Cisco 2509 - Router - EN Manuel utilisateur

Corporate Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 526-4100

User Guide for Cisco Secure ACS

for Windows Server

Customer Order Number: DOC-7814696=

Text Part Number: 78-14696-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT

NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT

ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR

THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION

PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO

LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE

PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED

OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL

DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR

INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH

DAMAGES.

User Guide for Cisco Secure ACS for Windows Server

CCIP, the Cisco Arrow logo, the Cisco Powered Network mark, the Cisco SystemsVerified logo, Cisco Unity, Follow Me Browsing, FormShare, Internet

Quotient, iQ Breakthrough, iQ Expertise, iQ FastTrack, the iQ Logo, iQ Net Readiness Scorecard, Networking Academy, ScriptShare, SMARTnet,

TransPath, and Voice LAN are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, Discover All That’s Possible, The

Fastest Way to IncreaseYour Internet Quotient, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA,

CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco

Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack,

IOS, IP/TV, LightStream, MGX, MICA, the Networkers logo, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar,

SlideCast, StrataView Plus, Stratm, SwitchProbe, TeleRouter, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S.

and certain other countries.

All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a

partnership relationship between Cisco and any other company. (0206R)

iii

User Guide for Cisco Secure ACS for Windows Server

78-14696-01, Version 3.1

CONTENTS

Preface xxv

Document Objective xxv

Audience xxv

Organization xxvi

Conventions xxviii

Related Documentation xxix

Obtaining Documentation xxx

World Wide Web xxx

Documentation CD-ROM xxx

Ordering Documentation xxx

Documentation Feedback xxxi

Obtaining Technical Assistance xxxi

Cisco.com xxxi

Technical Assistance Center xxxii

Cisco TAC Web Site xxxii

Cisco TAC Escalation Center xxxiii

CHAPTER

1Overview of Cisco Secure ACS 1-1

The Cisco Secure ACS Paradigm 1-1

Cisco Secure ACS Specifications 1-2

System Performance Specifications 1-3

Cisco Secure ACS Windows Services 1-4

AAA Server Functions and Concepts 1-5

Cisco Secure ACS and the AAA Client 1-5

Contents

User Guide for CiscoSecure ACS for Windows Server 78-14696-01, Version 3.1

AAA Protocols—TACACS+ and RADIUS 1-6

TACACS+ 1-6

RADIUS 1-6

Authentication 1-7

Authentication Considerations 1-8

Authentication and User Databases 1-8

Authentication Protocol-Database Compatibility 1-9

Passwords 1-10

Other Authentication-Related Features 1-15

Authorization 1-15

Max Sessions 1-16

Dynamic Usage Quotas 1-17

Shared Profile Components 1-17

Support for Cisco Device-Management Applications 1-18

Other Authorization-RelatedFeatures 1-19

Accounting 1-20

Other Accounting-Related Features 1-20

Administration 1-21

HTTP Port Allocation for Remote Administrative Sessions 1-21

Network Device Groups 1-22

Other Administration-Related Features 1-22

Cisco Secure ACS HTML Interface 1-23

About the Cisco Secure ACS HTML Interface 1-23

HTML Interface Security 1-24

HTML Interface Layout 1-25

Uniform Resource Locatorfor the HTML Interface 1-26

Network Environments and Remote Administrative Sessions 1-27

Remote Administrative Sessions and HTTP Proxy 1-27

Remote Administrative Sessions through Firewalls 1-28

Remote Administrative Sessions through a NAT Gateway 1-28

User Guide for Cisco Secure ACS for Windows Server

78-14696-01, Version 3.1

Contents

Accessing the HTML Interface 1-29

Logging Off the HTML Interface 1-29

Online Help and Online Documentation 1-30

Using Online Help 1-30

Using the Online Documentation 1-31

CHAPTER

2Deploying Cisco Secure ACS 2-1

Basic Deployment Requirements for Cisco Secure ACS 2-2

System Requirements 2-2

Hardware Requirements 2-2

Operating System Requirements 2-2

Third-Party Software Requirements 2-3

