Cisco Servers Manuale utente

Corporate Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 526-4100

Cisco Secure ACS 3.0 for Windows

2000/NT Servers User Guide

November 2001

Customer Order Number: DOC-7813751=

Text Part Number: 78-13751-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT

NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT

ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR

THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION

PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO

LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE

PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED

OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL

DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR

INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH

DAMAGES.

AccessPath, AtmDirector, Browse with Me, CCIP, CCSI, CD-PAC, CiscoLink, the Cisco Powered Network logo, Cisco Systems Networking

Academy, the Cisco Systems Networking Academy logo, Cisco Unity, Fast Step, Follow Me Browsing, FormShare, FrameShare, IGX, Internet

Quotient, IP/VC, iQ Breakthrough, iQ Expertise, iQ FastTrack, the iQ Logo, iQ Net Readiness Scorecard, MGX, the Networkers logo, ScriptBuilder,

ScriptShare, SMARTnet, TransPath, Voice LAN, Wavelength Router, and WebViewer are trademarks of Cisco Systems, Inc.; Changing the Way

We Work, Live, Play, and Learn, and Discover All That’s Possible are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst,

CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco

Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch,

FastHub, FastSwitch, GigaStack, IOS, IP/TV, LightStream, MICA, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX,

Registrar, SlideCast, StrataView Plus, Stratm, SwitchProbe, TeleRouter, and VCO are registered trademarks of Cisco Systems, Inc. and/or its

affiliates in the U.S. and certain other countries.

All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply

a partnership relationship between Cisco and any other company. (0110R)

Cisco Secure ACS 3.0 for Windows 2000/NT Servers User Guide

iii

Cisco Secure ACS 3.0 for Windows 2000/NT Servers User Guide

78-13751-01, Version 3.0

CONTENTS

Preface xxvii

Document Objectives xxvii

Who Should Read This Guide xxvii

How This Guide is Organized xxviii

Conventions Used in This Guide xxx

Related Documentation xxxi

Obtaining Documentation xxxii

World Wide Web xxxii

Documentation CD-ROM xxxii

Ordering Documentation xxxii

Documentation Feedback xxxiii

Obtaining Technical Assistance xxxiii

Cisco.com xxxiii

Technical Assistance Center xxxiv

Cisco TAC Web Site xxxiv

Cisco TAC Escalation Center xxxv

CHAPTER

1Overview of Cisco Secure ACS 1-1

The Cisco Secure ACS Paradigm 1-1

Cisco Secure ACS Specifications 1-2

System Performance Specifications 1-3

Cisco Secure ACS Windows Services 1-3

Contents

Cisco Secure ACS 3.0 for Windows 2000/NT Servers User Guide 78-13751-01, Version 3.0

AAA Server Functions and Concepts 1-4

Cisco Secure ACS and the AAA Client 1-5

AAA Protocols—TACACS+ and RADIUS 1-5

TACACS+ 1-6

RADIUS 1-6

Authentication 1-7

Authentication Considerations 1-8

Authentication and User Databases 1-8

Passwords 1-10

Other Authentication-Related Features 1-14

Authorization 1-15

Max Sessions 1-16

Dynamic Usage Quotas 1-16

Other Authorization-Related Features 1-17

Accounting 1-17

Other Accounting-Related Features 1-18

Administration 1-18

HTTP Port Allocation for Remote Administrative Sessions 1-19

Network Device Groups 1-20

Other Administration-Related Features 1-20

Cisco Secure ACS HTML Interface 1-21

About the Cisco Secure ACS HTML Interface 1-21

HTML Interface Layout 1-22

Uniform Resource Locator for the HTML Interface 1-24

Network Environments and Remote Administrative Sessions 1-24

Remote Administrative Sessions and HTTP Proxy 1-24

Remote Administrative Sessions through Firewalls 1-25

Cisco Secure ACS 3.0 for Windows 2000/NT Servers User Guide

78-13751-01, Version 3.0

Contents

Remote Administrative Sessions through a NAT Gateway 1-25

Accessing the HTML Interface 1-26

Logging Off the HTML Interface 1-26

Online Help and Online Documentation 1-27

Using Online Help 1-27

Using the Online Documentation 1-28

CHAPTER

2Deploying Cisco Secure ACS 2-1

Basic Deployment Requirements for Cisco Secure ACS 2-2

System Requirements 2-2

Hardware Requirements 2-2

Operating System Requirements 2-3

Third-Party Software Requirements 2-3

Network Requirements 2-4

Basic Deployment Factors for Cisco Secure ACS 2-4

Network Topology 2-5

Dial-Up Topology 2-5

Wireless Network 2-8

Remote Access using VPN 2-11

Remote Access Policy 2-13

Security Policy 2-14

Administrative Access Policy 2-14

Separation of Administrative and General Users 2-16

Database 2-17

Number of Users 2-17

Type of Database 2-17

Contents

Cisco Secure ACS 3.0 for Windows 2000/NT Servers User Guide 78-13751-01, Version 3.0

