max Sessions area is not displayed, click Interface Configuration: Advanced Options: Max Sessions.

User Max Sessions

There are three options for User Max Sessions:

Unlimited—Allows the administrator to allocate an unlimited number of Max Sessions for use by this user. This equates to setting Max Sessions Disabled.
Max Sessions—The actual maximum number of sessions granted to this user (see note below).
Use Group Setting—Allows the administrator to specify that this user be allocated the Max Session value set for the group.

The default setting is Use Group Setting.

Note User Max Sessions settings override Group Settings.

If set by the administrator, the CiscoSecure ACS allows the user whatever value the User Max Sessions parameter is set to. This always takes precedence over the Group settings. For example, if the group Sales has a Max Sessions value of only 10, but a user in the group Sales, John, has a User Max Sessions value of Unlimited, John is still allowed an unlimited number of sessions.

Expiration

Enter the information for expiration of this user's account:

Never—This is the default.
Disable account if:—Click to enable a condition under which the account is to be disabled.

Date exceeds—From the drop-down menus, select the month, date, and year on which to disable the account. The default is 30 days after the user is added.
Failed attempts exceed—Click the check box and enter the number of consecutive unsuccessful login attempts to allow before disabling the account. The default is 5.
Reset current failed attempts count on submit—Click to reset the failed attempts counter to zero (0) after the Submit button is clicked.

When you have finished configuring the user information, click the Cisco logo to return to the CiscoSecure ACS main menu.

Deleting User Accounts

To delete a user account from the CiscoSecure database:

Step 1 Click User Setup. The Select and Help windows of the user interface open.

Step 2 In the User field, enter the complete username to be deleted.

Step 3 Click Add/Edit.

Step 4 At the bottom of the User Setup window, click Delete.

Caution If you are authenticating using the Unknown User policy, you must also delete the user account from the external user database. This prevents the username from being automatically re-added to the CiscoSecure user database the next time the user attempts to log in.

Advanced TACACS+ Settings

The following information applies when you have a TACACS+ NAS configured. If this field does not display, click Interface Configuration: Advanced Options: Advanced TACACS+ Settings.

TACACS+ Enable Control

Use TACACS+ Enable control with Exec session to control administrator access. It is primarily used for router management control. Select the Max Privilege level you want this user to have. See your NAS documentation for information on privilege levels. Enter and confirm a control password for this user. This password is used in addition to the regular authentication.

TACACS+ Outbound Password

TACACS+ Outbound Password enables a NAS to authenticate itself to another NAS/client via outbound authentication. The outbound authentication can be PAP, CHAP, or ARAP and results in the CiscoSecure ACS password being given out. By default, the user's ASCII/PAP or CHAP/ARAP password is used. To prevent compromising inbound passwords, you can configure a separate SENDAUTH password. Use this feature only if you are familiar with TACACS+ SendAuth/OutBound password.

Group Setup

Click Group Setup to perform the following tasks:

List all Users in Group—Displays all the users listed in the group you selected from the Group list box.
Edit Settings—Displays all the settings that you can change for the selected group.
Rename Group—Allows you to rename a selected group.

List Users in Group

To list all users in a specified group:

Step 1 Click Group Setup. The Select and Help windows open.

Step 2 From the drop-down menu, select the group to list.

Step 3 Click Users in Group. The User List and the Edit windows open. You can view, modify, or delete a user by clicking on the user's name in the list.

Edit Group Settings

To assign or edit a group's authorization and authentication settings, follow these steps:

Note Depending on the features that are enabled in the Interface Configuration: Advanced Settings window, Quick Link buttons will appear at the top of the Group Setup window. Click the applicable button to go directly to the appropriate location.

Step 1 Click Group Setup. The Select window opens.

Step 2 In the drop-down list, select the applicable group.

Step 3 Click Edit Settings. The Edit window opens.

Step 4 Complete the Group Setup section.

Before you configure Group Setup it is important to understand how this window functions. Group Setup is dynamically built depending on the configuration of your NAS and the security protocols being used. There are six basic sections to Group Setup:

1. General information that applies to both TACACS+ and all instances of RADIUS

2. Token Card Information

3. TACACS+

4. RADIUS (IETF)

5. RADIUS (Cisco Vendor Specific Attribute)

6. RADIUS (Ascend)

The General Information is always displayed. Token card information is displayed if a token card external user database is configured. The combination of TACACS+ and RADIUS sections that are displayed depends on how your access server is configured. If one NAS is configured within CiscoSecure and is running TACACS+, only the following subsections are displayed:

General information that applies to both TACACS+ and all instances of RADIUS
Token Card Information
TACACS+

If a second NAS is using RADIUS (IETF), the following subsections are displayed:

General information that applies to both TACACS+ and all instances of RADIUS
Token Card Information
TACACS+
RADIUS (IETF)

Note When RADIUS (Cisco) or RADIUS (Ascend) is selected for a NAS, RADIUS (IETF) attributes are available because they are the base set of attributes used to configure the first 74 attributes for all RADIUS vendors.

