User Guide for Cisco Secure Access Control System 5.2
Understanding My Workspace
Downloads: This chapterpdf (PDF - 1.32MB) The complete bookPDF (PDF - 17.78MB) | Feedback

Understanding My Workspace

Table Of Contents

Understanding My Workspace

Welcome Page

Task Guides

My Account Page

Using the Web Interface

Accessing the Web Interface

Logging In

Logging Out

Understanding the Web Interface

Web Interface Design

Navigation Pane

Content Area

Importing and Exporting ACS Objects through the Web Interface

Supported ACS Objects

Creating Import Files

Downloading the Template from the Web Interface

Understanding the CSV Templates

Creating the Import File

Common Errors

Concurrency Conflict Errors

Deletion Errors

System Failure Errors

Accessibility

Display and Readability Features

Keyboard and Mouse Features

Obtaining Additional Accessibility Information


Understanding My Workspace


The Cisco Secure ACS web interface is designed to be viewed using Microsoft Internet Explorer 6.x, 7.x, and 8.x, and Mozilla Firefox 3.x. The web interface not only makes viewing and administering ACS possible, but it also allows you to monitor and report on any event in the network.

These reports track connection activity, show which users are currently logged in, list the failed authentication and authorization attempts, and so on.

The My Workspace drawer contains:

Welcome Page

Task Guides

My Account Page

Using the Web Interface

Importing and Exporting ACS Objects through the Web Interface

Common Errors

Accessibility

Welcome Page

The Welcome page appears when you start ACS, and provides shortcuts to common ACS tasks, and links to information.

You can return to the Welcome page at any time during your ACS session. To return to this page, choose My Workspace > Welcome.

Table 5-1 Welcome Page 

Field
Description

Before You Begin

This section contains a link to a section that describes the ACS policy model and associated terminology.

Getting Started

The links in this section launch the ACS Task Guides, which provide step-by-step instructions on how to accomplish ACS tasks.

Quick Start

Opens the Task Guide for the Quick Start scenario. These steps guide you through a minimal system setup to get ACS going quickly in a lab, evaluation, or demonstration environment.

Initial System Setup

Opens the Task Guide for initial system setup. This scenario guides you through the steps that are required to set up ACS for operation as needed; many steps are optional.

Policy Setup Steps

Opens the Task Guide for policy setup. This scenario guides you through the steps that are required to set up ACS policies.

New in ACS 5

The options in this section link to topics in the ACS online help. Click an option to open the online help window, which displays information for the selected topic.

Use the links in the online help topics and in the Contents pane of the online help to view more information about ACS features and tasks.

Tutorials & Other Resources

Provides links to:

Introduction Overview video.

Configuration guide that provides step-by-step instructions for common ACS scenarios.


Task Guides

From the My Workspace drawer, you can access Tasks Guides. When you click any of the tasks, it opens a frame on the right side of the web interface. This frame contains step-by-step instructions as well as links to additional information. ACS provides the following task guides:

Quick Start—Lists the minimal steps required to get ACS up and running quickly.

Initial System Setup—Lists the required steps to set up ACS for basic operations, including information about optional steps.

Policy Setup Steps—Lists the required steps to define ACS access control policies.

My Account Page


Note Every ACS administrator account is assigned one or more administrative roles. Depending upon the roles assigned to your account, you may or may not be able to perform the operations or see the options described in certain procedures. See Configuring System Administrators and Accounts to configure the appropriate administrator privileges.


Use the My Account page to update and change the administrator password for the administrator that is currently logged in to ACS.

To display this page, select My Workspace > My Account.

Table 5-2 My Account Page 

Field
Description

General

Read-only fields that display information about the currently logged-in administrator:

Administrator name

Description

E-mail address, if it is available

Change Password

Displays rules for password definition according to the password policy.

To change your password:

1. In the Password field, enter your current password.

2. In the New Password field, enter a new password.

3. In the Confirm Password field, enter your new password again.

Assigned Roles

Displays the roles that are assigned to the currently logged-in administrator.


Related Topics

Configuring Authentication Settings for Administrators

Changing the Administrator Password

Using the Web Interface

You can configure and administer ACS through the ACS web interface, in which you can access pages, perform configuration tasks, and view interface configuration errors. This section describes:

Accessing the Web Interface

Understanding the Web Interface

Common Errors

Accessibility

Accessing the Web Interface

The ACS web interface is supported on HTTPS-enabled Microsoft Internet Explorer versions 6.x, 7.x, and 8.x, and Firefox version 3.x.

