Table Of Contents
Installation Guide for Cisco Secure ACS for Windows Server Version 3.2
Preparation for Installing or Upgrading Cisco Secure ACS
Cisco Secure ACS System Description
System Requirements
Network and Port Requirements
Back Up Data
Gathering Answers for the Installation Questions
What You Can Do
Creating a Cisco Secure ACS Installation
Reinstalling or Upgrading Cisco Secure ACS and Preserving Existing Configuration
Reinstalling or Upgrading Cisco Secure ACS without Preserving Existing Configuration
Windows Authentication from a Member Server
Verifying Domain Membership
Configuring Cisco Secure ACS Services
Configuring Active Directory for EAP-TLS
Migrating to a Cisco Secure ACS Appliance
Uninstalling Cisco Secure ACS
Related Documentation
Obtaining Documentation
Cisco.com
Documentation CD-ROM
Ordering Documentation
Documentation Feedback
Obtaining Technical Assistance
Cisco.com
Technical Assistance Center
Obtaining Additional Publications and Information
Installation Guide for Cisco Secure ACS for Windows Server Version 3.2
This document provides information about installing, reinstalling, and upgrading to Cisco Secure Access Control Server (Cisco Secure ACS) for Windows Server version 3.2. It contains the following sections:
•
Preparation for Installing or Upgrading Cisco Secure ACS
– Cisco Secure ACS System Description
– System Requirements
– Cisco Secure ACS Upgrade Requirements
– Network and Port Requirements
– Back Up Data
– Gathering Answers for the Installation Questions
• What You Can Do
• Creating a Cisco Secure ACS Installation
• Reinstalling or Upgrading Cisco Secure ACS and Preserving Existing Configuration
• Reinstalling or Upgrading Cisco Secure ACS without Preserving Existing Configuration
• Windows Authentication from a Member Server
• Migrating to a Cisco Secure ACS Appliance
• Uninstalling Cisco Secure ACS
• Related Documentation
• Obtaining Documentation
• Obtaining Technical Assistance
• Obtaining Additional Publications and Information
Preparation for Installing or Upgrading Cisco Secure ACS
Before performing an installation or upgrade procedure, read this section and perform the recommended actions. This section includes the following topics:
• Cisco Secure ACS System Description
• System Requirements
• Cisco Secure ACS Upgrade Requirements
• Network and Port Requirements
• Back Up Data
• Gathering Answers for the Installation Questions
Cisco Secure ACS System Description
Cisco Secure ACS network security software helps you authenticate users by controlling access to a AAA client—any one of many network devices that can be configured to defer authentication and authorization of network users to a AAA server. Cisco Secure ACS operates as a set of Windows services that control the authentication, authorization, and accounting of users accessing networks.
Cisco Secure ACS operates on Windows 2000 Server. Windows 2000 Advanced Server and Windows 2000 Datacenter Server are not supported. Cisco Secure ACS can run on a domain controller or a member server.
Note If you install Cisco Secure ACS on a member server and want to authenticate users with a Windows Security Account Manager user database or an Active Directory user database, there is additional Windows configuration required after you have installed Cisco Secure ACS. For more information, see Windows Authentication from a Member Server.
For additional information about Cisco Secure ACS, refer to the User Guide for Cisco Secure ACS for Windows Server, version 3.2.
System Requirements
Your Cisco Secure ACS server must meet the minimum hardware, operating system, and third-party software requirements detailed in the following sections. Additionally, if you are upgrading from a previous version of Cisco Secure ACS, refer to Cisco Secure ACS Upgrade Requirements.
Cisco Secure ACS Upgrade Requirements
The setup program supports upgrades from previous versions of Cisco Secure ACS. For information about the versions of Cisco Secure ACS that we used to test the upgrade process, see the Release Notes. The latest version of the Release Notes are posted on Cisco.com, accessible from the following URL: http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/
csacs4nt/index.htm.
Hardware Requirements
The computer running Cisco Secure ACS must meet the following minimum hardware requirements:
•Pentium III processor, 550 MHz or faster.
•256 MB of RAM.
•At least 250 MB of free disk space. If you are running your database on the same computer, more disk space is required.
•Minimum graphics resolution of 256 colors at 800 x 600 lines.
Operating System Requirements
The computer running Cisco Secure ACS use an English-language version of Windows 2000 Server with Service Pack 3 installed. Both the operating system and the applicable service pack must be English-language versions.
Note Windows 2000 Advanced Server and Windows 2000 Datacenter Server are not supported.
Windows service packs can be applied before or after installing Cisco Secure ACS. If you do not install a required service pack before installing Cisco Secure ACS, the Cisco Secure ACS installation program may warn you that the required service pack is not present. If you receive a service pack message, continue the installation, and then install the required service pack before starting user authentication with Cisco Secure ACS.
For the most recent information about tested operating systems and service packs, see the Release Notes. The current version of the Release Notes are posted on Cisco.com, accessible from the following URL: http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/
csacs4nt/index.htm.
Third-Party Software Requirements
Note The Release Notes provide information about third-party software products that we tested with Cisco Secure ACS and that we support. Other than the software products described in the Release Notes, we have not tested the interoperability of Cisco Secure ACS and other software products on the same computer. We only support interoperability issues of software products that are mentioned in the Release Notes. The most recent version of the Release Notes are posted on Cisco.com, accessible from the following URL: http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/
csacs4nt/index.htm.