The content of these subsections is dynamic. Only the attributes selected from the Interface Configuration: TACACS+ (Cisco) or RADIUS (IETF) section are displayed. This allows you to select and display only those attributes you want. You can change what is displayed in each of the subsections by selecting a security protocol from the Protocol Configuration Options in the NAS Configuration window.

Network Access Restrictions

Network Access Restrictions provide an automated method of making access control decisions on the following:

Calling Station ID (CLID)—These are identification attributes associated with the calling station. To support flexible access control, the CiscoSecure ACS supports the use of station/node identifiers from a variety of network types.
Called Station ID/Dialed Number Identification Service (DNIS)—These are identification attributes of the device through or for which access was attempted. As with CLID, for maximum flexibility, the CiscoSecure ACS supports the use of more than one type of device identifier. As an access device might have many ports or numbers associated to or through which access may be attempted, DNIS can identify these specifically giving even greater granularity of control if required.

Follow these steps to permit or deny a group access to a specified server or specified ports on the server based on a definable filter.

Step 1 From the NAS (Telnet/Login/Exec) Access Control drop-down box, select either Permitted Calling/Point of Access Locations or Denied Calling/Point of Access Locations.

Access Server—Select All NASes or the name of the NAS to permit or deny access.
Port—Enter the port to which to permit or deny access. You can use the wildcard asterisk (*) to permit or deny access to all ports on the selected NAS.
Address—Enter the IP address to filter on when performing access restrictions. You can enter multiple entries separated by a comma or use the wildcard asterisk (*).

Step 2 From the Dial-Up (PPP/ARAP) Access Control drop-down box, select either Permitted Calling/Point of Access Locations or Denied Calling/Point of Access Locations.

Type—Select one of the following:

CLID—Select CLID to filter on the Calling Line Identification number.
DNIS—Select to filter on the number into which the group will be dialing.
CLID/DNIS—Select to filter on both the CLID and DNIS numbers.
NAS/PORT—If you are using a Cisco IOS release that does not support CLID and DNIS, select this option to filter on NAS access by entering the IP address and port number.

Value—Enter the value that applies to the type you selected. For example, for CLID, enter the CLID number; for DNIS, enter the telephone number. You can use the wildcard asterisk (*). For example, to restrict or allow access whenever the group is dialing in from a certain area code, enter the area code followed by the asterisk (for example, 555*).

Group Max Sessions

Group Max Sessions configuration is split in two. The first section is for the group level settings:

Unlimited—Allows the administrator to allocate an unlimited number of Max Sessions for use by a group. This equates to setting Max Sessions Disabled.
Max Sessions—Allows the administrator to specify the maximum number of sessions available for the group (see note below for exceptions).

The second is for users within the group Settings for Users of this Group:

Infinite—Allows the administrator to allocate an unlimited number of Max Sessions for use by a member of the group
Max Sessions—The maximum number of sessions granted to each individual user of the group. This is only used if the User Max Sessions (see below) is set to Use Group Setting (the default setting).

Note The default setting for Group Max Sessions is Infinite (disabled) for both the group and the user within the group.

Token Card Information

Token Card Caching—Click this check box to allow the token to be cached. This lets you use a second B channel without having to enter a second one-time password (OTP). You can configure token caching on a per-session basis or with a specified duration for which the token is cached.

TACACS+

These parameters are displayed only if the NAS has been configured to use TACACS+. The default service-protocol settings displayed for TACACS+ are:

PPP-IP
Shell (Exec)

To display or hide additional services or protocols, click Interface Configuration: TACACS+ (Cisco).

Select the services and protocols to be authorized for the Group by checking the box next to the protocol-service. Below each service-protocol, select the attributes to further define the authorization for that protocol-service. In the case of access control lists (ACLs) and IP address pools, the name of the ACL or pool as defined on the NAS should be entered. (An ACL is a list of Cisco IOS commands used to restrict access to or from other devices and users on the network.) Leave blank if the default (as defined on the NAS) should be used. More information about attributes can be found in the appendix of this document or your NAS documentation.

Note You can define and download an ACL. Click Interface Configuration: TACACS+ (Cisco) and click Display a Window for each service selected in which you can enter customized TACACS+ options. A box opens under each service-protocol allowing you to define an Access Control List.

When configuring Shell (Exec), you can define the Cisco IOS commands and arguments to be permitted or denied. Click the box to enable the command, enter the name of the command, define its arguments using standard permit or deny syntax, and define whether Unlisted Arguments are to be permitted or denied. You can enter any number of commands. To add fields, submit the changes for the first commands and reenter Group Setup. The submitted commands appear and additional fields become available.