This section contains:

Logging In

Logging Out

Logging In

To log in to the ACS web interface for the first time after installation:


Step 1 Enter the ACS URL in your browser, for example https://acs_host/acsadmin, where /acs_host is the IP address or Domain Name System (DNS) hostname.

The login page appears.

Step 2 Enter ACSAdmin in the Username field; the value is not case-sensitive.

Step 3 Enter default in the Password field; the value is case-sensitive.

This password (default) is valid only when you log in for the first time after installation. Click Reset to clear the Username and Password fields and start over, if needed.

Step 4 Click Login or press Enter.

The login page reappears, prompting you to change your password.

ACS prompts you to change your password the first time you log in to the web interface after installation and in other situations based on the authentication settings that is configured in ACS.

Step 5 Enter default in the Old Password field, then enter a new password in the New Password and the Confirm Password fields.

If you forget your username or password, use the acs reset-password command to reset your username to ACSAdmin and your password to default. You are prompted to change your password after a reset. See Command Line Reference for ACS 5.2 for more information.

Step 6 Click Login or press Enter.

You are prompted to install a valid license:


Note The license page only appears the first time that you log in to ACS.


Step 7 See Installing a License File to install a valid license.

If your login is successful, the main page of the ACS web interface appears.

If your login is unsuccessful, the following error message appears:

Invalid username or password specified.

The Username and Password fields are cleared.

Step 8 Re-enter the valid username and password, and click Login.


Logging Out

Click Logout in the ACS web interface header to end your administrative session. A dialog box appears asking if you are sure you want to log out of ACS. Click OK.


Caution For security reasons, Cisco recommends that you log out of the ACS when you complete your administrative session. If you do not log out, the ACS web interface logs you out if your session remains inactive for a configurable period of time, and does not save any unsubmitted configuration data. See Configuring Session Idle Timeout for configuring session idle timeout.

Understanding the Web Interface

The following sections explain the ACS web interface:

Web Interface Design

Header

Navigation Pane

Content Area

Web Interface Design

Figure 5-1 shows the overall design of the ACS web interface.

Figure 5-1 ACS Web Interface

The interface contains:

Header

Navigation Pane

Content Area

Header

Use the header to:

Identify the current user (your username)

Access the online help

Log out

Access the About information, where you can find information about which ACS web interface version is installed.

These items appear on the right side of the header (see Figure 5-2).

Figure 5-2 Header

Related Topics

Navigation Pane

Content Area

Navigation Pane

Use the navigation pane to navigate through the drawers of the web interface (see Figure 5-3).

Figure 5-3 Navigation Pane

Table 5-3 describes the function of each drawer.

Table 5-3 Navigation Pane Drawers  

Drawer
Function

My Workspace

Access the Task Guide and Welcome page with shortcuts to common tasks and links to more information. See Chapter 5 "Understanding My Workspace" for more information.

Network Resources

Configure network devices, AAA clients, and network device groups. See Chapter 7 "Managing Network Resources" for more information.

Users and Identity Stores

Configure internal users and identity stores. See Chapter 8 "Managing Users and Identity Stores" for more information.

Policy Elements

Configure policy conditions and results. See Chapter 9 "Managing Policy Elements" for more information.

Access Policies

Configure access policies. See Chapter 10 "Managing Access Policies" for more information.

Monitoring and Reports

View log messages. See Chapter 11 "Monitoring and Reporting in ACS" for more information.

System Administration

Administer and maintain your ACS. See Chapter 16 "Managing System Administrators" for more information.


To open a drawer, click it. A list of options for that drawer appears. You can view the contents of only one drawer at a time. When you open a drawer, any previously open drawer automatically closes. Click an option to view the hierarchy of items and the current configuration, and perform configuration tasks associated with that option in the content area. See Content Area for more information about the content area.

To hide the navigation pane and expand the content area, click the collapse arrow, which is centered vertically between the navigation pane and content area. Click the collapse arrow again to reveal the navigation pane.

The options listed beneath drawers in the navigation pane are organized in a tree structure, where appropriate. The options in the tree structure are dynamic and can change based on administrator actions. Creating, deleting, or renaming objects in the content area can change the option display in the navigation pane.

For example, beneath the Network Resources > Network Device Groups option, there are two preconfigured network device groups (options)—Location and Device Type.

Figure 5-4 shows that the administrator has used the Network Device Groups option page to create an additional network device group called Business, which appears in the tree structure in the navigation pane.