Network Speed and Reliability 2-18

Suggested Deployment Sequence 2-18

CHAPTER

3Setting Up the Cisco Secure ACS HTML Interface 3-1

Interface Design Concepts 3-2

User-to-Group Relationship 3-2

Per-User or Per-Group Features 3-2

User Data Configuration Options 3-3

Defining New User Data Fields 3-3

Advanced Options 3-4

Setting Advanced Options for the Cisco Secure ACS User Interface 3-6

Protocol Configuration Options for TACACS+ 3-7

Setting Options for TACACS+ 3-9

Protocol Configuration Options for RADIUS 3-10

Setting Protocol Configuration Options for (IETF) RADIUS 3-12

Setting Protocol Configuration Options for RADIUS (Cisco IOS/PIX) 3-14

Setting Protocol Configuration Options for RADIUS (Ascend) 3-14

Setting Protocol Configuration Options for RADIUS (Cisco VPN 3000) 3-15

Setting Protocol Configuration Options for RADIUS (Cisco VPN 5000) 3-16

Setting Protocol Configuration Options for RADIUS (Microsoft) 3-17

Setting Protocol Configuration Options for RADIUS (Nortel) 3-18

Setting Protocol Configuration Options for RADIUS (Juniper) 3-19

Setting Protocol Configuration Options for RADIUS (Cisco BBSM) 3-20

CHAPTER

4Setting Up and Managing Network Configuration 4-1

About Distributed Systems 4-2

AAA Servers in Distributed Systems 4-3

vii

Cisco Secure ACS 3.0 for Windows 2000/NT Servers User Guide

78-13751-01, Version 3.0

Contents

Default Distributed System Settings 4-3

Proxy in Distributed Systems 4-4

Fallback on Failed Connection 4-5

Character String 4-6

Stripping 4-6

Proxy in an Enterprise 4-6

Remote Use of Accounting Packets 4-7

Other Features Enabled by System Distribution 4-8

AAA Client Configuration 4-8

Adding and Configuring a AAA Client 4-9

Editing an Existing AAA Client 4-12

Deleting a AAA Client 4-14

AAA Server Configuration 4-15

Adding and Configuring a AAA Server 4-16

Editing a AAA Server Configuration 4-18

Deleting a AAA Server 4-20

Network Device Group Configuration 4-20

Adding a Network Device Group 4-21

Assigning an Unassigned AAA Client or AAA Server to an NDG 4-22

Reassigning a AAA Client or AAA Server to an NDG 4-23

Renaming a Network Device Group 4-23

Deleting a Network Device Group 4-24

Proxy Distribution Table Configuration 4-25

About the Proxy Distribution Table 4-25

Adding a New Proxy Distribution Table Entry 4-26

Sorting the Character String Match Order of Distribution Entries 4-28

Contents

viii

Cisco Secure ACS 3.0 for Windows 2000/NT Servers User Guide 78-13751-01, Version 3.0