RADIUS (IETF)

These parameters are displayed only when the NAS has been configured to use RADIUS (IETF). Table 8-1 gives the default attribute settings for IETF RADIUS:

Table 8-1 Default Attribute Settings for IETF RADIUS

Service Type	Framed-Protocol
Framed-IP-Address	Framed-IP-Network
Framed-Routing	Filter-Id
Framed-MTU	Framed-Compression
Login-IP-Host	Login-Service
Login-TCP-Port	Reply-Message
Callback-Number	Callback-Id
Framed-Route	Framed-IPX-Network
State	Class
Session-Timeout	Idle-Timeout
Proxy-State	Login-LAT-Service
Login-LAT-Node	Login-LAT-Group
Framed-AppleTalk-Link	Framed-AppleTalk-Network
Framed-AppleTalk-Zone	Port-Limit
Login-LAT-Port

Note RADIUS attributes are sent as a profile for each user from the CiscoSecure ACS to the requesting NAS. To display or hide any of these attributes, see the section "TACACS+ or RADIUS Protocol Configuration Options."

Select the attributes to be authorized for the Group by checking the box next to the attribute, then define the authorization for the attribute in the field next to it. More information about attributes can be found in the appendix of this document or your NAS documentation.

RADIUS (Cisco)

The RADIUS (IETF) and RADIUS (Cisco) parameters are displayed only if a NAS has been configured to use RADIUS (Cisco). RADIUS (Cisco) represents the Cisco Vendor Specific Attribute (VSA) IETF number 26. Therefore, when configuring RADIUS (Cisco), both IETF and Cisco VSA apply. The default attribute setting displayed for RADIUS (Cisco) is Cisco VSA, which are packed as RADIUS VSAs (attribute number 26 using Cisco's Vendor ID of 9).

Note To hide or display additional IETF attributes, see "TACACS+ or RADIUS Protocol Configuration Options."

Step 1 For the IETF attributes, select the attributes to be authorized for the Group by checking the box next to the attribute. Be sure to further define the authorization for the attribute in the field next to it. More information about attributes can be found in the appendix of this document, or your NAS documentation.

Step 2 For the Cisco VSA, enter the commands (such as TACACS+ commands) to be packed as a RADIUS VSA.

Note The RADIUS (IETF) attributes are shared among the different RADIUS vendors. You must configure the first 74 RADIUS attributes using the RADIUS (IETF) dictionary.

RADIUS (Ascend)

The RADIUS (IETF) and RADIUS (Ascend) parameters are displayed only if a NAS has been configured to use RADIUS (Ascend). RADIUS (Ascend) represents the Ascend proprietary attributes. Therefore, when configuring RADIUS (Ascend), both IETF and Ascend apply (proprietary attributes override IETF when conflicting).

The default attribute setting displayed for RADIUS is Ascend-Remote-Addr.

To display additional, or hide any/all of these IETF attributes, see "TACACS+ or RADIUS Protocol Configuration Options."

Step 1 For the IETF attributes, select which attributes should be authorized for the Group by checking the box next to the attribute. Be sure to further define the authorization for that attribute in the field next to it. More information about attributes can be found in the appendix of this document or your NAS documentation.

Step 2 For the Ascend attributes, select which attributes that should be authorized for the Group by checking the box next to the attribute. Be sure to further define the authorization for that attribute in the field next to it. More information about attributes can be found in the appendix of this document or your NAS documentation.

Note The RADIUS (IETF) attributes are shared among the different RADIUS vendors. You must configure the first 74 RADIUS attributes using the RADIUS (IETF) dictionary.

Step 3 Click Submit + Restart. The group attributes are applied and services are restarted. The Edit window opens. (Click Submit if you want to save your changes and apply them later by restarting the services.)

Note Restarting the service clears the Logged-in User Report and temporarily interrupts all of the CiscoSecure ACS services. This will affect the Max Sessions counter.

Step 4 Verify that your changes were applied by selecting the group and click Edit Settings. View the settings.

Renaming a Group

To rename a group, follow these steps:

Step 1 Click Group Setup. The Select window opens

Step 2 Select a group from the drop-down list.

Step 3 Click Rename Group.

Step 4 Enter the new name in the Group field.

Step 5 Click Rename Group. The Select window opens with the new group name selected.

Note The group remains in the same position in the list box. The number value of the group is still associated with this group name. Some utilities, such as the database import utility, use the numeric value associated with the group.

Network Configuration

The NAS you use with the CiscoSecure ACS must be configured and active on the network. To configure the NAS, follow these steps:

Step 1 Click Network Configuration.

Step 2 Click Add New Access Server.

Step 3 Enter the Access Server Hostname.

Step 4 Enter the Access Server IP address.

Step 5 Enter the Key value (this is the secret value shared between the NAS and CiscoSecure).

Step 6 Select a security protocol from the Authenticate Using drop-down list.

Step 7 Select single TCP connection to configure CiscoSecure ACS to use this feature if it is configured on the NAS.

Step 8 Click Submit + Restart.

Note Restarting the service clears the Logged-in User Report and temporarily interrupts all of the CiscoSecure ACS services. This will affect the Max Sessions counter.

You can also configure specific security protocol attributes to be used by CiscoSecure. Click the button for the specific protocol you want to configure. A list of attributes appears.

Attributes marked with an asterisk (*) are configured on the NAS and cannot be changed from the CiscoSecure user interface. Attributes with a check box to the left can be enabled by checking the box or disabled by clearing the box.