The computer running Cisco Secure ACS must have a supported browser installed. We tested Cisco Secure ACS using English-language versions of the following browsers on Microsoft Windows operating systems:
•Microsoft Internet Explorer Version 5.5 and 6.0.
•Netscape Communicator Version 7.0.
Note To use a web browser to access the Cisco Secure ACS HTML interface, you must enable both Java and JavaScript in the browser. Also, the web browser must not be configured to use a proxy server. For more information about other network environment factors that affect access to the HTML interface, see User Guide for Cisco Secure ACS for Windows Server, version 3.2.
For the most recent information about tested browsers and other third-party applications, such as Novell NDS clients and token-card clients, see the Release Notes. The most recent version of the Release Notes are posted on Cisco.com, accessible from the following URL: http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/
csacs4nt/index.htm.
Network and Port Requirements
Your network should meet the following requirements before you begin deploying Cisco Secure ACS.
•For full TACACS+ and RADIUS support on Cisco IOS devices, AAA clients must run Cisco IOS Release 11.2 or later.
•Non-Cisco IOS AAA clients must be configured with TACACS+ and/or RADIUS.
•Dial-in, VPN, or wireless clients must be able to connect to the applicable AAA clients.
•The computer running Cisco Secure ACS must be able to ping all AAA clients.
•Gateway devices between Cisco Secure ACS and other network devices must permit communication over the ports needed to support the applicable feature or protocol. For information about ports listened to by Cisco Secure ACS, see Table 1.
•A supported web browser must be installed on the computer running Cisco Secure ACS. For the most recent information about tested browsers, see the Release Notes. The most recent version of the Release Notes are posted on Cisco.com, accessible from the following URL: http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/
csacs4nt/index.htm.
•All network cards in the computer running Cisco Secure ACS must be enabled. If there is a disabled network card on the computer running Cisco Secure ACS, installing Cisco Secure ACS may proceed slowly due to delays caused by Microsoft CryptoAPI.
Note We tested Cisco Secure ACS on computers that only have one network interface card.
•To have Cisco Secure ACS use the Grant Dial-in Permission to User feature in Windows when authorizing network users, this option must be selected in the Windows User Manager or Active Directory Users and Computers for the applicable user accounts.
Table 1 lists the ports that Cisco Secure ACS listens to for communications with AAA clients, other Cisco Secure ACSes and applications, and web browsers. Cisco Secure ACS uses other ports to communicate with external user databases; however, it initiates those communications rather than listening to specific ports. In some cases, these ports are configurable, such as with LDAP and RADIUS token server databases. For more information about ports that a particular external user database listens to, see the documentation for that database.
Table 1 Ports that Cisco Secure ACS Listens To
Feature/Protocol
|
UDP or TCP?
|
Ports
|
RADIUS authentication and authorization
|
UDP
|
1645, 1812
|
RADIUS accounting
|
UDP
|
1646, 1813
|
TACACS+
|
TCP
|
49
|
CiscoSecure Database Replication
|
TCP
|
2000
|
RDBMS Synchronization with synchronization partners
|
TCP
|
2000
|
User-Changeable Password web application
|
TCP
|
2000
|
Logging
|
TCP
|
2001
|
Administrative HTTP port for new sessions
|
TCP
|
2002
|
Administrative HTTP port range
|
TCP
|
Configurable; default 1024 through 65535
|
Back Up Data
Before you install or upgrade Cisco Secure ACS, we strongly recommend that you back up the computer that you will install Cisco Secure ACS on, using a Windows backup utility of your choice. Include the Windows Registry in the backup.
If you are upgrading or reinstalling Cisco Secure ACS, use the Cisco Secure ACS Backup feature to back up the Cisco Secure ACS configuration and database, and then copy the backup file to a drive other than one local to the computer running Cisco Secure ACS.
Caution If you are upgrading Cisco Secure ACS rather than reinstalling, the backups you create cannot be used after the upgrade is successful. The backups provide for recovery should you need to restore your previous installation of Cisco Secure ACS.
For information about backing up Cisco Secure ACS, see the User Guide for Cisco Secure ACS for Windows Server, version 3.2.
Gathering Answers for the Installation Questions
During new installations, or upgrades and reinstallations that do not preserve the existing configuration, the installation requires specific information about the computer you want to install Cisco Secure ACS on and a AAA client on your network. To facilitate the installation, collect the applicable information before beginning the installation.
Note If you are upgrading or reinstalling Cisco Secure ACS and intend to keep the existing configuration and database, you do not need to perform the following procedure, which requires information already recorded in your Cisco Secure ACS installation.
To collect information that is required during the installation of Cisco Secure ACS, follow these steps:
Step 1 Determine whether the computer that you will install Cisco Secure ACS on is a domain controller or a member server. If you are installing Cisco Secure ACS on a member server and want Cisco Secure ACS to authenticate users with a Windows domain user database, be aware that after you install Cisco Secure ACS you must perform the additional Windows configuration discussed in Windows Authentication from a Member Server.
Step 2 For the first AAA client that you want to configure to use AAA services provided by Cisco Secure ACS, determine which AAA protocol and vendor-specific attribute you want to implement:
•TACACS+ (Cisco IOS)
•RADIUS (Cisco Aironet)
•RADIUS (Cisco BBSM)
•RADIUS (Cisco IOS/PIX)
•RADIUS (Cisco VPN 3000)
•RADIUS (Cisco VPN 5000)
•RADIUS (IETF)
•RADIUS (Ascend)
•RADIUS (Juniper)
•RADIUS (Nortel)
•RADIUS (iPass)
Step 3 Record the name of the AAA client.