Network Requirements 2-4

Basic Deployment Factors for Cisco Secure ACS 2-5

Network Topology 2-5

Dial-Up Topology 2-5

Wireless Network 2-8

Remote Access using VPN 2-11

Remote Access Policy 2-13

Security Policy 2-14

Administrative Access Policy 2-14

Separation ofAdministrative and General Users 2-16

Database 2-17

Number of Users 2-17

Type of Database 2-17

Network Latency and Reliability 2-18

Suggested Deployment Sequence 2-18

Contents

User Guide for CiscoSecure ACS for Windows Server 78-14696-01, Version 3.1

CHAPTER

3Setting Up the Cisco Secure ACS HTML Interface 3-1

Interface Design Concepts 3-2

User-to-Group Relationship 3-2

Per-User or Per-Group Features 3-2

User Data Configuration Options 3-3

Defining New User Data Fields 3-3

Advanced Options 3-4

Setting Advanced Options for the Cisco Secure ACS User Interface 3-6

Protocol Configuration Options for TACACS+ 3-7

Setting Options for TACACS+ 3-9

Protocol Configuration Options for RADIUS 3-10

Setting Protocol Configuration Options for IETF RADIUS Attributes 3-15

SettingProtocolConfigurationOptionsforNon-IETFRADIUSAttributes 3-16

CHAPTER

4Setting Up and Managing Network Configuration 4-1

AboutNetwork Configuration 4-2

AboutDistributed Systems 4-3

AAA Servers in Distributed Systems 4-3

Default Distributed System Settings 4-4

Proxy in Distributed Systems 4-4

Fallback on Failed Connection 4-6

Character String 4-6

Stripping 4-6

Proxy in an Enterprise 4-7

Remote Use of Accounting Packets 4-7

Other Features Enabled bySystem Distribution 4-8

Network Device Searches 4-8

Network Device Search Criteria 4-9

Searching for Network Devices 4-10

vii

User Guide for Cisco Secure ACS for Windows Server

78-14696-01, Version 3.1

Contents

AAA ClientConfiguration 4-11

AAA ClientConfiguration Options 4-11

Adding a AAA Client 4-15

Editing a AAA Client 4-18

Deleting a AAA Client 4-19

AAA Server Configuration 4-20

AAA Server Configuration Options 4-21

Adding a AAA Server 4-23

Editing a AAA Server 4-25

Deleting a AAA Server 4-27

Network Device Group Configuration 4-27

Adding a Network Device Group 4-28

Assigning an Unassigned AAA Client or AAA Server to an NDG 4-29

Reassigning a AAA Client or AAA Server to an NDG 4-30

Renaming a Network Device Group 4-31

Deleting a Network Device Group 4-31

Proxy Distribution Table Configuration 4-32

Aboutthe Proxy Distribution Table 4-32

Adding a New Proxy Distribution Table Entry 4-33

Sorting the Character StringMatch Order of Distribution Entries 4-35

Editing a Proxy Distribution Table Entry 4-35

Deleting a Proxy Distribution Table Entry 4-36

CHAPTER

5Setting Up and Managing Shared Profile Components 5-1

AboutShared Profile Components 5-1

Downloadable PIX ACLs 5-2

AboutDownloadable PIX ACLs 5-2

Downloadable PIX ACL Configuration 5-4

Adding a Downloadable PIX ACL 5-4

Contents

viii

User Guide for CiscoSecure ACS for Windows Server 78-14696-01, Version 3.1

Editing a Downloadable PIX ACL 5-5

Deleting a Downloadable PIX ACL 5-5

Network Access Restrictions 5-6

AboutNetwork Access Restrictions 5-6

Shared Network Access Restrictions Configuration 5-8

Adding a Shared Network Access Restriction 5-9

Editing a Shared Network Access Restriction 5-11

Deleting a Shared Network Access Restriction 5-13

Command Authorization Sets 5-13

AboutCommand Authorization Sets 5-14

AboutPattern Matching 5-15

Command Authorization Sets Configuration 5-16

Adding a Command Authorization Set 5-16

Editing a Command Authorization Set 5-19

Deleting a Command Authorization Set 5-20

CHAPTER

6Setting Up and Managing UserGroups 6-1

User Group Setup Features and Functions 6-2

Default Group 6-2

Group TACACS+ Settings 6-2

Common User Group Settings 6-3

Enabling VoIP Support for a User Group 6-4

Setting Default Time-of-Day Access for a User Group 6-5

Setting Callback Options for a UserGroup 6-6

Setting Network Access Restrictions fora User Group 6-7

Setting Max Sessions for a User Group 6-11

Setting Usage Quotas for a User Group 6-13

Configuration-specific User Group Settings 6-15

Setting Token Card Settings for a User Group 6-16

User Guide for Cisco Secure ACS for Windows Server

78-14696-01, Version 3.1

Contents

Setting Enable Privilege Options for a UserGroup 6-18

Enabling Password Aging for the CiscoSecure User Database 6-20