Note You must select attributes from these lists before they are available for use in User Setup or Group Setup. The RADIUS (IETF) attributes are shared among all the RADIUS vendors. You must configure the first 74 RADIUS attributes from RADIUS (IETF).

Edit Network Configuration

To edit the configuration of a NAS that is listed in the Select window, follow these steps:

Step 1 Click Network Configuration. The Select window opens. Existing NASes are listed under Access Server Setup.

Step 2 Click the name of the NAS to edit. The Edit window opens.

Step 3 Change the following information as applicable:

Access Server IP Address—IP address of the NAS configured to work with the CiscoSecure ACS.
Key—A shared secret between the NAS and the CiscoSecure ACS for either TACACS+ or RADIUS. The shared secret is case-sensitive.
Authenticate Using—Defines the type of security control protocol that is used for communication between the CiscoSecure ACS and the NAS.

Step 4 Select single TCP connection to configure CiscoSecure ACS to use this feature if it is configured on the NAS.

Step 5 To immediately apply the changes, click Submit + Restart; to restart the services and apply the changes later, click Submit.

Note Restarting the service clears the Logged-in User Report and temporarily interrupts all of the CiscoSecure ACS services. This will affect the Max Sessions counter.

For more information on Network Configuration, see the chapter "Distributed Systems."

System Configuration

To edit your current CiscoSecure configuration, click System Configuration. The Select window opens. Select one of the following:

Service Control—Restarts or stops services
Logging—Sets the files to which start/stop events are logged
CiscoSecure Database Replication—Enables database replication
RDBMS Synchronization—Enables RDBMS synchronization

Note If CiscoSecure Database Replication or RDBMS Synchronization is not displayed, click Interface Configuration: Advanced Options and enable both the feature you want and Distributed System Settings.

Service Control

To restart or stop services, click Service Control. Click one of the following:

Restart Services—Stops and restarts all CiscoSecure services except for CSAdmin. CSAdmin controls the browser and must continue to run.
Stop Services—Stops all CiscoSecure services except for CSAdmin. CSAdmin controls the browser and must continue to run.

To set the files to which start/stop events are logged, click Logging.

Logging

Remote Logging allows accounting information to be sent to one central location: Click one of the following options:

Do Not Log Remotely—Click this check box have remote logging not configured.
Log To All Selected Hosts—Click this check box, then click the name of the CiscoSecure ACS servers in the Log Servers column and click the arrow button to move the selected hosts to the Log To column. Logs will be sent to all selected CiscoSecure ACSes.
Log to Subsequent Selected Hosts on Failure—Click this check box to enable backup logging. If the first server in the list goes down, logs are sent to the following selected CiscoSecure ACSes, in the order in which they appear in the Log To column.

Note This field does not have the same function as Send Accounting Information: Local/Remote. Click Network Configuration and add or edit a distribution table to view information on sending accounting packets to the local or remote AAA server.

CiscoSecure Database Replication

Database replication lets you enable and schedule the method and times that the CiscoSecure ACS database is replicated by sending or receiving information from another CiscoSecure ACS database.

Replication Components—Select the components of the database that are to be replicated and whether this CiscoSecure ACS server is to receive or send the information. For increased security you might want to have one server always be the sender and the other servers always be the receivers. This also allows you to ensure that all your servers are configured identically.

User and Group Database—Replicate the information for groups and users.
AAA & Network Access Server Tables—Replicate the information for AAA servers and NASes.
Distribution Table—Replicate the authentication forwarding information.
Interface Configuration—Replicate the Interface Configuration: Advanced Options settings.
Interface Security Settings—Replicate the security information for the server interface.

Replication Scheduling—Configure when CiscoSecure ACS replication will take place.

Manually—Do not replicate automatically.
Automatically Triggered Cascade—Replicate to a replication partner when information from a master is received.
Each backup period (minutes)—Enter the number of minutes after which replication is performed again. The default is 60.

Note If this time is set too low, replication might be incomplete; if it is set too high, replication might interfere with users' ability to authenticate if usernames are added frequently.

At specific times—Click the time of day and day of week and click Replicate to allow replication during those times or click No Replication to prevent replication during those times.

Replication Partners—Select the AAA server(s) to replicate to or from. Allows you to configure CiscoSecure ACS to be aware of other CiscoSecure ACSes.
Replicate Now—Click to replicate immediately.

For more information on Database Replication, see the chapters "Database Information Management" and "Distributed Systems."

RDBMS Synchronization

You can propagate changes from user and group setup information to other databases using RDBMS Synchronization.

RDBMS Setup—Select the source of the data and the type of change.

Data Source—From the dropdown box, click the source of the data to be synchronized.
Username—Enter the username for the changed information.
Password—Enter the password for the user whose information has changed.

Synchronization Scheduling—Set the time-of-day and day-of-week during which synchronization might take place.