Figure 5-4 Navigation Pane—Dynamic Tree Structure

Related Topics

Header

Content Area

Content Area

Use the content area to view your current location in the interface, view your configuration, configure AAA services, and administer your ACS.

The content area can contain:

Web Interface Location

List Pages

Secondary Windows

Rule Table Pages

Web Interface Location

Your current location in the interface appears at the top of the content area. Figure 5-5 shows that the location is the Policy Elements drawer and the Network Devices and AAA Clients page.

Using this location as an example, ACS documentation uses this convention to indicate interface locations—Policy Elements > Policy Conditions > Network Devices and AAA Clients > Location. The remainder of the content area shows the content of the chosen page.

The interface location also displays the action that you are configuring. For example, if you are in the Users and Identity Stores > Internal Identity Stores > Users page and you attempt to duplicate a specific user, the interface location is stated as:

Users and Identity Stores > Internal Identity Stores > Users > Duplicate: user_name, where user_name is the name of the user you chose to duplicate. ACS documentation also uses this convention.

List Pages

List pages contain a list of items (see Figure 5-5).

You can use list pages to delete one or more items from an option that you chose in the navigation pane.

Figure 5-5 List Page

Table 5-4 describes the content area buttons and fields that list pages have in common.

Table 5-4 Common Content Area Buttons and Fields for List Pages 

Button or Field
Description

Rows per page

Use the drop-down list to specify the number of items to display on this page. Options:

10—Up to 10.

25—Up to 25.

50—Up to 50.

100—Up to 100.

Go

Click to display the number of items you specify in the Rows per page field.

Check box or radio button

Chooses or does not choose items in a list, for edit, duplicate, or delete actions. Options:

Check (a check box) or click (a radio button)—Chooses an item.

Check the check box in the header row to choose all items in the list. Check the individual check boxes to choose specific items in the list.

Uncheck (a check box) or unclick (a radio button)—Does not choose an item.

List column

A tabular or hierarchical view of items associated with a specific configuration task. Figure 5-5 shows the list column as a list of configured network device names; the heading of this list column is Name.

Scroll bar

Use the content area scroll bar to view all the data in a page, if needed.

Create

Click to create a new item. A wizard or single page appears in the content area.

When you click Create, any selections that you made in the content area are ignored and the content area displays an Edit page with page-specific default values, if any.

Duplicate

Click to duplicate a selected item. A single page or a tabbed page appears in the content area.

Edit

Click to edit a selected item. A single page or a tabbed page appears in the content area.

Delete

Click to delete one or more selected items. A dialog box that queries Are you sure you want to delete item/items? appears for the item, or items, you chose to delete. The confirmation dialog box contains OK and Cancel. Click:

OK—Deletes the selected item or items. The list page appears without the deleted item.

Cancel—Cancels the delete operation. The list page appears with no changes.

You can only delete items that you can view on a page, including the content of a page that you can view by using the scroll bar.

For tables that span more than one page, your selections of rows to delete for pages that you cannot view are ignored and those selections are not deleted.

Page num of n

Enter the number of the page you want to display in the content area of the list page, where num is the page you want to display, then click Go.

Not available for tree table pages.

Direction arrows

Click the arrows on the lower right side of the content area to access the first page, previous page, next page, or last page. The arrows are active when required.

Not available for tree table pages.


Tree table pages are a variation of list pages (see Figure 5-6). You can perform the same operations on tree table pages that you can on list pages, except for paging. In addition, with tree table pages:

A darker background color in a row indicates the top level of a tree.

If the first folder of a tree contains fewer than 50 items, the first folder is expanded and all others are collapsed. You must use the expanding icon (+) to view the contents of the collapsed folders.

If the first folder of a tree contains 50 or more items, all folders in the tree are collapsed. You must click the expanding icon (+) to view the contents of the folders.

If you check the check box for a folder (a parent), it chooses all children of that folder.

If you check the check box of a folder (a parent), and then uncheck any of the children, the parent folder is unchecked automatically.

Figure 5-6 Tree Table Page

Filtering

Large lists in a content area window or a secondary window (see Figure 5-9) can be difficult to navigate through and select the data that you want. You can use the web interface to filter data in these windows to reduce the data that appears in a list, based on criteria and conditions that you choose. Table 5-5 describes the filtering options.


Note Not all filtering options are available in all fields.


Table 5-5 Filtering in the Content Area Window and Secondary Windows 

Button or Field
Description

Filter (drop-down list box)

Select the name of the column from the drop-down list box on which to filter.

Match if (drop-down list box)

Select the condition you want to apply to your filter action:

Contains

Doesn't Contain

Ends With

Equals

Is Empty

Not Empty

Not Equals

Starts With

The condition is applied to the column you select in the Filter drop-down list box.

v (down arrow)

Click to add an additional filter row on which to choose conditions to narrow or expand your filter action. The text And: precedes the additional filter row.

^ (up arrow)

Click to remove an extraneous filter row.

Go

Click to execute your filter action.

Clear Filter

Click to clear any current filter options.

OK

Click to add the selected data to your configuration and close the secondary window.

This button is only available in secondary windows (see Figure 5-9).



Note For tree table pages, you can only perform filtering on a root node, the top-most parent.


Sorting

Most nontree list pages support sorting by the Name column or the Description column, when available. You can sort pages in an ascending or descending manner.

For pages that do not have a Name or Description column, the sorting mechanism may be supported in the left-most column of the page, or the Description column. Place your cursor over a column heading to determine if sorting is available for a column. If sorting is available, the cursor turns into a hand and the text Click to sort appears.

When a table is sorted, the column heading text darkens and an up arrow or down arrow appears next to the text (see Figure 5-7). Click the arrow to resort in the opposing manner.

Figure 5-7 Sorting Example

Secondary Windows

The content area serves as the launching place for any secondary (popup) windows that you access by clicking Select (see Figure 5-8) from single, tabbed, or wizard pages. You use these secondary windows to filter and select data that you want to use in your configuration (see Figure 5-9 and Table 5-5).

You can select one or more items from a secondary window to include in your configuration, dependent upon the selection option.

Items listed in a secondary window with radio buttons allow you to select one item to include in your configuration and items listed with check boxes allow you to select multiple items.

Figure 5-8 Select Button—Accesses Secondary Windows

Figure 5-9 Secondary Window

In addition to selecting and filtering data, you can create a selectable object within a secondary window.

For example, if you attempt to create a users internal identity store, and click Select to assign the store to an identity group (a selectable object), but the identity group you want to associate it with is not available for selection, you can click Create within the secondary window to create the object you want.

After you have created the object and clicked Submit, the secondary window is refreshed with the newly created object, which you can then select for your configuration. In this example, you can select the newly created identity group to assign it to the users internal identity store.

Transfer Boxes

Transfer boxes are a common element in content area pages (see Figure 5-10). You use these boxes to select and remove items for use in your configuration and order them according to your needs. Figure 5-10 shows the transfer box options. Table 5-6 describes the transfer box options.

Figure 5-10 Transfer Box

Table 5-6 Transfer Box Fields and Buttons 

Field or Button
Description

Available

List of available items for selection.

Selected

Ordered list of selected items.

Right arrow (>)

Click to move one selected item from the Available list to the Selected list.

Left arrow (<)

Click to move one selected item from the Selected list to the Available list.

Double right arrow (>>)

Click to move all items from the Available list to the Selected list.

Double left arrow (<<)

Click to move all items from the Selected list to the Available list.

Up arrow with above score

Click to move one selected item to the top of the ordered Selected items list.

Up arrow

Click to move one selected item up one position in the ordered Selected items list.

Down arrow

Click to move one selected item down one position in the ordered Selected items list.

Down arrow with underscore

Click to move one selected item to the bottom of the ordered Selected items list.


Schedule Boxes

Schedule boxes are a common element in content area pages (see Figure 5-10). You use them to select active times for a policy element from a grid, where each row represents a day of the week and each square in a row represents an hour in a day.

Click one square to make one hour active. Table 5-7 describes the Schedule box options.

Figure 5-11 Schedule Box

Table 5-7 Schedule Box Fields and Buttons 

Field or Button
Description

Mon

A row that indicates Monday of every week of every year.

Tue

A row that indicates Tuesday of every week of every year.

Wed

A row that indicates Wednesday of every week of every year.

Thu

A row that indicates Thursday of every week of every year.

Fri

A row that indicates Friday of every week of every year.

Sat

A row that indicates Saturday of every week of every year.

Sun

A row that indicates Sunday of every week of every year.

0:00 to 24:00

Indicates the hours of a day in columns, where 0:00 = the hour that begins the second after midnight Eastern Standard Time (EST), and 24:00 = midnight to 1:00 a.m., in the time zone in which your ACS instance is located.

Square (of the grid)

Click one square to make one hour active.

Set All

Click to select all squares (hours).