Step 4 Record the IP address of the AAA client.
Step 5 Record the IP address of the computer that you want to install Cisco Secure ACS on.
Step 6 Record the TACACS+ or RADIUS key (shared secret).
What You Can Do
This document provides detailed procedures for installing, reinstalling, and upgrading Cisco Secure ACS. You must select the right procedure for your situation. Table 2 lists the five possible installation and upgrade scenarios. See Table 2 to determine which procedure applies to your situation.
Note Before you perform any installation or upgrade procedure, we strongly recommend that you read Preparation for Installing or Upgrading Cisco Secure ACS, and perform the applicable tasks detailed in that section.
Creating a Cisco Secure ACS Installation
Use this procedure to install Cisco Secure ACS for the first time.
Note For information about upgrading or reinstalling an existing Cisco Secure ACS installation, see Table 2.
Before You Begin
For information about what must be completed before installing Cisco Secure ACS, see Preparation for Installing or Upgrading Cisco Secure ACS.
If you are installing Cisco Secure ACS on a member server and want Cisco Secure ACS to authenticate users with a Windows domain user database, be aware that after you install Cisco Secure ACS you must perform the additional Windows configuration discussed in Windows Authentication from a Member Server.
To install Cisco Secure ACS, follow these steps:
Step 1 Using a local administrator account, log in to the computer you want to install Cisco Secure ACS on.
Note We only support installations performed at computer you are installing Cisco Secure ACS on. Remote installations, performed using Windows Terminal Services or products such as Virtual Network Computing (VNC), are not tested and are not supported.
Step 2 Insert the Cisco Secure ACS CD into a CD-ROM drive on the computer.
Result: If the CD-ROM drive supports the Windows autorun feature, the Cisco Secure ACS for Windows Server dialog box appears.
Note If the computer does not have a required service pack installed, a dialog box appears. Windows service packs can be applied either before or after installing Cisco Secure ACS. You can continue with the installation, but the required service pack must be applied after the installation is complete; otherwise, Cisco Secure ACS may not function reliably.
Step 3 Do one of the following:
a. If the Cisco Secure ACS for Windows Server dialog box appears, click Install.
b. If the Cisco Secure ACS for Windows Server dialog box does not appear, run setup.exe, located in the root directory of the Cisco Secure ACS CD.
Note If the computer does not have a required service pack installed, a dialog box appears. Windows service packs can be applied before or after installing Cisco Secure ACS. You can continue with the installation, but the required service pack must be applied after the installation is complete; otherwise, Cisco Secure ACS may not function reliably.
Result: The CiscoSecure ACS Setup dialog box displays the software license agreement.
Step 4 Read the software license agreement. If you accept the software license agreement, click ACCEPT.
Result: The Welcome dialog box displays basic information about the setup program.
Step 5 After you have read the information in the Welcome dialog box, click Next >.
Result: The Before You Begin dialog box lists items that you must complete before continuing with the installation. These are the same items discussed in Gathering Answers for the Installation Questions.
Step 6 If you have completed all items listed in the Before You Begin dialog box, select the corresponding check box for each item, and then click Next >.
Note If you have not completed all items listed in the Before You Begin dialog box, click Cancel, and then click Exit Setup. After completing all items listed in the Before You Begin dialog box, restart the installation. For more information, see Preparation for Installing or Upgrading Cisco Secure ACS.
Result: The Choose Destination Location dialog box appears. Under Destination Folder, the installation location appears. This is the drive and path where the setup program installs Cisco Secure ACS.
Step 7 To change the installation location, follow these steps:
a. Click Browse.
Result: The Choose Folder dialog box appears. The Path box contains the installation location.
b. Change the installation location. You can either type the new location in the Path box or use the Drives and Directories lists to select a new drive and directory.
Note The installation location must be on a drive local to the computer.
c. Click OK.
Note If you specified a folder that does not exist, the setup program displays a dialog box to confirm the creation of the folder. To continue, click Yes.
Result: In the Choose Destination Location dialog box, the new installation location appears under Destination Folder.
Step 8 Click Next >.
Result: The Authentication Database Configuration dialog box lists options for authenticating users. You can authenticate with the CiscoSecure user database only, or with a Windows user database also.
Note After you have installed Cisco Secure ACS, you can configure authentication support for all external user database types in addition to Windows user databases.
Step 9 If you want to authenticate users with the CiscoSecure user database only, select the Check the CiscoSecure ACS database only option.
Step 10 If you want to authenticate users with a Windows Security Access Manager (SAM) user database or Active Directory user database in addition to the CiscoSecure user database, follow these steps:
a. Select the Also check the Windows User Database option.
Result: The Yes, refer to "Grant dialin permission to user" setting check box becomes available.
Note The Yes, refer to "Grant dialin permission to user" setting check box applies to all forms of access controlled by Cisco Secure ACS, not just dial-in access. For example, a user accessing your network through a VPN tunnel is not dialing into a network access server; however, if the Yes, refer to "Grant dialin permission to user" setting check box is selected, Cisco Secure ACS applies the Windows user dial-in permissions to determine whether to grant the user access to your network.
b. If you want to allow access by users who are authenticated by a Windows domain user database only when they have dial-in permission in their Windows account, select the Yes, refer to "Grant dialin permission to user" setting check box.
Step 11 Click Next >.
Result: The CiscoSecure ACS Network Access Server Details dialog box appears. The information you provide in this dialog box has two uses:
•The setup program creates the AAA client definition in the Network Configuration section of Cisco Secure ACS.