Manual Synchronization—Do not synchronize automatically.
Period (minutes)—The frequency between synchronizations. The default is 60 minutes. If this time is set too low, synchronization might be incomplete; if it is set too high, synchronization might interfere with users' ability to authenticate.
At specific times—Click the time of day and day of week and click Synchronize to allow synchronization during those times or click No Synchronization to prevent synchronization during those times.

Synchronization Partners—Select the AAA server(s) to synchronize to or from.

For more information on RDBMS Synchronization, see the chapters "Database Information Management" and "Distributed Systems."

Interface Configuration

The Interface Configuration window lets you display or hide fields in the other parts of the HTML user interface. The information for hidden fields will still be stored in the CiscoSecure ACS, but you will not be able to see them unless you check the item here. This allows you to hide unused fields and view a clearer interface. You can configure the following items from the Interface Configuration window:

User Data Configuration
TACACS+ or RADIUS Protocol Configuration Options
Advanced Options

User Data Configuration

You can define up to five fields to contain information that you want to view for each user. The fields you define in this section will appear in the Supplementary User Information section at the top of the User Setup window. To define the fields, click Display and enter a Field Name in each applicable box.

TACACS+ or RADIUS Protocol Configuration Options

These fields display only if you have configured a NAS with the applicable protocol. This lets you select the AV pairs you want to appear as a configurable option in the Group Setup window. Click the applicable option and click Submit. See the section "Group Setup" for more information on these fields.

Advanced Options

Click the check boxes of the items you want to have displayed in the applicable area of the GUI; clear the check boxes of the items you want to hide.

Per-User Advanced TACACS+ Features—Displays or hides the Advanced TACACS+ Options section in the User Setup window.
User-Level Network Access Restriction—Displays or hides the NAS and Dialup filter sections in the User Setup window. If the Group Setup page specifies these filters, these sections will still display.
Default Time-of-Day/Day-of-Week Specification—Displays or hides the time-of-day/day-of-week grid on the Group Setup page.
Per-Service Time-of-Day/Day-of-Week Specification—Displays or hides the time-of-day/day-of-week grid for each TACACS+.
Group Level Network Access Restriction—Displays or hides the NAS and dialup filter sections of the Group Setup window.
Max Sessions—Displays or hides the Max Sessions section of the User Setup and Group Setup windows.
Distributed-System Settings—Displays or hides the AAA server and authentication forwarding table in the Network Interface window. If the tables are not empty and have information other than the defaults in them, they will always display.
Remote Logging—Displays or hides the Logging field in the System Configuration window. If remote logging is configured, this window will always display.
CiscoSecure Database Replication—Displays or hides the Database Replication field in the System Configuration window.
RDBMS Synchronization—Displays or hides the RDBMS Synchronization window in the System Configuration window. If RDBMS Synchronization is configured, this window will always display.

Administration Control

You can administer CiscoSecure from any workstation in the network as long as the workstation is running a compatible browser. See the section "System Requirements" in the chapter "Overview" for a list of compatible browsers. The address to enter in the remote administrator's browser is: http:// Windows NT server ip-address:2002. The port number, 2002, is dynamically changed after the initial login of a remote administrator.

Remote administrators can use a firewall protected dial-in connection, but this is not recommended or supported. Leaving a port open for remote administration could compromise network security.

Note You must enable the Java functions on your browser.

Adding a Remote Administrator

To enable remote administration from a workstation or remote client:

Step 1 Click Administration Control from the navigation bar.

Step 2 Click Add new administrator.

(a). Administrator Name—User identification for the administrator to log into CiscoSecure

(b). Password—Password used by the administrator to log in

(c). Confirm Password—Confirmation of the administrator password

Note This password is for a remote administrator to access the CiscoSecure interface. It has no connection with the user passwords for authentication, authorization, and accounting (AAA) services.

Step 3 Click Submit to save these changes and stop and start the appropriate services.

Session Policy

An administrative login can be terminated by setting the idle timeout. This parameter applies to the browser session only. It does not apply to the dial-in session. The browser connection with CiscoSecure is terminated if there is no activity for the specified period of time.

Session idle timeout—Time in minutes that the browser must remain idle before the connection to CiscoSecure is terminated. This terminates the browser connection only.
Allow Automatic Local Login—Allows administrators to log in to their local CiscoSecure ACS without entering their password.

When this check box is checked, the browser, when it connects to the CSAdmin server, goes directly to the CiscoSecure ACS welcome screen without the administrator having to enter a valid administrator name and password.

If this check box is cleared and the form is submitted, the browser is sent a page that requires the user to log in using a valid administration name and password. The user cannot progress to the welcome screen until a valid administrator name and password pair is supplied.

Note If there are no administrator accounts defined on the CSAdmin server, the browser always goes to the welcome page, no matter what the state of the Allow Automatic Local Login check box. This prevents a situation in which the local browser is locked out of the CSAdmin server because there are no administrator accounts.

The preferred way to end a remote browser session or a local browser session where login is required (the Allow Auto Local Login check box is clear) is to click Logout at the top right corner of any of the title bars, or to go back to the welcome screen by clicking the CiscoSecure logo and then clicking Logout. This releases the administration session in the server and closes any back door left open on the session's port. When you have logged out this way, you can close the browser or leave it running, as required.

Respond to Invalid IP Address Connections—Allows the CiscoSecure ACS to send information to invalid IP addresses.

Access Policy

The following items can be configured for the Access Policy:

IP Address Filtering—Click one of the following options:

Allow all IP addresses to connect—No filtering on any IP address is performed when an administrator is accessing CiscoSecure ACS remotely.
Allow only listed IP addresses to connect—Click to allow remote administration from only those workstations whose IP addresses fall within the range specified in the IP Addresses Ranges section. Workstations whose IP addresses are not within the specified range will not be able to access CiscoSecure ACS remotely.
Reject connections from listed IP addresses—Click to filter out remote administration from the IP addresses specified in the IP Address Ranges section. Remote administration from workstations whose IP addresses do not fall within the specified range will be permitted.

IP Address Ranges—Enter the IP address range in Class C format from which to permit or deny access.

Edit Administrator Configuration

You can change an administrator's password or delete an existing administrator.

Changing an Administrator Password

To change a password:

Step 1 Click Administration Control. The Select window opens.

Step 2 Click an existing administrator name in the list. The Edit window opens.

Step 3 Enter a new password for the selected administrator. You must enter the password twice for confirmation.

Step 4 Click Submit to update the password now.

Deleting an Administrator

To delete an administrator:

Step 1 Click Administration Control. The Select window opens.

Step 2 Click an existing administrator name in the list. The Edit window opens.

Step 3 Click Delete. A delete confirmation window opens.

Step 4 Click OK to delete the selected administrator.

External User Databases

Click External User Databases to configure the following features:

Unknown User Policy—Defines the action for the CiscoSecure ACS to take it if it does not find a username matching that of the incoming authentication request in its own database. There are two options: fail the authentication and reject the request (that is, fail all unknown users) or continue to search the list of external user databases configured.
Database Group Mappings—Provides the controls to allow the CiscoSecure ACS to map an appropriate authentication/authorization group profile to each external user database.
Database Configuration—Installs support for communication with an external user database.

For more information on External User Databases, see the chapter "User Databases."

Unknown User Policy

In CiscoSecure ACS, an unknown user is defined as one for whom no account has been created within the CiscoSecure ACS database.

To specify how the CiscoSecure ACS should handle users who are not in the CiscoSecure ACS database, follow these steps:

Step 1 In the navigation bar, click External User Databases.

Step 2 Click Unknown User Policy.

Step 3 In the Configure Unknown User Policy window, click one of the following:

Fail the attempt—Do not authenticate any unknown users.
Check the following external user databases—Authenticate users using the database you select:

CRYPTOCard Token Card—Authenticates a user from a CRYPTOCard one-time password (OTP) token card server. The CiscoSecure ACS acts as a client to the token card server.
AXENT Token Card—Authenticates a user from an AXENT token card server.
SDI SecurID Token Card—Authenticates a user from an SDI SecurID token card server.
NDS Database Authentication—Authenticates a user using Novell Directory Services (NDS).
Windows NT—Authenticates a user from the Windows NT user database.
Safe Word Token Card—Authenticates a user from a Safe Word token card server.

Step 4 Click Submit.

For more information on Unknown User Policy, see the chapter "Sophisticated Unknown User Handling."

Network Access Authorization

While Unknown User Policy allows authentication requests to be forwarded to external user databases, all responsibility for the authorization parameters provided to the NAS remain with CiscoSecure ACS. Basically, the external user database simply authenticates the user and CiscoSecure ACS then provides the additional authorization information that is sent to the NAS in the RADIUS or TACACS+ response packet (see External Database Group Mapping below).

Database Group Mappings

The Database Group Mappings window allows you to enable the CiscoSecure ACS to map an appropriate authentication/authorization group profile to each external user database. Because the only data items common to both the CiscoSecure ACS database and the third-party database are username and password, external users databases can be used only for authentication.

The CiscoSecure ACS supports group-access profiles for external user database mapping so that you can specify a different access profile for each individual external user database. Because it is a native Windows NT application, the CiscoSecure ACS provides even greater configurability of group access profile mapping when using Windows NT as an external user database The CiscoSecure ACS can extract a substantial amount of data on each user from the API calls, including the user's Windows NT Domain and, within that domain, the groups to which the user belongs. The CiscoSecure ACS allows you to map group access profiles to Windows NT domains or to groups within domains.

For more information on external user databases, see the chapter "Sophisticated Unknown User Handling."

OTP Database Authentication Group Mappings

To specify a token card database mapping for a group, follow these steps:

Step 1 In the navigation bar, click External User Databases.

Step 2 Click Database Group Mappings.

Step 3 Click the name of the external user database to be used:

CRYPTOCard Token Card—Authenticates a user from a CRYPTOCard token card server. The CiscoSecure ACS acts as a client to the token card server.
Safe Word Token Card—Authenticates a user from a Safe Word token card server.
AXENT Token Card—Authenticates a user from an AXENT token card server.
SDI SecurID Token Card—Authenticates a user from an SDI SecurID token card server.
NDS Database Authentication—Authenticates a user using Novell Directory Services.

Step 4 Click the number of the group to be authenticated using this source. For example, Group 0 (x users) where x is the number of users assigned to the group. See the section "Group Setup" for more information.

Step 5 Click Submit.

Windows NT Database Authentication Group Mappings

To map a group to the Windows NT database, follow these steps:

Step 1 In the navigation bar, click External User Databases.

Step 2 Click Database Group Mappings.

Step 3 Click Windows NT to authenticate a user from an existing entry in the Windows NT user database located on the same machine as the CiscoSecure server. There is also an entry in the CiscoSecure ACS database used for other CiscoSecure ACS services. A window with a list of domain configurations opens.

Step 4 Click New Configuration to add a domain or click the name of the domain to configure.

Step 5 If you are adding a domain configuration, do one of the following:

In the Detected domains scroll box, click the name of the domain to configure
In the Domain: Field dialog box, enter a known Windows NT domain name.

You can use this field to enter a domain you know is trusted, even though one has not been returned on the display. When you reboot a Windows NT server, there are a few minutes of delay during which the browser "warms up." Asking for all trusts at this time might not return the entire list correctly.

Additionally, if a trusted host is down, its name will not display, so you will not be able to add group mappings for it. The Domain field allows you to manually enter the name of an unlisted trusted domain. See your Microsoft documentation for more information on Trust Relationships.

Step 6 Click Submit. The service restarts and the Domain Configurations window opens. The name of the new configuration is listed.

Step 7 To edit an existing configuration, click its name in the Domain Configurations window. The Mappings for Domain: domainname window opens where domainname is the name of the configuration you are editing.

Step 8 Click Add Mapping. The Create New Mapping for Domain domainname window opens.

Step 9 In the CiscoSecure group scroll box, click the name of the group to which you want to map this configuration; for example, Group 0. See the section "Group Setup" for information on renaming a group.

Step 10 Click Submit.

Step 11 The Mappings for Domain: domainname window opens again, this time listing the mapping you just created.

Editing Domain Mappings

To edit the mapping for a domain, follow these steps:

Step 1 In the navigation bar, click External User Databases.

Step 2 Click Database Group Mappings.

Step 3 Click Windows NT. The Domain Configurations window opens.

Step 4 To edit a domain, click the name of the domain you want to edit. The Mappings for Domain domainname window opens. This window displays a list of the NT groups you have configured for this domain and the CiscoSecure group to which it is mapped.

(a). To edit the mapping, click the name of the Windows NT group to be edited. The Edit mapping for Domain domainname window opens.

(b). In the CiscoSecure group scroll box, click the name of the group to which this NT group should be mapped, then click Submit.

Step 5 To add a new mapping, click Add mapping. The Create New Mapping for Domain: domainname window opens. In the CiscoSecure group: scroll box, select the CiscoSecure group to which this Windows NT domain should be mapped; for example, Group 1. If you do not want to assign this mapping to a group, you can leave this scroll box set to the default, <No Access>.

Step 6 In the Define Windows NT group set, Windows NT Groups scroll box, click the name of the NT group you want to assign to this mapping.

Step 7 Click the -> (right arrow) button to move your selection into the Selected column.

Step 8 When you have finished selecting all the groups you want, click Submit. The Mappings for Domain domainname window opens again with the new group mapping listed.

Deleting a Domain Mapping Configuration

To delete an existing mapping configuration, follow these steps:

Step 1 In the navigation bar, click External User Databases.

Step 2 Click Database Mappings.

Step 3 Click Windows NT. The Domain Configurations window opens.

Step 4 Click the name of the configuration to delete. The Mappings for Domain: domainname window opens (where domainname is the name of the configuration to delete).

Step 5 Click Delete Configuration.

Step 6 Click Submit.

Database Configuration

To install CiscoSecure ACS support for any of the remote authentication sources follow these steps:

Step 1 Click External User Databases.

Step 2 Click Database Configuration. The External User Databases window opens.

Step 3 Click one of the following types of authentication to be used:

CRYPTOCard Token Card—Authenticates a user from a CRYPTOCard token card server. The CiscoSecure ACS acts as a client to the token card server.
Safe Word Token Card—Authenticates a user from a Safe Word token card server.
AXENT Token Card—Authenticates a user from an AXENT token card server.
SDI SecurID Token Card—Authenticates a user from an SDI SecurID token card server.
NDS Database Authentication—Authenticates a user using Novell Directory Services.
Windows NT—Authenticates a user from an existing entry in the Windows NT user database located on the same machine as the CiscoSecure server.

For the CiscoSecure ACS to interact with an external user database, two components are required; a source-specific CiscoSecure ACS DLL and the third-party authentication source API with which this communicates. However, for Windows NT and NDS authentication, the program interface for the external authentication is local to the CiscoSecure ACS system and is provided by the local operating system. In these cases, no further components are required. To communicate with each of the OTP servers, you must have software components provided by the OTP vendors installed, in addition to the CiscoSecure ACS components. You must also specify in User Setup that a token card server is to be used.

