Table Of Contents
Release Notes for Cisco Secure ACS Express 5.0.1
Exceptions To TACACS+ Draft 1.78 Support
Release Notes for Cisco Secure ACS Express 5.0.1
September 25, 2009
OL-20149-01
Cisco Secure ACS Express 5.0.1 (ACS Express) is a Linux-based hardware platform that is pre-installed with the ACS Express server software. The ACS Express appliance leverages the Cisco Application Deployment Engine (ADE) 1010 hardware platform.
For information on ADE 1010, refer to http://www.cisco.com/en/US/prod/collateral/netmgtsw/ps5734/ps8340/ps8348/product_data_sheet0900aecd806d39ff.html.
Note
ACS Express 5.0.1 provides support for Windows 2008 AD.
These release notes provide general information about ACS Express, resolved bugs in this release, and related documentation.
Contents
This release note contains the following sections:
Introduction
Cisco Secure ACS Express (referred to as ACS Express from here on) is an easy to use access control server that operates as a centralized RADIUS and TACACS+ server. It extends access security by combining authentication and authorization within a centralized identity networking solution, allowing greater flexibility and user-productivity gains. ACS Express supports a broad variety of access connections, including wired and wireless LAN, firewalls, and VPNs.
ACS Express is an entry-level RADIUS AAA and TACACS+ server addressing the small-to-medium sized business (SMB) such as retail branches and enterprise branch market segments. ACS Express controls user and machine access to various networks including wireless, wired, and virtual private networks. ACS Express also controls administrative access to network devices using RADIUS and TACACS+. ACS Express ships as an appliance with easy-to-use management interfaces to facilitate deployment and configuration.
The primary function of ACS Express is to control user access and client machines requesting access to protected resources within a corporate network. ACS Express interacts with AAA-enabled network devices to authenticate a user or device and authorize the user or device with entitlements granted to the user or device.
ACS Express controls user and client access to an enterprise network by way of various transports including wireless, wired, and VPN (Network Access) using RADIUS. For network access, ACS Express and the AAA-enabled devices such as a Network Access Server (NAS) communicate using the RADIUS protocol. ACS Express supports various NASs including Cisco IOS/PIX devices, Cisco VPN concentrators, Cisco Airespace controllers, Cisco Aironet access points, Juniper and Microsoft devices, and any IETF RADIUS-compliant NAS. ACS Express supports various authentication methods including CHAP, PAP, MS-CHAPv2, EAP-TLS, PEAP, EAP-FASTv0, and LEAP.
After a NAS submits a user's credentials to ACS Express, it can validate them against various user databases. ACS Express can communicate with Active Directory (AD), LDAP, and One-Time-Password user databases. ACS Express also provides its own user database to manage local users. During the credential validation process, the user database might return data describing a user's profile within an enterprise (such as a User Group). When using AD, ACS Express can also process machine authentication requests and enforce that both the machine and user are successfully authenticated prior to gaining network access.
After the credentials are validated, ACS Express then determines the entitlements granted to the user. For network access, an entitlement is a RADIUS authentication response returned to the originating NAS. An administrator can define rules to determine the returned entitlements. Conditions for the rules might include a user's profile (user group), how (wireless, wired, or other) and when (time of day) a user attempts to access the enterprise network.
ACS Express also controls network administrator access to configure a network device (Device Administration Access). For device administration, ACS Express supports NASs that communicate using TACACS+ or RADIUS. Credential validation and entitlement determination are processed in the same manner as described for network access. Entitlements for device administration specify the maximum administrative privilege level allowed. Conditions for the rules might include a user's profile (user group), the device being configured, and when (time of day) a user attempts to configure a network device.
ACS Express supports up to 50 NASs and is aimed at small-to-medium businesses requiring 350 or fewer successful user authentications per twenty-four hour period.
ACS Express is delivered as an appliance. You use the command line interface (CLI) to set up the ACS Express appliance. You use the GUI to configure the ACS Express server. ACS Express can be deployed in pairs where the configuration from the primary Express server is replicated to the secondary server.
Supported Protocols
ACS Express supports both Radius and TACACS+ protocols concurrently. ACS Express conforms to the latest TACACS+ specification (draft 1.78) from Cisco with some exceptions.
ACS Express conforms to the RADIUS protocol as defined in the draft of April 1997 and conforms substantially to the following Requests for Comments (RFCs):
•
•
•
•
•
•
•
•
The ports used for authentication and accounting have changed in RADIUS RFC documents. To support the older and newer RFCs, ACS Express accepts authentication requests on port 1645 and port 1812. For accounting, ACS accepts accounting packets on port 1646 and port 1813.
In addition to support for standard Internet Engineering Task Force (IETF) RADIUS attributes, ACS Express supports vendor-specific attributes (VSAs). The following VSAs are supported out of the box:
•
•
•
•
•
•
•
ACS Express also enables you to add and modify VSAs from the vendors listed above. ACS Express supports up to additional ten vendors. After a new RADIUS VSA is defined, you can use it as if it were a predefined ACS Express RADIUS VSA.
Exceptions To TACACS+ Draft 1.78 Support
The following lists exceptions to TACACS+ Draft 1.78 that are not supported in ACS Express 5.0.
•
•
•
•
•
•
Installation Notes
The Cisco Secure ACS Express product comprises an appliance, the Cisco Application Deployment Engine (ADE) 1010, and the ACS Express server software. The software for ACS Express is already installed on the appliance.
This section provides an overview of installation tasks required to install the ACS Express appliance.
Step 1
The package containing your ACS Express appliance includes the following:
•
•
•
•
•
Step 2
Step 3
See Chapter 3 of the Installation and Setup Guide for Cisco Secure ACS Express for more details about installing the ACS Express appliance.
Figure 1 shows the rear of the ACS Express appliance and the various cable connectors. Ensure that you connect the Ethernet cable to the NIC 1 connector (#6 in Figure 1).
Note
Figure 1 Cable Connectors on Rear of ACS Express Appliance
Table 1 describes the rear panel connectors called out in Figure 1:
After completing the hardware installation, you are ready to turn power on.
The first time you turn power on you must run the setup program. See Running the setup Program for more detailed information.
Running the setup Program
The setup program launches an interactive command-line interface (CLI) that prompts you for the required parameters. An administrator can use the console or a dumb terminal to configure the initial network settings and provide the initial administrator credentials for the ACS Express server using the setup program.
After you turn on power to the ACS Express appliance and it boots up for the first time, a login prompt like the following displays on the console:
*************************************************Please log in as setup to configure the appliance*************************************************localhost login:Enter setup at the login prompt to launch the setup program, and the ACS Express appliance will prompt you for the setup parameters. Table 2 lists and describes the setup program parameters. You must provide a response for each parameter before you advance to the next.
Figure 2 provides an example of the setup program interaction. Entries in bold font are administrator entries.
Figure 2 Sample Output of setup Command
localhost.localdomain login: setupPress 'Ctrl-C' to abort setupEnter hostname[]: acsexpress1Enter IP address[]: 209.165.200.225Enter IP default netmask[]: 255.255.255.0Enter IP default gateway[]: 209.165.200.1Enter default DNS domain[]: yourcompany.comEnter Primary nameserver[]: 209.165.200.254Add/Edit another nameserver? Y/N : nEnter username[admin]: adminEnter password:Enter password again:Pinging the gateway...Pinging the primary nameserver...Do not use 'Ctrl-C' from this point on...
Note
Appliance is configuredInstalling applications...Installing acsexpress ...Generating configuration...Rebooting...You can abort from setup by pressing CTRL-C. After providing the required input for each parameter, the new settings are applied. You can also use CTRL-C to abort from setup if you happen to enter an incorrect setting.
After you run the setup program and provide the initial settings, the ACS Express server reboots. After the ACS Express server reboots, use the username and password you entered during setup to log in.
Note
Upgrade Notes
Follow the steps below to upgrade an ACS Express server from 5.0 to 5.0.1:
Note
Step 1
acsexport <export_file> repository <repository_name> secret <secret_key_min_8_chars>
ACS Express displays the following message:
Successfully exported.Step 2
backup <backup_filename> repository <repository_name>
ACS Express creates a backup file with the name backup_filename.tar.gpg in the repository.
Step 3
To get the ACS Express 5.0.1 upgrade software, from the Cisco Software Download Site, select Network management > Security and Identity Management > Cisco Secure Access Control Server Products > Cisco Secure Access Control Server Express > Cisco Secure Access Control Server Express 5.0.
Step 4
application upgrade <upgrade_bundle> <remote_repository_name>
ACS Express requests you to confirm if you want to save the current configuration:
Do you want to save the current configuration ? (yes/no) [yes] ?Enter yes.
You will see the following message:
Saved the running configuration to startup successfullyApplication upgrade successful.
Note
When you want to restore the configuration and system data to the ACS Express 5.0.1 server, follow the steps below:
Step 1
acsimport <import_file> repository <repository_name> validateonly
This command validates the import file without modifying the configuration stored in the database. It also displays the errors that occurs during the validation. For example, this command displays an error when an XML file misses a reference to an object from another object.
ACS Express displays the following output:
% acsimport in progress...% Validating EAP SettingsValidating Network Device Group - RoutersValidating Network Device Group - SwitchesValidating Network Device Group - Wireless Controllers...Validating RADIUS Access Profile rule - peap-eapgtc-ad-napValidating RADIUS Access Profile rule - peap-eapgtc-ldap-napValidating before system Update.Updating the system. Please wait ...Imported Successfully.Step 2
acsimport <import_file> repository <repository_name> flushconfig
This command flushes the objects that have root elements in the XML file. For example, if <DeviceGroups> is in the XML file, all existing Device Groups will be deleted before importing the Device Groups in the XML file.
ACS Express displays the following output:
% acsimport in progress...% Validating EAP SettingsValidating Network Device Group - RoutersValidating Network Device Group - SwitchesValidating Network Device Group - Wireless Controllers...Validating RADIUS Access Profile rule - peap-eapgtc-ad-napValidating RADIUS Access Profile rule - peap-eapgtc-ldap-napValidating before system Update.Updating the system. Please wait ...Imported Successfully.Step 3
restore <backupfile> repository <repository_name>
ACS Express requests you to confirm if you want to reboot the server:
Restore requires a reboot to successfully complete. Continue? (yes/no) [yes] ?Enter yes.
For more information on ACS Express commands, refer to Command Line Interface Reference Guide for Cisco Secure ACS Express, 5.0.
Resolved Bugs
Table 3 lists bugs that are resolved in ACS Express 5.0.1.
Related Documentation
This section provides a list of the ACS Express product documentation with links to the online documentation.
You can find links to all ACS Express product documentation at the following URL:
http://www.cisco.com/en/US/products/ps8543/tsd_products_support_series_home.html
The following documents comprise the ACS Express documentation set and should be read in the following order:
•
•
The Installation and Setup Guide for Cisco Secure ACS Express is an online only document that provides information about how to set up the ACS Express appliance including location, internet connection, and initial configuration.
•
The User Guide for Cisco Secure ACS Express is an online only document that provides information about how to use the ACS Express GUI and how to perform routine tasks associated with the features and functionality of Cisco ACS Express.
•
The Cisco Secure ACS Express Command Reference focuses on the following topics:
–
–
Each topic provides a high-level summary of the tasks required for using the CLI in the Application Deployment Engine OS 1.0.1, and the procedures for performing these tasks.
•
This guide provides information about troubleshooting strategies and shows example ACS Express logs with pointers to things to look for when experiencing difficulties.
•
This guide provides information about support device types and supported browsers.
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect, Cisco Pulse, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, and Flip Gift Card are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Fast Step, Follow Me Browsing, FormShare, GainMaker, GigaDrive, HomeLink, iLYNX, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0908R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2007-2009 Cisco Systems, Inc. All rights reserved.