Enabling Password Aging for Users in Windows Databases 6-25

Setting IP Address Assignment Method for a User Group 6-27

Assigning a Downloadable PIX ACL to a Group 6-28

Configuring TACACS+ Settings for a User Group 6-29

Configuring a Shell Command Authorization Set for a User Group 6-31

Configuring a PIX Command Authorization Set for a User Group 6-33

Configuring Device-Management Command Authorization for a User

Group 6-35

Configuring IETF RADIUS Settings for a User Group 6-37

Configuring Cisco IOS/PIX RADIUS Settings for a User Group 6-38

Configuring Cisco Aironet RADIUS Settings for a User Group 6-39

Configuring Ascend RADIUS Settings for a UserGroup 6-41

Configuring Cisco VPN 3000 Concentrator RADIUS Settings fora User

Group 6-42

Configuring Cisco VPN 5000 Concentrator RADIUS Settings fora User

Group 6-43

Configuring Microsoft RADIUS Settings for a User Group 6-45

Configuring Nortel RADIUS Settings for a User Group 6-46

Configuring Juniper RADIUS Settings for a User Group 6-48

Configuring BBSM RADIUS Settings for a User Group 6-49

Configuring Custom RADIUS VSA Settings for a User Group 6-50

Group Setting Management 6-51

Listing Users in a User Group 6-52

Resetting Usage Quota Counters for a User Group 6-52

Renaming a User Group 6-53

Saving Changes to User Group Settings 6-53

Contents

User Guide for CiscoSecure ACS for Windows Server 78-14696-01, Version 3.1

CHAPTER

7Setting Up and Managing UserAccounts 7-1

User Setup Features and Functions 7-2

AboutUser Databases 7-2

Basic User Setup Options 7-4

Adding a Basic User Account 7-5

Setting Supplementary User Information 7-7

Setting a Separate CHAP/MS-CHAP/ARAP Password 7-8

Assigning a Userto a Group 7-9

Setting User Callback Option 7-10

Assigning a Userto a ClientIP Address 7-11

Setting Network Access Restrictions fora User 7-12

Setting Max Sessions Options for a User 7-16

Setting User Usage Quotas Options 7-18

Setting Options for User AccountDisablement 7-20

Assigning a PIX ACL to a User 7-21

Advanced User Authentication Settings 7-22

TACACS+ Settings(User) 7-22

Configuring TACACS+ Settings for a User 7-23

Configuring a Shell Command Authorization Set for a User 7-25

Configuring a PIX Command Authorization Set for a User 7-28

Configuring Device Management Command Authorization for a User 7-30

Configuring the Unknown Service Setting for a User 7-32

Advanced TACACS+Settings (User) 7-33

Setting Enable Privilege Options for a User 7-33

Setting TACACS+ Enable Password Options for a User 7-35

Setting TACACS+ Outbound Password for a User 7-36

RADIUS Attributes 7-37

Setting IETF RADIUS Parameters for a User 7-38

Setting Cisco IOS/PIX RADIUS Parameters for a User 7-39

Setting Cisco Aironet RADIUS Parameters for a User 7-40

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Cisco Logiciel

Cisco

Cisco 6.x and 7.0 Guide de démarrage rapide

Cisco

Cisco Digital Media Player Manuel utilisateur

Cisco

Cisco Servers Manuel utilisateur

Cisco

Cisco Voice Interworking Services (VISM) Manuel de l'opérateur

Cisco

Cisco TELEPRESENCE CALL DETAIL RECORDS FILE FORMAT... Manuel utilisateur

Cisco

Cisco Router IOS XR Manuel utilisateur

Cisco

Cisco OL-11757-01 Mode d’emploi

Cisco

Cisco XO Manuel utilisateur

Cisco

Cisco ASA5500-SC-5= - ASA 5500 Security Context Manuel utilisateur

Cisco

Cisco CCNA NETWORK SIMULATOR Manuel utilisateur

Cisco

Cisco GO GREEN Manuel utilisateur

Cisco

Cisco TELEPRESENCE MOVI 4.1 - FOR MAC OS X Manuel utilisateur

Cisco

Cisco III - Supervisor Engine III Manuel utilisateur

Cisco

Cisco OL-10426-01 Manuel utilisateur

Cisco

Cisco ONS 15327 Manuel utilisateur

Cisco

Cisco CRS-1 Series Manuel utilisateur

Cisco

Cisco IP Communicator Mode d’emploi

Cisco

Cisco TMS SQL DATABASE Manuel utilisateur

Cisco

Cisco TELEPRESENCE MANAGEMENT SUITE EXTENSION 2.2 - FOR MICROSOFT... Manuel de service

Cisco

Cisco 1701 Mode d’emploi

Cisco

Cisco 15454-TCC - Network Processor Card Manuel utilisateur

Cisco

Cisco MeetingPlace Video Integration Manuel de service

Cisco

Cisco TELEPRESENCE MANAGEMENT SUITE EXTENSION 2.2 - FOR MICROSOFT... Manuel utilisateur

Cisco

Cisco TMS SERVER REDUNDANCY - CONFIGURATION GUIDE... Manuel utilisateur

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuel utilisateur

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur