Table of Contents

Sample Configurations

Before you configure CiscoSecure ACS for the first time, make sure you have the required settings for the configuration you want. This chapter outlines the necessary settings for the following sample configurations:

1. Dialup Using the Windows NT User Database with TACACS+

2. Dialup Using the CiscoSecure ACS User Database with TACACS+

3. Dialup Using SDI Token-Card Server with TACACS+

4. Dialup Using NDS with TACACS+

5. ../../../../../../../../../home/home.htm

6. Dialup Using the CiscoSecure ACS User Database with Cisco RADIUS

7. Dialup for an ARAP Client Using the CiscoSecure ACS User Database with TACACS+

8. NAS Management Using the CiscoSecure ACS User Database with TACACS+

9. Password Aging and User-Changeable Passwords Using CiscoSecure ACS with the CiscoSecure Authentication Agent

10. Single Authentication Using CiscoSecure ACS and the CAA

11. Double Authentication Using CiscoSecure ACS and the CAA

12. Authentication Using CiscoSecure ACS and an MCIS LDAP Database

13. PIX Firewall Authentication/Authorization Using the Windows NT User Database with TACACS+

14. VPDN Using the CiscoSecure ACS User Database with TACACS+

15. Virtual Profiles Using the CiscoSecure ACS User Database with TACACS+

Select the configuration that most closely meets your needs.

You must configure four components to successfully initiate connectivity and start the CiscoSecure ACS for Windows NT services:

1. Windows NT server—Computer hosting the CiscoSecure ACS software and the Windows NT user database

2. Cisco Secure ACS 2.3 for Windows NT Server—Software that provides centralized network security services

3. NAS—Network access servers, routers, or other devices, such as firewalls, that provide your users with access to specific networks

Note Unless specifically stated otherwise, the term NAS includes access servers, routers, and PIX firewalls.

4. Client—Async or ISDN dialup user applications

Dialup Using the Windows NT User Database with TACACS+

This section presents a typical configuration that can be used in a Windows NT network using only the Windows NT user database to maintain access. This configuration would typically be used in businesses with significant or strategic investment in Windows NT. This configuration makes it possible to:

Windows NT Server Configuration

This option requires significant configuration in the Windows NT server environment because it depends heavily on Windows NT management functions. Configure these items in the User Manager on your Windows NT server that is running CiscoSecure ACS. Make sure that:

CiscoSecure ACS Configuration

Follow these steps in CiscoSecure ACS.

Network Configuration

Follow these steps in the Network Configuration window:

Step 2   Add or edit a NAS.

Step 3   Enter the name of the NAS.

Step 4   Enter the IP address of the NAS.

Step 5   Enter the shared secret (key) of the NAS and CiscoSecure ACS.

Step 6   Select TACACS+ (Cisco) as the security control protocol.

External User Databases Configuration

If CiscoSecure ACS was originally installed to authenticate usernames against the CiscoSecure ACS database only; you must add a new configuration to allow it to also authenticate against the Windows NT database.

Step 2   Click Windows NT.

Step 3   Click Create a new configuration.

Step 4   Click Submit to accept the default name.

Step 5   Click Configure to allow the additional capability to Grant dialin permission to user. CiscoSecure ACS verifies that dialup permission is granted for the user in the Windows NT user database. Authentication for a user without dialup permission on the Windows NT server fails, even if the user supplies the correct password. If you do not want to use this feature, clear the check box and click Submit.

Step 6   The Unknown User Policy window controls how CiscoSecure ACS handles usernames that are not found in the CiscoSecure ACS user database. Configure this option to ensure that all authentications without usernames in the CiscoSecure ACS user database are checked against the Windows NT database.

If this authentication succeeds, a record is automatically generated in the CiscoSecure ACS Database indicating that the Windows NT database should also be used for password authentication. User records added to the database in this way automatically become members of the selected group.

Interface Configuration

Follow these steps in the Interface Configuration window:

Note When you select any Point-to-Point Protocol (PPP), you must also enable PPP LCP.

Step 2   To add more controls for dial-in access, check the applicable features in the Interface Configuration: Advanced Options window to display the options in the user interface. Select the features in this section to reduce the level of complexity or enhance the detail of your access security.

Group Setup

Follow these steps in Group Setup for the Default Group:

Step 2   To permit or deny users to call only from a particular location, enter the applicable information in the Network Access Restrictions field. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Step 3   To control the number of simultaneous sessions allowed to a group and to specify the number of sessions allowed to users in the groups, enter the applicable number in the MaxSessions fields. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Note The Max Sessions count defined in the User Setup window overrides the Max Sessions per-user count in the Group Setup window.

Step 4   To allow the NAS to support dialup clients running IP over a PPP (async or ISDN) connection, enable PPP-IP. If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

Step 5   To make CiscoSecure ACS a "DHCP-like" server, enable IP Pool and enter the IP Pool name defined on the NAS. To use a NAS-name pool, leave the field blank.

Step 6   To allow the NAS to support dialup clients running IPX over a PPP (async or ISDN) connection, enable PPP-IPX. If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

Step 7   To allow Telnet sessions to be run by the client or to allow CiscoSecure ACS to also be used for NAS management, enable Shell (Exec). If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

User Setup

User setup is not necessary; users who successfully authenticate against the Windows NT user database are added to the CiscoSecure ACS user database as members of the default group, Default Group. You can reassign them to another group later.

NAS Configuration

Cisco IOS configuration for the NAS depends on the network protocol, routing, IP address definition, access control list definition, and so on. The following sample configuration shows the minimum requirements for a Cisco 2509 access server using TACACS+. PAP or MS-CHAP can be used when authenticating against Windows NT.

Enter the following command under each interface used for dial-in access:

or

Client Configuration

The client can be an async or integrated services digital network (ISDN) client. For an ISDN client, be sure it is configured to use PAP or MS-CHAP.

Windows 95 Client Configuration

Follow these steps in the Dial-Up Networking section of Windows 95:

Step 2   Right-click the Connection icon and select Properties.

Step 3   Click Server Type.

Step 4   For the Type of Dial-Up Server, click PPP.

Step 5   Under Advanced Options, check Log on to Network to log on to the Windows NT domain.

Step 6   Clear the require encrypted password check box.

Step 7   In Server Types: Allowed Network Protocols, click IP and/or IPX.

Step 8   If you are using an IP pool on the NAS (not assigning the IP address at the client), set TCP/IP settings to server assigned IP Address and server assigned name.

Note The NAS must support IP Pools.

Step 9   To set up single login, install the Client for Microsoft Networks under the Network Configuration, and set the Primary Network Logon to Windows Logon.

Step 10   For single login, in the properties for Client for Microsoft Networks, leave Log on to Windows NT Domain disabled, but enter the desired domain in the Windows NT Domain field.

Step 11   When making a connection, enter the same username and password being used for the user account in the Windows NT user database.

Step 12   For single login, in the Connect To dialog box, click save password. Make sure you have the Windows 95 service pack installed so the password is saved. Check with your system administrator to find out if the service pack has been installed.

Tips

Consider the following:

Dialup Using the CiscoSecure ACS User Database with TACACS+

This sample configuration lets you set a higher level of authentication security, such as CHAP, or increase authentication/authorization processing speed. Service providers can use this configuration when transaction speed is critical. Corporations in which the administrator would rather allow a single login to a Windows NT domain than have the added level of security of one-time passwords (OTPs) with CHAP can also use this configuration.

Windows NT Server Configuration

No Windows NT Server configuration is required; users do not need to exist in the Windows NT user database unless they need to log in to the Windows NT network.

CiscoSecure ACS Configuration

Configure these items in CiscoSecure ACS.

Network Configuration

Follow these steps in the Network Configuration window:

Step 2   Add or edit a NAS.

Step 3   Enter the name of the NAS.

Step 4   Enter the IP address of the NAS.

Step 5   Enter the shared secret (key) of the NAS and CiscoSecure ACS.

Step 6   Select the TACACS+ protocol.

Step 7   To allow the Service/Protocol to be configurable for a group, in the Protocol Configuration Options window, click TACACS+ (Cisco).

Note When you select any PPP protocol, you must also enable PPP LCP.

Step 8   Use the User Setup window to add a user.

External User Database Configuration (Optional)

Follow these steps in the External User Databases window:

Step 2   Check Fail the attempt.

This sets CiscoSecure ACS to deny authentication unless the user has an active account in the CiscoSecure ACS database.

Interface Configuration

Follow these steps in the Interface Configuration window:

Note When you select any PPP protocol, you must also enable PPP LCP.

Step 2   To add more controls for dial-in access, check the applicable features in the Interface Configuration: Advanced Options window to display the options in the user interface. Select the features in this section to reduce the level of complexity or enhance the detail of your access security.

Group Setup

Follow these steps in Group Setup for the Default Group:

Step 2   To permit or deny users to call only from a particular location, enter the applicable information in the Network Access Restrictions field. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Step 3   To control the number of simultaneous sessions allowed to a group, and to specify the number of sessions allowed to users in the groups, enter the appropriate number in the MaxSessions fields. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Note The Max Sessions count defined in the User Setup window overrides the Max Sessions per user count in the Group Setup window.

Step 4   To allow the NAS to support dialup clients running IP over a PPP (async or ISDN) connection, enable PPP-IP. If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

Step 5   To make CiscoSecure ACS a "DHCP-like" server, enable IP Pool and enter the IP Pool name defined on the NAS. To use a NAS-name pool, leave the field blank.

Step 6   To allow the NAS to support dialup clients running IPX over a PPP (async or ISDN) connection, enable PPP-IPX. If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

Step 7   To allow the client to run Telnet sessions or to allow CiscoSecure ACS to also be used for NAS management, enable Shell (Exec). If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

User Setup

Follow these steps in the User Setup window of CiscoSecure ACS:

Step 2   Select CiscoSecure Database as the method for password authentication.