Clear All

Click to deselect all squares (hours).

Undo All

Click to remove your most recent selections.


Rule Table Pages

Rule table pages display the rules that comprise policies. You can reorder rules within a rule table page and submit the policy that is associated with a table. You can access properties and customization pages from rule tables to configure your policies.

For more information on specific rule table pages, and properties and customization pages, see Managing Access Policies.

Directly above the rule table are two display options:

Standard Policy—Click to display the standard policy rule table.

Exception Policy—Click to display the exception policy rule table, which takes precedence over the standard policy rule table content.

Table 5-8 describe the common options of standard and exception rule table pages:

Table 5-8 Rule Table Page Options  

Option
Description

#

The ordered column of rules within the rule table. You can renumber the rules by reordering, adding, or deleting rules and then clicking Save Changes to complete the renumbering.

New rules are added to the end of the ordered column, so you must reorder them if you want to move a new rule to a different position within the ordered list.

You cannot reorder the default (catch-all) rule, which remains at the bottom of the rule table.

Check box

Click one or more check boxes to select associated rules on which to perform actions.

Status

(Display only.) Indicates the status of rules within the rule table. The status can be:

Enabled—Indicated by a green (or light colored) circle with a white check mark.

Disabled—Indicated by a red (or dark colored circle) with a white x.

Monitor-only—Indicated by a gray circle with a black i.

Name

A unique name for each rule (except the default, catch-all rule). Click a name to edit the associated rule. When you add a new rule, it is given a name in the format Rule-num, where num is the next available consecutive integer.

You can edit the name to make it more descriptive. Cisco recommends that you name rules with concatenation of the rule name and the service and policy names.

Conditions

A variable number of condition types are listed, possibly in subcolumns, dependent upon the policy type.

Results

A variable number of result types are listed, possibly in subcolumns, dependent upon the policy type.

Hit Counts column

View the hits counts for rules, where hits indicate which policy rules are invoked.

Rules scroll bar

Use the scroll bar at the right of the rules rows to scroll up and down the rules list.

Conditions and results scroll bar

Use the scroll bar beneath the Conditions and Results columns to scroll left and right through the conditions and results information.

Default rule

Click to configure the catch-all rule. This option is not available for exception policy rule tables.

Customize

Click to open a secondary window where you can determine the set and order of conditions and results used by the rule table.

Hit Counts button

Click to open a secondary window where you can:

View when the hit counters were last reset or refreshed.

View the collection period.

Request a reset or refresh of the hit counts.

See Displaying Hit Counts for more information.

Move to...

Use the ^ and v buttons to reorder selected rules within the rule table.

Save Changes

Click to submit your configuration changes.

Discard Changes

Click to discard your configuration changes prior to saving them.


Related Topic

ACS 5.x Policy Model

Importing and Exporting ACS Objects through the Web Interface

You can use the import functionality in ACS to add, update, or delete multiple ACS objects at the same time. ACS uses a comma-separated values (CSV) file to perform these bulk operations. This .csv file is called an import file. ACS provides a separate .csv template for add, update, and delete operations for each ACS object.

The first record in the .csv file is the header record from the template that contains column (field) names. You must download these templates from the ACS web interface. The header record from the template must be included in the first row of any .csv file that you import.


Note You cannot use the same template to import all the ACS objects. You must download the template that is designed for each ACS object and use the corresponding template while importing the objects. However, you can use the export file of a particular object, retain the header and update the data, and use it as the import file of the same object.


You can use the export functionality to create a .csv file that contains all the records of a particular object type that are available in the ACS internal store.

You must have CLI administrator-level access to perform import and export operations. Additionally:

To import ACS configuration data, you need CRUD permissions for the specific configuration object.

To export data to a remote repository, you need read permission for the specific configuration object.

This functionality is not available for all ACS objects. This section describes the supported ACS objects and how to create the import files.

This section contains:

Supported ACS Objects

Creating Import Files

Supported ACS Objects

While ACS 5.2 allows you to perform bulk operations (add, update, delete) on ACS objects using the import functionality, you cannot import all ACS objects. The import functionality in ACS 5.2 supports the following ACS objects:

Users

Hosts

Network Devices

Identity Groups

NDGs

Downloadable ACLs

Command Sets

Table 5-9 lists the ACS objects, their properties, and the property data types. The import template for each of the objects contains the properties described in this table.

Table 5-9 ACS Objects - Property Names and Data Types 

Property Name
Property Data Type
Object Type: User

Username

(Required in create, edit, and delete) String. Maximum length is 64 characters.