•If you specify TACACS+ (Cisco IOS) or RADIUS (Cisco IOS/PIX) in the Authenticate Users Using list, the setup program uses this information in Step 19, in which you can configure a Cisco IOS network device to use this Cisco Secure ACS for AAA services.
Note You are not limited to defining a network access server in this dialog box. You can define any network device that can act as a AAA client.
Step 12 Complete the following items in the CiscoSecure ACS Network Access Server Details dialog box:
•Authenticate Users Using—Select the AAA protocol used by the AAA client you are defining. If you specify TACACS+ (Cisco IOS) or RADIUS (Cisco IOS/PIX), in Step 19 you can configure the network device specified in this dialog box.
•Access Server Name—Type the name of the AAA client that will use Cisco Secure ACS for AAA services.
•Access Server IP Address—Type the IP address of the AAA client that will use Cisco Secure ACS for AAA services.
•Windows Server IP Address—Type the IP address of the computer that you are installing Cisco Secure ACS on.
•TACACS+ or RADIUS Key—Type the shared secret of the AAA client and Cisco Secure ACS. To ensure proper function and communication between the AAA client and Cisco Secure ACS, the key must be identical to the AAA client key. Shared secrets are case sensitive.
Step 13 Click Next >.
Result: The setup program installs Cisco Secure ACS and updates the Windows Registry.
The Advanced Options dialog box lists several features of Cisco Secure ACS that are not enabled by default. For more information about these features, see the User Guide for Cisco Secure ACS for Windows Server, version 3.2.
Note The listed features appear in the Cisco Secure ACS HTML interface only if you enable them. After installation, you can enable or disable them on the Advanced Options page in the Interface Configuration section.
Step 14 For each feature you want to enable, select the corresponding check box.
Step 15 Click Next >.
Result: The Active Service Monitoring dialog box appears.
Note After installation, you can configure active service monitoring features on the Active Service Management page in the System Configuration section.
Step 16 If you want Cisco Secure ACS to monitor user authentication services, select the Enable Log-in Monitoring check box. From the Script to execute list, select the option you want applied in the event of authentication service failure:
•No Remedial Action—Cisco Secure ACS does not run a script.
Note This option is useful if you enable event mail notifications.
•Reboot—Cisco Secure ACS runs a script that reboots the computer that runs Cisco Secure ACS.
•Restart All—Cisco Secure ACS restarts all Cisco Secure ACS services.
•Restart RADIUS/TACACS+—Cisco Secure ACS restarts only the RADIUS and TACACS+ services.
Step 17 If you want Cisco Secure ACS to send an e-mail message when service monitoring detects an event, select the Mail Notification check box.
Step 18 Click Next >.
Result: If, in Step 12, you specified TACACS+ (Cisco IOS) or RADIUS (Cisco IOS/PIX) as the AAA protocol for your first AAA client, the Network Access Server Configuration dialog box appears.
If, in Step 12, you specified a AAA protocol other than TACACS+ (Cisco IOS) or RADIUS (Cisco IOS/PIX), the CiscoSecure ACS Service Initiation dialog box appears.
Step 19 If the Network Access Server Configuration dialog box appears and you want to configure AAA functionality on a Cisco IOS network device, follow these steps:
a. Select the Yes, I want to configure Cisco IOS software now check box and click Next >.
Result: The Enable Secret Password dialog box appears.
b. In the Enable Secret Password box, type an enable secret password for the Cisco IOS network device.
Note You must type the shared secret exactly the same as it is configured on the Cisco IOS device, including whether the characters are uppercase or lowercase.
c. Click Next >.
Result: The Access Server Configuration dialog box displays information about configuring a Cisco IOS network device.
d. After reading the text in the Access Server Configuration dialog box, click Next >.
Result: The NAS Configuration dialog box displays the minimum Cisco IOS configuration needed for the network device you specified in Step 12. The minimum configuration includes information you have provided during installation, including the IP address of the computer you are installing Cisco Secure ACS on, the TACACS+ or RADIUS key, and the enable secret password.
Note When using the Cisco IOS aaa new-model command, always provide for a local login method. This guards against the slight risk of being locked out of a Cisco IOS device should the administrative Telnet session fail while you are in the process of enabling a new AAA paradigm. For more information about the Cisco IOS aaa command, refer to Cisco IOS documentation.
e. To print the minimum Cisco IOS configuration, click Print.
Note Especially if you intend to implement the minimum configuration provided by the setup program, we recommend that you print the configuration now.
Result: The setup program prints the configuration using the server's default printer.
f. To telnet to the network device you specified in Step 12, click Telnet Now.
Result: The setup program opens a Telnet window. You can log in to the Cisco IOS device and update the device configuration, as applicable. The setup program copies the minimum configuration it provides to the Windows clipboard. If you want to use the minimum configuration, you can paste it in the Telnet window after you have entered the applicable configuration mode.
g. After you finish with the options in the NAS Configuration dialog box, click Next >.
Result: The CiscoSecure ACS Service Initiation dialog box appears.
h. Proceed to Step 21.
Step 20 If the Network Access Server Configuration dialog box appears and you want to skip configuring a Cisco IOS network device, clear the Yes, I want to configure Cisco IOS software now check box, and then click Next >.
Result: The CiscoSecure ACS Service Initiation dialog box appears.
Step 21 For each option you want, select the corresponding check box. The actions associated with the options occur after the setup program finishes.