Editing a Proxy Distribution Table Entry 4-28

Deleting a Proxy Distribution Table Entry 4-29

CHAPTER

5Setting Up and Managing Shared Profile Components 5-1

Downloadable PIX ACLs 5-2

About Downloadable PIX ACLs 5-2

Downloadable PIX ACL Configuration 5-3

Adding a Downloadable PIX ACL 5-3

Editing a Downloadable PIX ACL 5-4

Deleting a Downloadable PIX ACL 5-5

Network Access Restrictions 5-6

About Network Access Restrictions 5-6

Shared Network Access Restrictions Configuration 5-7

Adding a Shared Network Access Restriction 5-8

Editing a Shared Network Access Restriction 5-10

Deleting a Shared Network Access Restriction 5-12

Command Authorization Sets 5-12

About Command Authorization Sets 5-13

About Pattern Matching 5-14

Command Authorization Sets Configuration 5-14

Adding a Command Authorization Set 5-15

Editing a Command Authorization Set 5-17

Deleting a Command Authorization Set 5-17

CHAPTER

6Setting Up and Managing User Groups 6-1

User Group Setup Features and Functions 6-2

Default Group 6-2

Cisco Secure ACS 3.0 for Windows 2000/NT Servers User Guide

78-13751-01, Version 3.0

Contents

Group TACACS+ Settings 6-2

Common User Group Settings 6-3

Enabling VoIP Support for a User Group 6-4

Setting Default Time of Day Access for a User Group 6-5

Setting Callback Options for a User Group 6-6

Setting Network Access Restrictions for a User Group 6-7

Setting Max Sessions for a User Group 6-11

Setting Usage Quotas for a User Group 6-13

Configuration-specific User Group Settings 6-15

Setting Token Card Settings for a User Group 6-17

Setting Enable Privilege Options for a User Group 6-18

Enabling Password Aging for the CiscoSecure User Database 6-20

Varieties of Password Aging Supported by Cisco SecureACS 6-20

Password Aging Feature Settings 6-21

Enabling Password Aging for Users in Windows Databases 6-25

Setting IP Address Assignment Method for a User Group 6-26

Assigning a Downloadable PIX ACL to a Group 6-27

Configuring TACACS+ Settings for a User Group 6-28

Configuring a Shell Command Authorization Set for a User Group 6-30

Configuring a PIX Command Authorization Set for a User Group 6-32

Configuring IETF RADIUS Settings for a User Group 6-34

Configuring Cisco IOS/PIX RADIUS Settings for a User Group 6-36

Configuring Ascend RADIUS Settings for a User Group 6-37

Configuring Cisco VPN 3000 Concentrator RADIUS Settings for a User

Group 6-38

Configuring Cisco VPN 5000 Concentrator RADIUS Settings for a User

Group 6-39

Contents

Cisco Secure ACS 3.0 for Windows 2000/NT Servers User Guide 78-13751-01, Version 3.0

Configuring Microsoft RADIUS Settings for a User Group 6-41

Configuring Nortel RADIUS Settings for a User Group 6-42

Configuring Juniper RADIUS Settings for a User Group 6-44

Configuring Cisco BBSM RADIUS Settings for a User Group 6-45

Configuring Custom RADIUS VSA Settings for a User Group 6-46

Group Setting Management 6-48

Listing Users in a User Group 6-48

Resetting Usage Quota Counters for a User Group 6-49

Renaming a User Group 6-49

Saving Changes to User Group Settings 6-50

CHAPTER

7Setting Up and Managing User Accounts 7-1

User Setup Features and Functions 7-2

About User Databases 7-3

Basic User Setup Options 7-4

Adding a Basic User Account 7-5

Setting Supplementary User Information 7-7

Setting a Separate CHAP/MS-CHAP/ARAP Password 7-8

Assigning a User to a Group 7-9

Setting User Callback Option 7-10

Assigning a User to a Client IP Address 7-11

Setting Network Access Restrictions for a User 7-12

Setting Max Sessions Options for a User 7-17

Setting User Usage Quotas Options 7-19

Setting Options for User Account Disablement 7-21

Assigning a PIX ACL to a User 7-22

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali Cisco Software

Cisco

Cisco AP775A - Nexus Converged Network Switch 5010 Manuale di servizio

Cisco

Cisco Voice Interworking Services (VISM) Manuale dell'operatore

Cisco

Cisco Digital Media System 3.5 Manuale di istruzioni

Cisco

Cisco WS-SUP32-GE-3B - Supervisor Engine 32 Manuale utente

Cisco

Cisco MCS 7825 Series Manuale utente

Cisco

Cisco OL-5490-01 Manuale utente

Cisco

Cisco ACTIVE NETWORK ABSTRACTION - BROCHURE WHATS NEW IN RELEASE... Manuale utente

Cisco

Cisco Catalyst Series Switch 2940 Manuale utente

Cisco

Cisco Unified Contact Center Express Manuale utente

Cisco

Cisco Surveillance Media Server Manuale di istruzioni

Cisco

Cisco C8510-CHAS5-RF - Catalyst 8510 Campus Switch Router Modular Expansion... Istruzioni per l'installazione e il funzionamento

Cisco

Cisco IP Communicator Manuale utente

Cisco

Cisco III - Supervisor Engine III Manuale utente

Cisco

Cisco SMTP Manuale di istruzioni

Cisco

Cisco TrustSec 3.0 Come usare

Cisco

Cisco CCNA NETWORK SIMULATOR Manuale utente

Cisco

Cisco Unified Videoconferencing Manager Manuale utente

Cisco

Cisco Unified MeetingPlace H.323/SIP Manuale di servizio

Cisco

Cisco 1811W - Integrated Services Router Wireless Manuale di istruzioni

Cisco

Cisco Network Assistant Manuale utente

Cisco

Cisco TELEPRESENCE MANAGEMENT SUITE EXTENSION - INSTALLATION GUIDE FOR IBM LOTUS NOTES... Manuale utente

Cisco

Cisco ROUTER-SDM-CD Manuale utente

Cisco

Cisco CONFERENCING EXTENSIONS - ADMINISTRATOR GUIDE FOR MICROSOFT... Manuale di servizio

Cisco

Cisco OL-10426-01 Manuale utente

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

HP ProLiant BL420c Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuale utente

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente