Configuration Guide for Cisco Secure ACS 4.2
Overview of ACS Configuration
Downloads: This chapterpdf (PDF - 112.0KB) The complete bookPDF (PDF - 4.32MB) | Feedback

Overview of ACS Configuration

Table Of Contents

Overview of ACS Configuration

Summary of Configuration Steps

Configuration Flowchart


Overview of ACS Configuration


This chapter describes the general steps for configuring Cisco Secure Access Control Server, hereafter referred to as ACS, and presents a flowchart showing the sequence of steps.


Note If you are configuring ACS to work with Microsoft clients in a Cisco Network Access Control/Microsoft Network Access Protection (NAC/NAP) network, refer to Chapter 9 "NAC Configuration Scenario."


This chapter contains:

Summary of Configuration Steps

Configuration Flowchart

Summary of Configuration Steps

To configure ACS:


Step 1 Plan the ACS Deployment.

Determine how many ACS servers you need and their placement in the network.

For detailed information, see Chapter 2 "Deploy the Access Control Servers."

Step 2 Install the ACS Servers.

Install the ACS servers as required. For detailed installation instructions, refer to:

Installation Guide for Cisco Secure ACS for Windows Release 4.2, available on Cisco.com at:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/
4.2/installation/guide/windows/IGwn42.html

Installation Guide for Cisco Secure ACS Solution Engine Release 4.2, available on Cisco.com at:

http://www.cisco.com/en/US/docs/net_mgmt/
cisco_secure_access_control_server_for_solution_engine/4.2/installation/guide/solution_engine/
SE42.html

Step 3 Configure Additional Administrators.

When you install the Windows version of ACS, there are initially no administrative users. When you install Cisco Secure ACS Solution Engine (ACS SE), there is initially one administrator.

To set up additional administrative accounts:

a. Add Administrators.

b. For each administrator, specify administrator privileges.

c. As needed, configure the following optional administrative policies:

Access Policy—Specify IP address limitations, HTTP port restrictions, and secure socket layer (SSL) setup.

Session Policy—Specify timeouts, automatic local logins, and response to invalid IP address connections.

Password Policy—Configure the password policy for administrators.

For detailed information, see Chapter 5 "Password Policy Configuration Scenario."

Step 4 Configure the Web Interface:

a. Add AAA clients and specify the authorization protocols that the clients will use.

b. Click Interface Configuration.

c. On the Interface Configuration page, configure the interface to include one or more of:

RADIUS Configuration Options—For detailed information, see "Displaying RADIUS Configuration Options" in Chapter 2 of the User Guide for Cisco Secure ACS 4.2, "Using the Web Interface."

TACACS+ Configuration Options—For detailed information, see "Displaying TACACS+ Configuration Options" in Chapter 2 of the User Guide for Cisco Secure ACS 4.2, "Using the Web Interface."

Advanced Options—For detailed information, see "Displaying RADIUS Configuration Options" in Chapter 2 of the User Guide for Cisco Secure ACS 4.2, "Using the Web Interface."

Customized User Options—For detailed information, see "Displaying RADIUS Configuration Options" in Chapter 2 of the User Guide for Cisco Secure ACS 4.2, "Using the Web Interface."

Step 5 Configure Basic ACS System Settings:

a. Click System Configuration.

b. Configure:

Service Control

Logging

Date Format Control

Local Password Management

ACS Backup

ACS Restore

ACS Service Management

(optional) IP Pools Server

(optional) IP Pools Address Recovery

For detailed instructions, see "Displaying RADIUS Configuration Options" in Chapter 2 of the User Guide for Cisco Secure ACS 4.2, "Using the Web Interface."

Step 6 Configure Users:

a. As required for your network security setup, configure users. You can configure users:

Manually, by using the ACS web interface

By using the CSUtil utility to import users from an external database

By using database synchronization

By using database replication

For detailed instructions, see "Displaying RADIUS Configuration Options" in Chapter 2 of the User Guide for Cisco Secure ACS 4.2, "Using the Web Interface."

Step 7 Configure Certificates.

This step is required if you are using EAP-TLS, Secure Sockets Layer (SSL), or Cisco Network Admission Control (NAC).

For detailed instructions, see Step 3: Install and Set Up an ACS Security Certificate.

Step 8 Configure Global Authentication Settings.

Configure the security protocols that ACS uses to authenticate users. You can configure the following global authentication methods:

PEAP

EAP-FAST

EAP-TLS

LEAP

EAP-MD5

Legacy authentication protocols, such as MS-CHAP Version 1 and Version 2

For detailed instructions, see "Global Authentication Setup" in Chapter 8 of the User Guide for Cisco Secure ACS 4.2, "System Configuration: Authentication and Certificates."

Step 9 Configure Shared Profile Components.

You can configure the following shared profile components:

Downloadable IP ACLs

Network Access Filtering

RADIUS Authorization Components

Network Access Restrictions

Command Authorization Sets

For detailed instructions, see Chapter 3 of the User Guide for Cisco Secure ACS 4.2, "Shared Profile Components."

Step 10 Set Up Network Device Groups.

You can set up network device groups to simplify configuration of common devices. For detailed information, see the User Guide for Cisco Secure ACS 4.2.

Step 11 Add AAA clients.

You can add RADIUS clients or TACACS+ clients. For detailed instructions, see Step 2: Configure a RADIUS AAA Client.

Step 12 Set Up User Groups.

Set up user groups to apply common configuration settings to groups of users. For detailed instructions, see Chapter 2 of the User Guide for Cisco Secure ACS 4.2, "User Group Management."

Step 13 Configure Posture Validation.

If you are using ACS with NAC, configure posture validation.

Step 14 Set Up Network Access Profiles.

If required, set up Network Access Profiles.

Step 15 Configure Logs and Reports.

Configure reports to specify how ACS logs data. You can also view the logs in HTML reports. For detailed instructions, see Chapter 9 of the User Guide for Cisco Secure ACS 4.2, "Logs and Reports.


Configuration Flowchart

Figure 1-1 is a configuration flowchart that shows the main steps in ACS configuration.

Figure 1-1 ACS Configuration Flowchart

Refer to the list of steps in Summary of Configuration Steps for information on where to find detailed descriptions of each step.