Description

(Optional) String. Maximum length is 1024 characters.

Enabled

(Required in create) Boolean.

Change Password

(Required in create) Boolean.

Password

(Required in create) String. Maximum length is 32 characters. Not available in Export.

Enable Password

(Optional) String. Maximum length is 32 characters.

User Identity Group

(Optional) String. Maximum length is 256 characters.

List of attributes

(Optional) String and other data types.

Object Type: Hosts

MAC address

(Required in create, edit, delete) String. Maximum length is 64 characters.

Description

(Optional) String. Maximum length is 1024 characters.

Enabled

(Optional) Boolean.

Host Identity Group

(Optional) String. Maximum length is 256 characters.

List of attributes

(Optional) String.

Object Type: Network Device

Name

(Required in create, edit, delete) String. Maximum length is 64 characters.

Description

(Optional) String. Maximum length is 1024 characters.

Subnet

(Required in create) String.

Support RADIUS

(Required in create) Boolean.

RADIUS secret

(Optional) String. Maximum length is 32 characters.

Support TACACS

(Required in create) Boolean.

TACACS secret

(Optional) String. Maximum length is 32 characters.

Single connect

(Optional) Boolean.

Legacy TACACS

(Optional) Boolean.

Support CTS

(Required in create) Boolean.

CTS Identity

(Optional) String. Maximum length is 32 characters.

CTS trusted

(Optional) Boolean.

Password

(Optional) String. Maximum length is 32 characters.

sgACLTTL

(Optional) Integer.

peerAZNTTL

(Optional) Integer.

envDataTTL

(Optional) Integer.

Session timeout

(Optional) Integer.

List of NDG names

(Optional) String.

Object Type: Identity Group

Name

(Required in create, edit, delete) String. Maximum length is 64 characters.

Description

(Optional) String. Maximum length is 1024 characters.

Object Type: NDG

Name

(Required in create, edit, delete) String. Maximum length is 64 characters.

Description

(Optional) String. Maximum length is 1024 characters.

Object Type: Downloadable ACLs

Name

(Required in create, edit, delete) String. Maximum length is 64 characters.

Description

(Optional) String. Maximum length is 1024 characters.

Content

(Required in create, edit, delete) String. The ACL content is split into permit/deny statements separated by a semicolon (;). Maximum length for each statement is 256 characters. There is no limit for ACL content.

Object Type: Command Set

Name

(Required in create, edit, delete) String. Maximum length is 64 characters.

Description

(Optional) String. Maximum length is 1024 characters.

Commands (in the form of grant:command:arguments)

(Optional) String.

This is a list with semi separators (:) between the values that you supply for grant.


Fields that are optional can be left empty and ACS substitutes the default values for those fields.

For example, when fields that are related to a hierarchy are left blank, ACS assigns the value of the root node in the hierarchy. For network devices, if TrustSec is enabled, all the related configuration fields are set to default values.

Creating Import Files

This section describes how to create the .csv file for performing bulk operations on ACS objects. You can download the appropriate template for each of the objects from the ACS web interface. This section contains the following:

Downloading the Template from the Web Interface

Understanding the CSV Templates

Creating the Import File

Downloading the Template from the Web Interface

Before you can create the import file, you must download the import file templates from the ACS web interface.

To download the import file templates for adding internal users:


Step 1 Log in to the ACS 5.2 web interface.

Step 2 Choose Users and Identity Stores > Internal Identity Stores > Users.

The Users page appears.

Step 3 Click File Operations.

The File Operations wizard appears.

Step 4 Choose any one of the following:

Add—Adds users to the existing list. This option does not modify the existing list. Instead, it performs an append operation.

Update—Updates the existing internal user list.

Delete—Deletes the list of users in the import file from the internal identity store.

Step 5 Click Next.

The Template page appears.

Step 6 Click Download Add Template.

Step 7 Click Save to save the template to your local disk.


The following list gives you the location from which you can get the appropriate template for each of the objects:

User—Users and Identity Stores > Internal Identity Stores > Users

Hosts—Users and Identity Stores > Internal Identity Stores > Hosts

Network Device—Network Resources > Network Devices and AAA Clients

Identity Group—Users and Identity Stores > Identity Groups

NDG

Location—Network Resources > Network Device Groups > Location

Device Type—Network Resources > Network Device Groups > Device Type

Downloadable ACLs—Policy Elements > Authorization and Permissions > Named Permission Objects > Downloadable ACLs

Command Set—Policy Elements > Authorization and Permissions > Device Administration > Command Sets

Follow the procedure described in this section to download the appropriate template for your object.

Understanding the CSV Templates

You can open your CSV template in Microsoft Excel or any other spreadsheet application and save the template to your local disk as a .csv file. The .csv template contains a header row that lists the properties of the corresponding ACS object.

For example, the internal user Add template contains the fields described in Table 5-10:

Table 5-10 Internal User Add Template 

Header Field
Description

name:String(64):Required

Username of the user.

description:String(1024)

Description of the user.

enabled:Boolean (True,False):Required

A boolean field that indicates whether the user must be enabled or disabled.

changePassword:Boolean (True,False):Required

A boolean field that indicates whether the user must change password on first login.

password:String(32):Required

Password of the user.

enablePassword:String(32)

Enable password of the user.

UserIdentityGroup:String(256)

Identity group to which the user belongs.

All the user attributes that you have specified would appear here.


Each row of the .csv file corresponds to one internal user record. You must enter the values into the .csv file and save it before you can import the users into ACS. See Creating the Import File for more information on how to create the import file.

This example is based on the internal user Add template. For the other ACS object templates, the header row contains the properties described in Table 5-9 for that object.

Creating the Import File

After you download the import file template to your local disk, enter the records that you want to import into ACS in the format specified in the template. After you enter all the records into the .csv file, you can proceed with the import function. The import process involves the following:

Adding Records to the ACS Internal Store

Updating the Records in the ACS Internal Store

Deleting Records from the ACS Internal Store

Adding Records to the ACS Internal Store

When you add records to the ACS internal store, you add the records to the existing list. This is an append operation, in which the records in the .csv file are added to the list that exists in ACS.

To add internal user records to the Add template:


Step 1 Download the internal user Add template. See Downloading the Template from the Web Interface for more information.

Step 2 Open the internal user Add template in Microsoft Excel or any other spreadsheet application. See Table 5-9 for a description of the fields in the header row of the template.

Step 3 Enter the internal user information. Each row of the .csv template corresponds to one user record.

Figure 5-12 shows a sample Add Users import file.

Figure 5-12 Add Users - Import File

Step 4 Save the add users import file to your local disk.


Updating the Records in the ACS Internal Store

When you update the records in the ACS store, the import process overwrites the existing records in the internal store with the records from the .csv file. This operation replaces the records that exist in ACS with the records from the .csv files.

The update operation is similar to the add operation except for one additional column that you can add to the Update templates. The Update template can contain an Updated name column for internal users and other ACS objects, and an Updated MAC address column for the internal hosts. The Updated Name replaces the name.


Timesaver Instead of downloading the update template for each of the ACS objects, you can use the export file of that object, retain the header row, and update the data to create your update .csv file.


To add an updated name or MAC address to the ACS objects, you have to download and use the particular update template. Also, for the NDGs, the export template contains only the NDG name, so in order to update any other property, you must download and use the NDG update template.

For example, Figure 5-13 shows a sample import file that updates existing user records.

Figure 5-13 Update Users-Import File


Note The second column, Updated name, is the additional column that you can add to the Update template.


Deleting Records from the ACS Internal Store

You can use this option to delete a subset of records from the ACS internal store. The records that are present in the .csv file that you import are deleted from the ACS internal store. The Delete template contains only the key column to identify the records that must be deleted.

For example, to delete a set of internal users from the ACS internal identity store, download the internal user Delete template and add the list of users that you want to delete to this import file. Figure 5-14 shows a sample import file that deletes internal user records.


Timesaver To delete all users, you can export all users and then use the same export file as your import file to delete users.


Figure 5-14 Delete Users - Import File

Common Errors

You might encounter these common errors:

Concurrency Conflict Errors

Deletion Errors

System Failure Errors

Accessibility

Concurrency Conflict Errors

Concurrency conflict errors occur when more than one user tries to update the same object. When you click Submit and the web interface detects an error, a dialog box appears, with an error message and an OK button. Read the error message, click OK, and resubmit your configuration, if needed.

Possible error messages, explanations, and recommended actions are:

Error Message    The item you are trying to Submit has been modified elsewhere while 
you were making your changes.

Explanation    You accessed an item to perform an edit and began to configure it; simultaneously, another user accessed and successfully submitted a modification to it. Your submission attempt failed.

Recommended Action    Click OK to close the error message and display the content area list page. The page contains the latest version of all items. Resubmit your configuration, if needed.

Error Message    The item you are trying to Submit has been deleted while you were making 
your changes.

Explanation    If you attempt to submit an edited item that another user simultaneously accessed and deleted, your submission attempt fails. This error message appears in a dialog box with an OK button.

Recommended Action    Click OK to close the error message and display the content area list page. The page contains the latest version of all items. The item that you tried to submit is not saved or visible.

Error Message    The item you are trying to Duplicate from has been deleted.
Error Message    The item you are trying to Edit has been deleted.

Explanation    You attempted to duplicate or edit a selected item that another user deleted at the same time that you attempted to access it.

Recommended Action    Click OK to close the error message and display the content area list page. The page contains the latest version of all items. The item that you tried to duplicate or edit is not saved or visible.

Error Message    The item you are trying to Submit is referencing items that do not 
exist anymore.

Explanation    You attempted to edit or duplicate an item that is referencing an item that another user deleted while you tried to submit your change.

Recommended Action    Click OK to close the error message and display the previous page, the Create page or the Edit page. Your attempted changes are not saved, nor do they appear in the page.

Error Message    Either Import or Export is already in progress.

Explanation    You attempted to import or export a .csv file while a previous import or export is still in progress. The subsequent import or export will not succeed. The original import or export is not interrupted due to this error.

Recommended Action    Click OK to close the error message and display the previous page. For a currently running import process, consult the Import Progress secondary window and wait for the Save Log button to become enabled. Save the log, then attempt to import or export your next .csv file.

Deletion Errors

Deletion errors occur when you attempt to delete an item (or items) that another item references. When you click Delete and an error is detected, a dialog box appears, with an error message and an OK button. Read the error message, click OK, and perform the recommended action.

Possible error messages, explanations, and recommended actions are:

Error Message    The item you are trying to Delete is referenced by other Items. You 
must remove all references to this item before it can be deleted.
Error Message    Some of the items you are trying to Delete are referenced by other 
Items. You must remove all references to the items before they can be deleted.

Explanation    If you attempt to delete one or more items that another item references, the system prevents the deletion.

Recommended Action    Click OK to close the error message and display the content area list page. Your deletion does not occur and the items remain visible in the page. Remove all references to the item or items you want to delete, then perform your deletion.

System Failure Errors

System failure errors occur when a system malfunction is detected. When a system failure error is detected, a dialog box appears, with an error message and OK button. Read the error message, click OK, and perform the recommended action.

Possible error messages, explanations, and recommended actions are:

Error Message    The following System Failure occurred: <description>.

Where description describes the specific malfunction.

Explanation    You have attempted to make a configuration change and the system detected a failure at the same time.

Recommended Action    Click OK to close the error message and display the content area list page. Your changes are not saved. Investigate and troubleshoot the detected malfunction, if possible.

Error Message    An unknown System Failure occurred.

Explanation    You tried to change the configuration and the system detected an unknown failure at the same time.

Recommended Action    Click OK to close the error message and display the content area list page. Investigate possible system failure causes, if possible.

Accessibility

The ACS 5.2 web interface contains accessibility features for users with vision impairment and mobility limitations.

This section contains the following topics:

Display and Readability Features

Keyboard and Mouse Features

Obtaining Additional Accessibility Information

Display and Readability Features

The ACS 5.2 web interface includes features that:

Increase the visibility of items on the computer screen.

Allow you to use screen reader software to interpret the web interface text and elements audibly.

The display and readability features include:

Useful text descriptions that convey information that appears as image maps and graphs.

Meaningful and consistent labels for tables, buttons, fields, and other web interface elements.

Label placement directly on, or physically near, the element to which they apply.

Color used as an enhancement of information only, not as the only indicator. For example, required fields are associated with a red asterisk.

Confirmation messages for important settings and actions.

User-controllable font, size, color, and contrast of the entire web interface.

Keyboard and Mouse Features

You can interact with the ACS 5.2 web interface by using the keyboard and the mouse to accomplish actions. The keyboard and mouse features include:

Keyboard accessible links to pages that display dynamic content.

Standard keyboard equivalents are available for all mouse actions.

Multiple simultaneous keystrokes are not required for any action.

Pressing a key for an extended period of time is not required for any action.

Backspace and deletion are available for correcting erroneous entries.

Obtaining Additional Accessibility Information

For more information, refer to the Cisco Accessibility Program:

E-mail: accessibility@cisco.com

Web: http://www.cisco.com/go/accessibility