Note If you select one of the token card servers but token card support is disabled, you must restart the CSAdmin service to reload the token card DLL.

Step 4 The Database Configuration window opens. To delete a configuration, click Delete. To set up a configuration, click Configure.

CRYPTOCard Token Card Configuration

If you selected CRYPTOCard, enter the following information:

Server Name—The name or IP address of the CRYPTOCard Server. The number defaults to 127.0.0.1 and cannot be changed.
CRYPTOCard Path—The path and directory in which all the configuration files for the CRYPTOCard server are located.

Click Submit.

Safe Word Token Card Configuration

If you selected Safe Word, enter the following information:

Server Name—Mnemonic for the user, preferably the name of the remote server.
Server Address—The IP address of the remote Safe Word token card server.

Click Submit.

AXENT Token Card Configuration

If you selected AXENT, enter the following information:

Server Name—Name of the defender security server
Server Address—IP address of the defender security server
Server Port—Port number of the defender security server
Communication Timeout—Number of seconds to wait before sending notification to the user that the connection has timed out.
Agent ID—Identification of an agent that has been approved by the server
Agent Key—Agent's SNK key in hexadecimal numbers (00 to FF)

Click Submit.

SDI SecurID Token Card Configuration

If you selected SDI, follow these steps:

Step 1 Before you start:

Log in to the Windows NT server with administrative privileges.
Make sure you have the ACE Client for Windows NT software.

Step 2 Run the Setup program of the ACE Client software (following the setup instructions). Do not restart your Windows NT server when installation is complete.

Step 3 Locate the ACE Server data directory, for example /sdi/ace/data.

Step 4 Get the file named sdconf.rec and place it in your Windows NT directory: %SystemRoot%\system32

for example:

\winnt\system32.

Step 5 Make sure the ACE server host machine name is in the Windows NT local host's file:

\winnt\system32\drivers\etc\hosts

Step 6 Restart your Windows NT server.

Step 7 Verify connectivity by running the Test Authentication function of your ACE client application. You can run this from the Control Panel.

NDS Database Authentication Configuration

If you selected NDS Server Support, follow these steps:

Step 1 See your Novell NetWare administrator to get the names and other information on the Tree, Container, and Context.

Step 2 Click NDS Server Support.

Step 3 Enter a name for the configuration. This is for information purposes only.

Step 4 Enter the Tree name.

Step 5 Enter the full Context List, separated by dots (.). You can enter more than one context list. If you do, separate them with a comma and space. For example, if your Organization is Corporation, your Organization Name is Chicago, and you want to enter two Context names, Marketing and Engineering, you would enter:

 
Engineering.Chicago.Corporation, Marketing.Chicago.Corporation

You do not need to add users in the Context List.

Step 6 Click Submit. Changes take effect immediately; you do not need to restart the CiscoSecure ACS.

Caution If you click Delete, your NDS database will be deleted.

Windows NT Configuration

If you did not already do so during installation, you can enable your CiscoSecure ACS to grant dial-in permission to users. Follow these steps:

Step 1 In the navigation bar, click External User Databases.

Step 2 Click Database Configuration.

Step 3 Click Windows NT.

Step 4 Click Configure.

Step 5 Check the Grant dialin permission to user check box.

Step 6 Click Submit.

Note Your Windows NT server must also be configured to allow grant dial-in permission to user. See your Microsoft documentation for more information.

Reports and Activity

Click Reports & Activity in the navigation bar to view reports. The Reports window opens. Select one of the following types of reports to view:

TACACS+ Accounting—Lists when sessions stop and start; records NAS messages with username; provides caller line identification information; records the duration of each session.
TACACS+ Administration—Lists configuration commands entered on a TACACS+ (Cisco) NAS.
RADIUS Accounting—Lists when sessions stop and start; records NAS messages with username; provides caller line identification information; records the duration of each session.
Failed Attempts—Lists authentication and authorization failures with an indication of the cause.
Logged-in Users—Lists all users currently receiving services for a single NAS or all NASes with access to the CiscoSecure ACS.
Disabled Accounts—Lists all user accounts that are currently disabled.

When you select Logged-in Users or Disabled Accounts, a list of these users or accounts appears in the window on the right of the display. For all other types of reports, a list of applicable reports opens in the window on the right of the display. The reports are named and listed by the date on which they were created; for example, 1997-12-04.csv was created on December 4, 1997. You can import these files into most database and spreadsheet applications.

Online Documentation

The online documentation provides more detailed information about the configuration, operation, and concepts of CiscoSecure.

Step 1 Click Online Documentation.

The Table of Contents opens in the left window.

Step 2 Click the applicable topic. The online documentation window opens.

Step 3 To print the online documentation, click in the right window, then click Print in your browser's navigation bar.

Note Click Section Information in any `Quick Help...' window to view the online user guide.