•Yes, I want to start the CiscoSecure ACS Service now—Starts the Windows services that compose Cisco Secure ACS. If you do not select this option, the Cisco Secure ACS HTML interface is not available unless you reboot the computer or start the CSAdmin service.
•Yes, I want Setup to launch the CiscoSecure ACS Administrator from my browser following installation—Opens the Cisco Secure ACS HTML interface in the default web browser for the current Windows user account.
•Yes, I want to view the Readme file—Opens the README.TXT file in Windows Notepad.
Step 22 Click Next >.
Result: If you so chose, the Cisco Secure ACS services start. The Setup Complete dialog box displays information about the Cisco Secure ACS HTML interface.
Step 23 Click Finish.
Result: The setup program exits. If, in Step 21, you chose the options to view the HTML interface or README.TXT file, those options occur now.
On the computer running Cisco Secure ACS, you can access the Cisco Secure ACS HTML interface using the ACS Admin desktop icon or you can use the following URL in a supported web browser:
http://127.0.0.1:2002
Note The Cisco Secure ACS HTML interface is available only if you chose to start Cisco Secure ACS services in Step 21. If you did not, to make the HTML interface available, you can either reboot the computer or type net start csadmin at a DOS prompt.
Step 24 If you have installed Cisco Secure ACS on a member server and want Cisco Secure ACS to authenticate users with a Windows domain user database, you must perform the additional Windows configuration discussed in Windows Authentication from a Member Server.
Reinstalling or Upgrading Cisco Secure ACS and Preserving Existing Configuration
Use this procedure to reinstall or upgrade Cisco Secure ACS if you want to preserve all existing configuration and database information.
Note For information about installing Cisco Secure ACS the first time, see Table 2.
Before You Begin
For information about what must be completed before reinstalling or upgrading Cisco Secure ACS, see Preparation for Installing or Upgrading Cisco Secure ACS.
Close all applications or command windows that are accessing any directory contained in the Cisco Secure ACS directory. The installation cannot succeed if another process is using the CiscoSecure ACS directory or any of its subdirectories. For example, if Windows Explorer is displaying the contents of an Cisco Secure ACS directory, installation fails.
If you are installing Cisco Secure ACS on a member server and want Cisco Secure ACS to authenticate users with a Windows domain user database, be aware that after you have installed Cisco Secure ACS you must perform the additional Windows configuration discussed in Windows Authentication from a Member Server.
To reinstall or upgrade Cisco Secure ACS and preserve the existing configuration and CiscoSecure user database, follow these steps:
Step 1 Using a local administrator account, log in to the computer you want to install Cisco Secure ACS on.
Note We only support installations performed at computer you are installing Cisco Secure ACS on. Remote installations, performed using Windows Terminal Services or products such as Virtual Network Computing (VNC), are not tested and are not supported.
Step 2 Insert the Cisco Secure ACS CD into a CD-ROM drive on the computer.
Result: If the CD-ROM drive supports the Windows autorun feature, the Cisco Secure ACS for Windows Server dialog box appears.
Note If the computer does not have a required service pack installed, a dialog box may appear. Windows service packs can be applied either before or after installing Cisco Secure ACS. You can continue with the installation, but the required service pack must be applied after the installation is complete; otherwise, Cisco Secure ACS may not function reliably.
Step 3 Do one of the following:
a. If the Cisco Secure ACS for Windows Server dialog box appears, click Install.
b. If the Cisco Secure ACS for Windows Server dialog box does not appear, run setup.exe, located in the root directory of the Cisco Secure ACS CD.
Note If the computer does not have a required service pack installed, a dialog box appears. Windows service packs can be applied before or after installing Cisco Secure ACS. You can continue with the installation, but the required service pack must be applied after the installation is complete; otherwise, Cisco Secure ACS may not function reliably.
Result: The CiscoSecure ACS Setup dialog box displays the software license agreement.
Step 4 Read the software license agreement. If you accept the software license agreement, click ACCEPT.
Result: The Welcome dialog box displays basic information about the setup program.
Step 5 After you have read the information in the Welcome dialog box, click Next >.
Result: The Before You Begin dialog box lists items that you must complete before continuing with the installation. These are the same items discussed in Gathering Answers for the Installation Questions.
Step 6 If you have completed all items listed in the Before You Begin dialog box, select the corresponding check box for each item, and then click Next >.
Note If you have not completed all items listed in the Before You Begin dialog box, click Cancel, and then click Exit Setup. After completing all items listed in the Before You Begin dialog box, restart the installation. For more information, see Preparation for Installing or Upgrading Cisco Secure ACS.
Result: The Existing Installation of CiscoSecure ACS vx.x dialog box appears.
Step 7 Select the Yes, import the existing configuration check box.
Caution Be sure that the Yes, import the existing configuration check box is selected, not cleared. If you proceed without selecting the Yes, import the existing configuration check box, the setup program deletes all existing AAA client, user, and group information.
Step 8 Click Next >.
Result: The Choose Destination Location dialog box appears. Under Destination Folder, the installation location appears. This is the drive and path where the setup program installs Cisco Secure ACS.
Step 9 To change the installation location, follow these steps:
a. Click Browse.
Result: The Choose Folder dialog box appears. The Path box contains the installation location.
b. Change the installation location. You can either type the new location in the Path box or you can use the Drives and Directories lists to select a new drive and directory.
Note The installation location must be on a drive local to the computer.
c. Click OK.
Note If you specified a folder that does not exist, the setup program displays a dialog box to confirm the creation of the folder. To continue, click Yes.
Result: In the Choose Destination Location dialog box, the new installation location appears under Destination Folder.
Step 10 Click Next >.
Result: The setup program installs Cisco Secure ACS and updates the Windows Registry.
The CiscoSecure ACS Service Initiation dialog box appears.
Step 11 For each option you want, select the corresponding check box. The actions associated with each option occur after the setup program finishes.
•Yes, I want to start the CiscoSecure ACS Service now—Starts the Windows services that compose Cisco Secure ACS. If you do not select this option, the Cisco Secure ACS HTML interface is not available unless you reboot the computer or start the CSAdmin service.
•Yes, I want Setup to launch the CiscoSecure ACS Administrator from my browser following installation—Opens the Cisco Secure ACS HTML interface in the default web browser for the current Windows user account.
•Yes, I want to view the Readme file—Opens the README.TXT file in Windows Notepad.
Step 12 Click Next >.
Result: If you so chose, the Cisco Secure ACS services start. The Setup Complete dialog box displays information about the Cisco Secure ACS HTML interface.
Step 13 Click Finish.
Result: The setup program exits. If, in Step 11, you chose the options to view the HTML interface or README.TXT file, those options occur now.
On the computer running Cisco Secure ACS, you can access the Cisco Secure ACS HTML interface using the ACS Admin desktop icon or you can use the following URL in a supported web browser:
http://127.0.0.1:2002
Note The Cisco Secure ACS HTML interface is available only if you chose to start Cisco Secure ACS services in Step 11. If you did not and you want to make the HTML interface available, you can either reboot the computer or type net start csadmin at a DOS prompt.
Step 14 If you have installed Cisco Secure ACS on a member server and want Cisco Secure ACS to authenticate users with a Windows domain user database, you must perform the additional Windows configuration discussed in Windows Authentication from a Member Server.
Note If you previously configured Cisco Secure ACS services to run using a specific username, that configuration was lost during the reinstallation. For more information, see Windows Authentication from a Member Server.
Reinstalling or Upgrading Cisco Secure ACS without Preserving Existing Configuration
Use this procedure to reinstall or upgrade Cisco Secure ACS if you do not intend to preserve the existing configuration and database information.
Caution Performing this procedure deletes the existing configuration of Cisco Secure ACS, including all AAA client, user, and group information. Unless you have backed up your Cisco Secure ACS data and the Windows Registry, there is no recovery of the previous configuration and database.
Before You Begin
For information about what must be completed before reinstalling or upgrading Cisco Secure ACS, see Preparation for Installing or Upgrading Cisco Secure ACS.
Close all applications or command windows that are accessing any directory contained in the Cisco Secure ACS directory. The installation cannot succeed if another process is using the CiscoSecure ACS directory or any of its subdirectories. For example, if Windows Explorer is displaying the contents of an Cisco Secure ACS directory, installation fails.
If you are installing Cisco Secure ACS on a member server and want Cisco Secure ACS to authenticate users with a Windows domain user database, be aware that after you have installed Cisco Secure ACS you must perform the additional Windows configuration discussed in Windows Authentication from a Member Server.
To reinstall or upgrade Cisco Secure ACS without preserving the existing configuration or CiscoSecure user database, follow these steps:
Step 1 Using a local administrator account, log in to the computer you want to install Cisco Secure ACS on.
Note We only support installations performed at computer you are installing Cisco Secure ACS on. Remote installations, performed using Windows Terminal Services or products such as Virtual Network Computing (VNC), are not tested and are not supported.
Step 2 Insert the Cisco Secure ACS CD into a CD-ROM drive on the computer.
Result: If the CD-ROM drive supports the Windows autorun feature, the Cisco Secure ACS for Windows Server dialog box appears.
Note If computer does not have a required service pack installed, a dialog box appears. Windows service packs can be applied before or after installing Cisco Secure ACS. You can continue with the installation, but the required service pack must be applied after the installation is complete; otherwise, Cisco Secure ACS may not function reliably.
Step 3 Do one of the following:
a. If the Cisco Secure ACS for Windows Server dialog box appears, click Install.
b. If the Cisco Secure ACS for Windows Server dialog box does not appear, run setup.exe, located in the root directory of the Cisco Secure ACS CD.
Note If computer does not have a required service pack installed, a dialog box appears. Windows service packs can be applied before or after installing Cisco Secure ACS. You can continue with the installation, but the required service pack must be applied after the installation is complete; otherwise, Cisco Secure ACS may not function reliably.
Result: The CiscoSecure ACS Setup dialog box displays the software license agreement.
Step 4 Read the software license agreement. If you accept the software license agreement, click ACCEPT.
Result: The Welcome dialog box displays basic information about the setup program.
Step 5 After you have read the information in the Welcome dialog box, click Next >.
Result: The Before You Begin dialog box lists items that you must complete before continuing with the installation. These are the same items discussed in Gathering Answers for the Installation Questions.
Step 6 If you have completed all items listed in the Before You Begin dialog box, select the corresponding check box for each item, and then click Next >.
Note If you have not completed all items listed in the Before You Begin dialog box, click Cancel, and then click Exit Setup. After completing all items listed in the Before You Begin dialog box, restart the installation. For more information, see Preparation for Installing or Upgrading Cisco Secure ACS.
Result: The Existing Installation of CiscoSecure ACS vx.x dialog box appears.
Step 7 Clear the Yes, import the existing configuration check box.
Note Be sure that the Yes, import the existing configuration check box is cleared, not checked; otherwise, the existing configuration and CiscoSecure user database are preserved.
Step 8 Click Next >.
Result: The setup program removes the previous installation of Cisco Secure ACS.
If Cisco Secure ACS services are running, the CiscoSecure ACS Uninstall dialog box appears.
Step 9 If the CiscoSecure ACS Uninstall dialog box appears, click Continue.
Result: The setup program finishes removing the previous installation of Cisco Secure ACS.
The Choose Destination Location dialog box appears. Under Destination Folder, the installation location appears. This is the drive and path where the setup program installs Cisco Secure ACS.
Step 10 To change the installation location, follow these steps:
a. Click Browse.
Result: The Choose Folder dialog box appears. The Path box contains the installation location.
b. Change the installation location. You can either type the new location in the Path box or you can use the Drives and Directories lists to select a new drive and directory.
Note The installation location must be on a drive local to the computer.
c. Click OK.
Note If you specified a folder that does not exist, the setup program displays a dialog box to confirm the creation of the folder. To continue, click Yes.
Result: In the Choose Destination Location dialog box, the new installation location appears under Destination Folder.
Step 11 Click Next >.
Result: The Authentication Database Configuration dialog box lists options for authenticating users. You can authenticate with the CiscoSecure user database only, or with a Windows user database also.
Note After you have installed Cisco Secure ACS, you can configure authentication support for all external user database types in addition to Windows user databases.
Step 12 If you want to authenticate users with the CiscoSecure user database only, select the Check the CiscoSecure ACS database only option.
Step 13 If you want to authenticate users with a Windows Security Access Manager (SAM) user database or Active Directory user database in addition to the CiscoSecure user database, follow these steps:
a. Select the Also check the Windows User Database option.
Result: The Yes, refer to "Grant dialin permission to user" setting check box becomes available.
Note The Yes, refer to "Grant dialin permission to user" setting check box applies to all forms of access controlled by Cisco Secure ACS, not just dial-in access. For example, a user accessing your network through a VPN tunnel is not dialing into a network access server; however, if the Yes, refer to "Grant dialin permission to user" setting check box is selected, Cisco Secure ACS applies the Windows user dial-in permissions to determine whether to grant the user access to your network.
b. If you want to allow access to users who are authenticated by a Windows domain user database only when they have dial-in permission in their Windows account, select the Yes, refer to "Grant dialin permission to user" setting check box.
Step 14 Click Next >.
Result: The CiscoSecure ACS Network Access Server Details dialog box appears. The information you provide in this dialog box has two uses:
•The setup program creates the AAA client definition in the Network Configuration section of Cisco Secure ACS.
•If you specify TACACS+ (Cisco IOS) or RADIUS (Cisco IOS/PIX) in the Authenticate Users Using list, the setup program uses this information in Step 22, in which you can configure a Cisco IOS network device to use this Cisco Secure ACS for AAA services.
Note You are not limited to defining a network access server in this dialog box. You can define any network device that can act as a AAA client.
Step 15 Complete the following items in the CiscoSecure ACS Network Access Server Details dialog box:
•Authenticate Users Using—Select the AAA protocol used by the AAA client you are defining. If you specify TACACS+ (Cisco IOS) or RADIUS (Cisco IOS/PIX), in Step 22 you can configure the network device specified in this dialog box.
•Access Server Name—Type the name of the AAA client that will use Cisco Secure ACS for AAA services.
•Access Server IP Address—Type the IP address of the AAA client that will use Cisco Secure ACS for AAA services.
•Windows Server IP Address—Type the IP address of the computer you are installing Cisco Secure ACS on.
•TACACS+ or RADIUS Key—Type the shared secret of the AAA client and Cisco Secure ACS. These passwords must be identical to ensure proper function and communication between the AAA client and Cisco Secure ACS. Shared secrets are case sensitive.
Step 16 Click Next >.
Result: The setup program installs Cisco Secure ACS and updates the Windows Registry.
The Advanced Options dialog box lists several features of Cisco Secure ACS that are not enabled by default. For more information about these features, refer to the User Guide for Cisco Secure ACS for Windows Server, version 3.2.
Note The listed features appear in the Cisco Secure ACS HTML interface only if you enable them. After installation, you can enable or disable them on the Advanced Options page in the Interface Configuration section.
Step 17 For each feature you want to enable, select the corresponding check box.
Step 18 Click Next >.
Result: The Active Service Monitoring dialog box appears.
Note After installation, you can configure active service monitoring features on the Active Service Management page in the System Configuration section.
Step 19 If you want Cisco Secure ACS to monitor user authentication services, select the Enable Log-in Monitoring check box. From the Script to execute list, select the option you want applied in the event of authentication service failure:
•No Remedial Action—Cisco Secure ACS does not run a script.
Note This option is useful if you enable event mail notifications.
•Reboot—Cisco Secure ACS runs a script that reboots the computer that runs Cisco Secure ACS.
•Restart All—Cisco Secure ACS restarts all Cisco Secure ACS services.
•Restart RADIUS/TACACS+—Cisco Secure ACS restarts only the RADIUS and TACACS+ services.
Step 20 If you want Cisco Secure ACS to send an e-mail message when service monitoring detects an event, select the Mail Notification check box.
Step 21 Click Next >.
Result: If, in Step 15, you specified TACACS+ (Cisco IOS) or RADIUS (Cisco IOS/PIX) as the AAA protocol for your first AAA client, the Network Access Server Configuration dialog box appears.
If, in Step 15, you specified a AAA protocol other than TACACS+ (Cisco IOS) or RADIUS (Cisco IOS/PIX), the CiscoSecure ACS Service Initiation dialog box appears.
Step 22 If the Network Access Server Configuration dialog box appears and you want to configure AAA functionality on a Cisco IOS network device, follow these steps:
a. Select the Yes, I want to configure Cisco IOS software now check box and click Next >.
Result: The Enable Secret Password dialog box appears.
b. In the Enable Secret Password box, type an enable secret password for the Cisco IOS network device.
Note You must type the shared secret exactly the same as it is configured on the Cisco IOS device, including whether the characters are uppercase or lowercase.
c. Click Next >.
Result: The Access Server Configuration dialog box displays information about configuring a Cisco IOS network device.
d. After reading the text in the Access Server Configuration dialog box, click Next >.
Result: The NAS Configuration dialog box displays the minimum Cisco IOS configuration needed for the network device you specified in Step 15. The minimum configuration includes information you provided during the installation, including the IP address of the computer running Cisco Secure ACS, the TACACS+ or RADIUS key, and the enable secret password.
Note When using the Cisco IOS aaa new-model command, always provide for a local login method. This guards against the slight risk of being locked out of a Cisco IOS device should the administrative Telnet session fail while you are in the process of enabling a new AAA paradigm. For more information about the Cisco IOS aaa command, refer to Cisco IOS documentation.
e. To print the minimum Cisco IOS configuration, click Print.
Note Especially if you intend to implement the minimum configuration provided by the setup program, we recommend that you print the configuration now.
Result: The setup program uses the server's default printer to print the configuration.
f. To telnet to the network device you specified in Step 15, click Telnet Now.
Result: The setup program opens a Telnet window. You can log in to the Cisco IOS device and update the device configuration, as applicable. The setup program copies the minimum configuration it provides to the Windows clipboard. If you want to use the minimum configuration, you can paste it in the Telnet window after you have entered the applicable configuration mode.
g. After you finish with the options in the NAS Configuration dialog box, click Next >.
Result: The CiscoSecure ACS Service Initiation dialog box appears.
h. Proceed to Step 24.
Step 23 If the Network Access Server Configuration dialog box appears and you want to skip configuring a Cisco IOS network device, clear the Yes, I want to configure Cisco IOS software now check box, and then click Next >.
Result: The CiscoSecure ACS Service Initiation dialog box appears.
Step 24 For each option you want, select the corresponding check box. The actions associated with each option occur after the setup program finishes.
•Yes, I want to start the CiscoSecure ACS Service now—Starts the Windows services that compose Cisco Secure ACS. If you do not select this option, the Cisco Secure ACS HTML interface is not available unless you reboot the computer or start the CSAdmin service.
•Yes, I want Setup to launch the CiscoSecure ACS Administrator from my browser following installation—Opens the Cisco Secure ACS HTML interface in the default web browser for the current Windows user account.
•Yes, I want to view the Readme file—Opens the README.TXT file in Windows Notepad.
Step 25 Click Next >.
Result: If you so chose, the Cisco Secure ACS services start. The Setup Complete dialog box displays information about the Cisco Secure ACS HTML interface.
Step 26 Click Finish.
Result: The setup program exits. If, in Step 24, you chose the options to view the HTML interface or README.TXT file, those options occur now.
On the computer running Cisco Secure ACS, you can access the Cisco Secure ACS HTML interface using the ACS Admin desktop icon or you can use the following URL in a supported web browser:
http://127.0.0.1:2002
Note The Cisco Secure ACS HTML interface is available only if you chose to start Cisco Secure ACS services in Step 24. If you did not, to make the HTML interface available, you can either reboot the computer or type net start csadmin at a DOS prompt.
Step 27 If you have installed Cisco Secure ACS on a member server and want Cisco Secure ACS to authenticate users with a Windows domain user database, you must perform the additional Windows configuration discussed in Windows Authentication from a Member Server.
Note If you previously configured Cisco Secure ACS services to run using a specific username, that configuration was lost during the reinstallation. For more information, see Windows Authentication from a Member Server.
Windows Authentication from a Member Server
Cisco Secure ACS can authenticate users against both types of Windows domain user databases: Security Accounts Manager (SAM) user databases and Active Directory user databases. For either type of Windows domain user database, Cisco Secure ACS submits authentication requests to the Windows operating system of the server on which Cisco Secure ACS is installed. If you have installed Cisco Secure ACS on a member server and you plan to use a Windows domain user database to authenticate users, you must perform additional Windows configuration to ensure that Windows permits authentication to occur from the member server. To do so, complete the steps in the following procedures:
• Verifying Domain Membership
• Configuring Cisco Secure ACS Services
• Configuring Active Directory for EAP-TLS
Verifying Domain Membership
One common configuration error that prevents Windows authentication is the erroneous assignment of the member server to a workgroup with the same name as the Windows domain that you want to use to authenticate users. While this may seem obvious, we recommend that you verify that the computer running Cisco Secure ACS is a member server of the correct domain.
To verify domain membership for your Cisco Secure ACS computer, follow these steps:
Step 1 From the Windows desktop of the computer running Cisco Secure ACS, right-click My Computer and from the shortcut menu, select Properties.
Result: The System Properties panel appears.
Step 2 Select the Network Identification tab.
Step 3 Verify that the Domain box displays the name of the domain that the computer running Cisco Secure ACS should be a member of.
Note If the Workgroup box appears instead of the Domain box, the member server is not a member of a domain.
Step 4