Step 3   Enter and confirm the password in the first set of the CiscoSecure ACS user database password fields.

Step 4   Assign the user to a group. You can use the Default Group, but it is better to use a different group, such as Group 1.

Note All groups can be renamed, but CiscoSecure ACS tracks all groups by their original number.

Step 5   To permit or deny users to call only from a particular location, enter the applicable information in the Network Access Restrictions field. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Step 6   If you are using dial-in, to assign a particular IP address to the user, enter that address in the Static IP Address field.

Step 7   To set expiration conditions for the user, configure them here.

NAS Configuration

Cisco IOS configuration for the NAS depends on the network protocol, routing, IP address definition, access control list definition, and so on. The following sample configuration shows the minimum requirements for a Cisco 2509 access server using TACACS+.

To allow dial-in access, enter the following command for each interface:

Client Configuration

The client can be an async or ISDN client.

Windows 95 Client

Follow these steps in the Dial-Up Networking section of Windows 95:

Step 2   Right-click the Connection icon and select Properties.

Step 3   Click Server Type and select PPP for Type Of Dial-up Server.

Step 4   Under Advanced Options, check Log on to Network to log on to the Windows NT domain.

Step 5   Clear the require encrypted password check box.

Step 6   Under Server Types: allowed network protocols, check IP and/or IPX.

Step 7   If the NAS is using an IP pool rather than assigning the IP address at the client, set the TCP/IP settings to server assigned IP Address and server assigned name.

Step 8   When making a connection, enter the CiscoSecure ACS user database username and password.

Tips

Consider the following:

Dialup Using SDI Token-Card Server with TACACS+

Using an SDI ACE server for authentication allows you to increase the level of security while still allowing CiscoSecure ACS to authorize the applicable services after a successful authentication.

Windows NT Server Configuration

Configure these items on the Windows NT Server:

CiscoSecure ACS Configuration

Configure these items in CiscoSecure ACS.

Network Configuration

Follow these steps in the Network Configuration window:

Step 2   Add or edit a NAS.

Step 3   Enter the name of the NAS.

Step 4   Enter the IP address of the NAS.

Step 5   Enter the shared secret (key) of the NAS and CiscoSecure ACS.

Step 6   Select TACACS+ (Cisco) as the security control protocol.

External User Database Configuration

To add a new configuration for the external user database, follow these steps:

Step 2   Click Database Configuration.

Step 3   Click SDI SecurID Token Card.

Step 4   Click Create New Configuration. Click Submit to accept the default name.

Step 5   Click Configure to configure and enable CiscoSecure ACS to use the external user database to authenticate users.

Interface Configuration

Follow these steps in the Interface Configuration window:

Note When you select any PPP protocol, you must also enable PPP LCP.

Step 2   To add more controls for dial-in access, check the applicable features in the Interface Configuration: Advanced Options window to display the options in the user interface. Select the features in this section to reduce the level of complexity or enhance the detail of your access security.

Group Setup

Follow these steps in Group Setup for the default group:

Step 2   To permit or deny users to call only from a particular location, enter the applicable information in the Network Access Restrictions field. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Step 3   To control the number of simultaneous sessions allowed to a group and to specify the number of sessions allowed to users in the groups, enter the appropriate number in the MaxSessions fields. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Note The Max Sessions count defined in the User Setup window overrides the Max Sessions per user count in the Group Setup window.

Step 4   CiscoSecure ACS can store ISDN passwords to authenticate the second B channel when it is brought into service. Select one of these token-caching methods:

Step 5   To allow the NAS to support dialup clients running IP over a PPP (async or ISDN) connection, enable PPP-IP. If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

Step 6   To make CiscoSecure ACS a "DHCP-like" server, enable IP Pool and enter the IP Pool name defined on the NAS. To use a NAS-name pool, leave the field blank.

Step 7   To allow the NAS to support dialup clients running IPX over a PPP (async or ISDN) connection, enable PPP-IPX. If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

Note To allow the client to run Telnet sessions or to allow CiscoSecure ACS to also be used for NAS management, enable Shell (Exec). If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

User Setup

Follow these steps in the User Setup window of CiscoSecure ACS:

Step 2   Select SDI SecurID Token Card as the method for password authentication.

Step 3   Enter and confirm the password in the first set of the CiscoSecure ACS user database password fields.

Step 4   Assign the user to a group. You can use the Default Group, but it is better to use a different group, such as Group 1.

Note All groups can be renamed, but CiscoSecure ACS tracks all groups by their original number.

Step 5   To permit or deny users to call only from a particular location, enter the applicable information in the Network Access Restrictions field. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Step 6   If you are using dial-in, to assign a particular IP address to the user, enter it in the Static IP Address field.

Step 7   To set expiration or aging conditions for the user, configure them here.

NAS Configuration

The Cisco IOS configuration for the NAS depends on the network protocol, routing, IP address definition, access control list definition, and so on. The following sample configuration shows the minimum requirements for a Cisco 2509 access server using TACACS+. CHAP can be used because the CiscoSecure ACS user database is being used.

Enter the one of the following commands under each interface used for dial-in access:

or

Client Configuration

The client can be an async or ISDN client.

Windows 95 Client

Follow these steps in the Dial-Up Networking section of Windows 95:

Step 2   Right-click the Connection icon and click Properties.

Step 3   Click the Server Type tab.

Step 4   For the Type of Dial-Up Server, select PPP.

Step 5   Under Advanced options, check the Log on to Network check box to log on to the Windows NT domain.

Step 6   Clear the Require encrypted password check box.

Step 7   Under Allowed network protocols, check IP and/or IPX.

Step 8   If the NAS is using an IP pool, rather than assigning the IP address at the client, set TCP/IP settings to server assigned IP Address and server assigned name.

Step 9   When you make a connection, enter the username and the token one-time password (OTP) using the correct convention to authenticate successfully.

Tips

Consider the following:

Dialup Using NDS with TACACS+

This configuration presents examples of the information you need to use CiscoSecure ACS with Novell Directory Services (NDS). You can increase the level of security by using NDS for authentication while still allowing CiscoSecure ACS to authorize services after a successful authentication. This section includes examples for a TACACS+ NAS; however, the protocol is transparent to NDS.

Windows NT Server Configuration

Configure these items on the Windows NT Server:

CiscoSecure ACS Configuration

Configure these items in CiscoSecure ACS.

Network Configuration

Follow these steps in the Network Configuration window:

Step 2   Add or edit a NAS.

Step 3   Enter the name of the NAS.

Step 4   Enter the IP address of the NAS.

Step 5   Enter the shared secret (key) of the NAS and CiscoSecure ACS.

Step 6   Select TACACS+ (Cisco) as the security control protocol.

External User Database Configuration

To add a new configuration for the external user database:

Step 2   Click Database Configuration.

Step 3   Click NDS Database.

Step 4   Click Create New Configuration. Click Submit to accept the default name.

Step 5   Click Configure to configure and enable CiscoSecure ACS to use the external user database to authenticate users.

Step 6   (Optional) If this is a first-time configuration, click Initial NDS Configuration and enter the following information:

See your Novell documentation for more information on trees and contexts.

Step 7   Click OK.

Interface Configuration

Follow these steps in the Interface Configuration window:

Note When you select any PPP protocol, you must also enable PPP LCP.

Step 2   To add more controls for dial-in access, check the applicable features in the Interface Configuration: Advanced Options window to display the options in the user interface. Select the features in this section to reduce the level of complexity or enhance the detail of your access security.

Group Setup

Follow these steps in Group Setup for the Default Group:

Step 2   To permit or deny users to call only from a particular location, enter the applicable information in the Network Access Restrictions field. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Step 3   To control the number of simultaneous sessions allowed to a group, and to specify the number of sessions allowed to users in the groups, enter the appropriate number in the Max Sessions fields. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Note The Max Sessions count defined in the User Setup window overrides the Max Sessions per user count in the Group Setup window.

Step 4   To allow the NAS to support dialup clients running IP over a PPP (async or ISDN) connection, enable PPP-IP. If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

Step 5   To make CiscoSecure ACS a "DHCP-like" server, enable IP Pool and enter the IP Pool name defined on the NAS. To use a NAS-name pool, leave the field blank.

Step 6   To allow the NAS to support dialup clients running IPX over a PPP (async or ISDN) connection, enable PPP-IPX. If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

Note To allow Telnet sessions to be run by the client or to allow CiscoSecure ACS to also be used for NAS management, enable Shell (Exec). If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

User Setup

Follow these steps in the User Setup window of CiscoSecure ACS:

Step 2   Select NDS Database as the method for password authentication.

Step 3   Assign the user to a group. You can use the Default Group, but it is better to use a different group, such as Group 1.

Note All groups can be renamed, but CiscoSecure ACS tracks all groups by their original number.

Step 4   To permit or deny users to call only from a particular location, enter the applicable information in the Network Access Restrictions field. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Step 5   If you are using dial-in, to assign a particular IP address to the user, enter it in the Static IP Address field.

Step 6   To set expiration conditions for the user, configure them here.

NAS Configuration

The Cisco IOS configuration for the NAS depends on the network protocol, routing, IP address definition, access control list definition, and so on. The following sample configuration shows the minimum requirements for a Cisco 2509 Access Server using TACACS+. NDS requires PAP authentication.

Enter the following command under each interface used for dial-in access:

Client Configuration

The client can be an async or ISDN client.

Windows 95 Client

Follow these steps in the Dial-Up Networking section of Windows 95:

Step 2   Right-click the Connection icon and click Properties.

Step 3   Click the Server Type tab.

Step 4   For the Type of Dial-Up Server, select PPP.

Step 5   Under Advanced options, check the Log on to Network check box to log on to the Windows NT domain.

Step 6   Clear the Require encrypted password check box.

Step 7   Under Allowed network protocols, check IP and/or IPX.

Step 8   If the NAS is using an IP pool, rather than assigning the IP address at the client, set TCP/IP settings to server assigned IP Address and server assigned name server address.

Tips

Consider the following:

Dialup Using a CRYPTOCard Token-Card Server with TACACS+

This configuration shows how to implement CiscoSecure ACS with the CRYPTOCard token-card server. To increase the level of security by using a token card, you can use the CRYPTOCard server for authentication while still letting CiscoSecure ACS authorize the services after a successful authentication.

Windows NT Server Configuration

Configure these items on the Windows NT Server:

CiscoSecure ACS Configuration

Configure these items in CiscoSecure ACS.

Network Configuration

Follow these steps in the Network Configuration window:

Step 2   Add or edit a NAS.

Step 3   Enter the name of the NAS.

Step 4   Enter the IP address of the NAS.

Step 5   Enter the shared secret (key) of the NAS and CiscoSecure ACS.

Step 6   Select TACACS+ (Cisco) as the security control protocol.

External User Database Configuration

To add a new configuration for the external user database:

Step 2   Click Database Configuration.

Step 3   Click CRYPTOCard Token Card Configuration to allow CiscoSecure ACS to support the CRYPTOCard token card. Enter CRYPTOCard in the field.

Step 4   In the CRYPTOCard Directory field, enter the full directory path in which the CRYPTOCard files are located. The directory must contain the CRYPTOCard and CCSecret files; otherwise, a configuration error occurs. Click Submit. A window opens that allows you to test your CRYPTOCard token server configuration.

Step 5   (Optional) To verify the configuration of your CRYPTOCard token server, click Test.

Interface Configuration

Follow these steps in the Interface Configuration window:

Note When you select any PPP protocol, you must also enable PPP LCP.

Step 2   To add more control for dial-in access, check the applicable features in the Interface Configuration: Advanced Options window to display the options in the user interface. Select the features in this section to reduce the level of complexity or enhance the detail of your access security.

Group Setup

Follow these steps in Group Setup for the Default Group:

Step 2   To permit or deny users to call only from a particular location, enter the applicable information in the Network Access Restrictions field. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Step 3   To control the number of simultaneous sessions allowed to a group and to specify the number of sessions allowed to users in the groups, enter the appropriate number in the Max Sessions fields. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Note The Max Sessions count defined in the User Setup window overrides the Max Sessions per user count in the Group Setup window.

Step 4   CiscoSecure ACS can store ISDN passwords to authenticate the second B channel when it is brought into service. Select one of these token-caching methods:

Step 5   To allow the NAS to support dialup clients running IP over a PPP (async or ISDN) connection, enable PPP-IP. If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

Step 6   To make CiscoSecure ACS a "DHCP-like" server, enable IP Pool and enter the IP Pool name defined on the NAS. To use a NAS-name pool, leave the field blank.

Step 7   To allow the NAS to support dialup clients running IPX over a PPP (async or ISDN) connection, enable PPP-IPX. If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

Note To allow Telnet sessions to be run by the client or to allow CiscoSecure ACS to also be used for NAS management, enable Shell (Exec). If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

User Setup

Follow these steps in the User Setup window of CiscoSecure ACS:

Step 2   Select CRYPTOCard Token Card as the method for password authentication.

Step 3   If you are using CHAP authentication, enter and confirm the password in the first set of the CiscoSecure ACS user database password fields.

Step 4   Assign the user to a group. You can use the Default Group, but it is better to use a different group, such as Group 1.

Note All groups can be renamed, but CiscoSecure ACS tracks all groups by their original number.

Step 5   To permit or deny users to call only from a particular location, enter the applicable information in the Network Access Restrictions field. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Step 6   If you are using dial-in, to assign a particular IP address to the user, enter it in the Static IP Address field.

Step 7   To set expiration or aging conditions for the user, configure them here.

NAS Configuration

The Cisco IOS configuration for the NAS depends on the network protocol, routing, IP address definition, access control list definition, and so on. The following sample configuration shows the minimum requirements for a Cisco 2509 access server using TACACS+. CHAP can be used because the CiscoSecure ACS user database is being used:

Enter the following command under each interface used for dial-in access:

Client Configuration

The client can be an async or ISDN client.

Windows 95 Client

Follow these steps in the Dial-Up Networking section of Windows 95:

Step 2   Right-click the Connection icon and select Properties.

Step 3   Click Server Type and select PPP for the Type of Dial-Up Server.

Step 4   Under Advanced Options, check Log on to Network to log on to the Windows NT domain.

Step 5   Clear the require encrypted password check box.

Step 6   Under Server Types: allowed network protocols, check IP and/or IPX.

Step 7   If the NAS is using an IP pool rather than assigning the IP address at the client, set TCP/IP settings to server assigned IP Address and server assigned name server address.

Step 8   When making a connection, enter the username and the token OTP using the correct convention to authenticate successfully:

Tips

Consider the following:

Dialup Using the CiscoSecure ACS User Database with Cisco RADIUS

This dialup configuration can be used by administrators who want to use RADIUS authentication/authorization processing. Administrators who need to support non-Cisco equipment might use RADIUS. CiscoSecure ACS supports Cisco, Internet Engineering Task Force (IETF), Ascend, and RedCreek RADIUS attributes.

Windows NT Server Configuration

No Windows NT server Configuration is required; users do not need to exist in the Windows NT database unless they need to log in to the Windows NT network.

CiscoSecure ACS Configuration

Configure these parameters in CiscoSecure ACS.

Network Configuration

Follow these steps in the Network Configuration window:

Step 2   Add or edit a NAS.

Step 3   Enter the name of the NAS.

Step 4   Enter the IP address of the NAS.

Step 5   Enter the shared secret (key) of the NAS and the CiscoSecure ACS.

Step 6   Click RADIUS (Cisco) under the Protocol Configuration Options and make sure the vendor-specific attribute (26) is selected.

Step 7   Click RADIUS (IETF) under the Protocol Configuration Options to select the Protocol to be configurable for a group.

Interface Configuration

Follow these steps in the Interface Configuration window:

Step 2   To add more controls for dial-in access, check the applicable features in the Interface Configuration: Advanced Options window to display the options in the user interface. Select the features in this section to reduce the level of complexity or enhance the detail of your access security.

Group Setup

Configure the following parameters in the Group Setup window for the desired group:

If these parameters are not displayed, configure them in the NAS Configuration window.

User Setup

Follow these steps in the User Setup window of CiscoSecure ACS:

Step 2   Select the CiscoSecure ACS user database as the method for password authentication.

Step 3   Enter and confirm a password in the first set CiscoSecure ACS User Database password fields.

Step 4   Assign the user to a group. You can use the Default Group, but it is better to use a different group, such as Group 1.

Step 5   To set expiration conditions for the user, configure them here.

Step 6   If you are using dial-in, to assign a particular IP address to the user, enter it in the Static IP Address field.

NAS Configuration

The Cisco IOS configuration for the NAS depends on the network protocol, routing, IP address definition, access control list definition, and so on. The following sample configuration shows the minimum requirements for a Cisco 2509 access server using RADIUS. CHAP can be used because the CiscoSecure ACS user database is being used:

Enter one of the following commands under each interface used for dial-in access:

or

Client Configuration

The client can be an async or ISDN client.

Windows 95 Client

Follow these steps in the Dial-Up Networking section of Windows 95:

Step 2   Right-click the Connection icon and click Properties.

Step 3   Click the Server Type tab.

Step 4   For the Type of Dial-Up Server, select PPP.

Step 5   Under Advanced options, check the Log on to Network check box to log on to the Windows NT domain.

Step 6   Clear the Require encrypted password check box.

Step 7   Under Allowed network protocols, check IP.

Step 8   If the NAS is using an IP pool, rather than assigning the IP address at the client, set TCP/IP settings to server assigned IP Address and server assigned name server address.

Tips

Consider the following:

Dialup for an ARAP Client Using the CiscoSecure ACS User Database with TACACS+

This section provides instructions for configuring a client using ARAP with TACACS+. The necessary (non-AAA) ARAP configuration parameters must already be configured on the NAS.

CiscoSecure ACS Configuration

Configure these items in the CiscoSecure ACS.

Network Configuration

Follow these steps in the Network Configuration window:

Step 2   Add or edit the NAS.

Step 3   Enter the name of the NAS.

Step 4   Enter the IP address of the NAS.

Step 5   Enter the shared secret (key) of the NAS and the CiscoSecure ACS.

Step 6   Select TACACS+ (Cisco) as the security control protocol.

Step 7   Under the Protocol Configuration Options, click TACACS+ (Cisco) and select the ARAP Protocol.

Interface Configuration

Follow these steps in the Interface Configuration window:

Step 2   To add more controls for dial-in access, check the applicable features in the Interface Configuration: Advanced Options window to display the options in the user interface. Select the features in this section to reduce the level of complexity or enhance the detail of your access security.

Group Setup

Follow these steps in Group Setup for the Default Group:

Step 2   To permit or deny users to call only from a particular location, enter the applicable information in the Network Access Restrictions field. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Step 3   To control the number of simultaneous sessions allowed to a group and to specify the number of sessions allowed to users in the groups, enter the applicable number in the Max Sessions fields. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Note The Max Sessions count defined in the User Setup window overrides the Max Sessions per user count in the Group Setup window.

Step 4   To allow the NAS to support dialup clients, enable ARAP.

Step 5   To allow Telnet sessions to be run by the client or to allow the CiscoSecure ACS to also be used for NAS management, enable Shell (Exec). If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

User Setup

Follow these steps in the CiscoSecure ACS from User Setup:

Step 2   Select the CiscoSecure ACS user database as the method for Password authentication, and enter/reconfirm a password in the first set CiscoSecure ACS User Database password fields.

Step 3   Assign the user to a group. You can use Default Group, but it is better to use a different group, such as Group 1.

Step 4   To set expiration or aging conditions for the user, configure them here.

NAS Configuration

The Cisco IOS configuration for the NAS depends on the network protocol, routing, IP address definition, access control list definition, and so on. The following sample configuration shows the minimum requirements for a Cisco 2509 access server using TACACS+ and ARAP:

Enter the following commands under each line used for dial-in access with ARAP:

Client Configuration

The client configured in this example is an Apple Macintosh Power PC running MAC/OS 7.5.5 and using AppleTalk Remote Access V.2.1 software.

Step 2   Configure these items in the Connect As section:

Step 3   Click Connect to initiate a call.

NAS Management Using the CiscoSecure ACS User Database with TACACS+

This section describes how to enhance security when accessing NAS configuration. Using command authorizations and administrative privilege levels can enhance secure access to the NAS's configuration. IS managers can use this method to control and monitor the administration activity of their NASes.

Windows NT Server Configuration

No Windows NT server configuration is required; users do not need to exist in the Windows NT database unless they need to log in to the Windows NT network.

CiscoSecure ACS Configuration

Configure these items in CiscoSecure ACS.

Network Configuration

Follow these steps in the Network Configuration window:

Step 2   Add or edit a NAS.

Step 3   Enter the name of the NAS.

Step 4   Enter the IP address of the NAS.

Step 5   Enter the shared secret (key) of the NAS and the CiscoSecure ACS.

Step 6   Select TACACS+ (Cisco) as the security control protocol.

Step 7   If CiscoSecure ACS is configured on the NAS, select single TCP connection to configure it to use this feature.

Interface Configuration

Follow these steps in the Interface Configuration window:

Note When you select any PPP protocol, you must also enable PPP LCP.

Step 2   To add more controls for dial-in access, check the applicable features in the Interface Configuration: Advanced Options window to display the options in the user interface. Select the features in this section to reduce the level of complexity or enhance the detail of your access security.

Group Setup

Follow these steps in Group Setup for the Default Group:

Step 2   To permit or deny users to call only from a particular location, enter the applicable information in the Network Access Restrictions field. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Step 3   To control the number of simultaneous sessions allowed to a group and to specify the number of sessions allowed to users in the groups, enter the appropriate number in the Max Sessions fields. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Note The Max Sessions count defined in the User Setup window overrides the Max Sessions per user count in the Group Setup window.

Step 4   To allow the NAS to support dialup clients running IPX over a PPP (async or ISDN) connection, enable PPP-IPX. If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

Note To allow Telnet sessions to be run by the client or to allow CiscoSecure ACS to also be used for NAS management, enable Shell (Exec). If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

Step 5   Assign the authorization privilege level for the group in the Shell (exec) section.

Step 6   To permit or deny Cisco IOS commands in the CiscoSecure ACS Group Setup, make sure the proper command authorization has been configured on the NAS. (See the section "NAS Configuration.")

Step 7   To permit or deny authorization of any command not specified for the group, click the Permit/Deny button on the Unmatched Cisco IOS Commands section.

Step 8   Select the Command check box and enter the command to authorize in the dialog box. Add the argument(s) of the command to be permitted or denied. For example, for the command show, enter:

Step 9   Click the button to permit or deny all unlisted arguments for the command being configured.

Step 10   To enter another command, click Submit, then click Edit Group Settings. Scroll down and configure another command for authorization until you have entered all your commands. To activate the changes immediately, click Submit and Restart.

User Setup

Follow these steps in the CiscoSecure ACS User Setup window:

Step 2   Select CiscoSecure ACS User Database as the method for password authentication.

Step 3   Enter and confirm a password in the first set CiscoSecure ACS User Database password fields.

Step 4   Assign the user to a group. You can use Default Group, but it is better to use a different group, such as Group 1.

Step 5   To permit or deny users to call only from a particular location, enter the applicable information in the Network Access Restrictions field. User definition overrides group definition.

Step 6   If you are using dial-in, to assign a particular IP address to the user, enter it in the Static IP Address field.

Step 7   To set expiration conditions for the user, configure them here.

Step 8   To authenticate the user by privilege level, in the Advanced TACACS+ Settings window, enable the TACACS+ Enable Control. Enter and confirm the password to be used when accessing enable mode on the NAS.

Note To enable the Advanced TACACS+ Settings, in the Interface Configuration: Advanced Options window, click TACACS+ (Cisco).

Token-Server Configuration

No token-server configuration is required; token card servers are not used in this configuration.

NAS Configuration

The Cisco IOS configuration for the NAS depends on the network protocol, routing, IP address definition, access control list definition, and so on. The following sample configuration shows the minimum requirements for a Cisco 2509 access server using TACACS+ that can authorize NAS commands and grant privilege-level authentication, if commands are other than 1 and 15 are enabled. CHAP can be used because the CiscoSecure ACS user database is being used:

Enter one of the following commands under each interface used for dial-in access:

or

Client Configuration

The client can be an async or ISDN client or reside on the network.

Windows 95 Client

Follow these steps in the Dial-Up Networking section of Windows 95:

Step 2   Right-click the Connection icon and click Properties.

Step 3   Click the Server Type tab.

Step 4   For the Type of Dial-Up Server, select PPP.

Step 5   Under Advanced options, check the Log on to Network check box to log on to the Windows NT domain.

Step 6   Clear the Require encrypted password check box.

Step 7   Under Allowed network protocols, check IP and/or IPX.

Step 8   If the NAS is using an IP pool, rather than assigning the IP address at the client, set TCP/IP settings to server assigned IP Address and server assigned name.

Step 9   When the connection comes up, enter the username and password entered in the CiscoSecure ACS user database.

Tips

Consider the following:

Password Aging and User-Changeable Passwords Using CiscoSecure ACS with the CiscoSecure Authentication Agent

You can use the CiscoSecure Authentication Agent (CAA) with CiscoSecure ACS to notify users to change their passwords before they expire and to allow users to change their own passwords. This feature uses the CAA Messaging Service and the new CiscoSecure Control Message Protocol (CCMP).

Web Server Configuration

In order to use CAA, you must install and configure a web server. SSL is not required. CAA must be installed on a PC running Windows 95 or Windows NT. See the Web Server Installation for CiscoSecure ACS for Windows NT User-changeable Passwords quick reference card for instructions.

CiscoSecure ACS Configuration

Configure these items in the CiscoSecure ACS.

User Setup

Follow these steps in the User Setup window of CiscoSecure ACS:

Step 2   Assign a CHAP or PAP password to the user.

Step 3   Map the user to the group that is configured to use password aging.

Group Setup

Follow these steps in the Group Setup window of CiscoSecure ACS:

Step 2   In the Apply age-by-uses rules section, select the number of logins after which to issue warning or require changes.

Note If you do not want users to ever be notified, enter -1 in these boxes.

Step 3   To force the user to change the password on the first login after an administrator has changed the password, check the Apply password change rule check box.

Step 4   To issue a greeting or message at each successful login, check the Generate greetings for successful logins check box. This message is displayed in the CAA.

Network Configuration

Follow these steps in the Network Configuration window:

Step 2   Add or edit a NAS.

Step 3   Enter the name of the NAS.

Step 4   Enter the IP address of the NAS.

Step 5   Enter the shared secret (key) of the NAS and CiscoSecure ACS.

Step 6   Select TACACS+ (Cisco) as the security control protocol.

System Configuration

Follow these steps in the System Configuration window:

Step 2   Enter the minimum and maximum length you want to require for the password. The default password length is from 4 through 32 characters.

Step 3   Check one or more of the following check boxes:

Interface Configuration

In the Interface Configuration window click Advanced Options and check the Group-Level Password Aging check box.

Administration Control

If you want the administrator to be able to control the Password Aging options, click Administration Control. In the Administrator Privileges: System Configuration section, check the Password Validation check box.

Reports & Activity

If the password has aged, the account is expired, not disabled; expired accounts are reflected in the Disabled Accounts report. If the user attempts to log in to an expired account, this action is logged in the Failed Attempts report.

NAS Configuration

The following sample configuration can be used for an analog dial-up networking user with a NAS-assigned dynamic IP address. This sample is for a Cisco AS5200 access server using TACACS+. Adjust the sample to match your individual requirements.

The term list-name used below in the command description refers to any character string (a name) used to represent a particular list of authentication method(s) for that login type.

Client Configuration

Install the CAA client software using the self-extracting file provided with the CAA software. See the Quick Start Guide for the CiscoSecure Authentication Agent for instructions.

Follow the instructions in the readme file provided with the CAA client software to configure the CAA software.

Configure Dial-Up Networking on the Windows 95 or Windows NT workstation or server from which you will dial in. See your Microsoft documentation for instructions.

Tips

Consider the following:

Single Authentication Using CiscoSecure ACS and the CAA

Single Authentication uses the special Cisco EIOS image release 4.2(13) or later to provide a simple CHAP or PAP authentication. Single Authentication uses Cisco 76x or Cisco 77x routers that are equipped with the special UDP SOHO client packet. Only one PC at a time can communicate through the Cisco 76x/77x device, and only one PC at a time can have a Telnet session or an Active Monitor status into the Cisco 76x/77x device.

Windows NT Server Configuration

No special configuration is required for the Windows NT server.

CiscoSecure ACS Configuration

Configure these items in the CiscoSecure ACS.

Network Configuration

Follow these steps in the Network Configuration window:

Step 2   Add or edit a NAS.

Step 3   Enter the name of the NAS.

Step 4   Enter the IP address of the NAS.

Step 5   Enter the shared secret (key) of the NAS and CiscoSecure ACS.

Step 6   Select TACACS+ (Cisco) as the security control protocol.

Group Setup

Create an ISDN small office/home office (SOHO) group.

User Setup

Create a standard ISDN user who will authenticate using a token card database, and/or map the user to the ISDN SOHO group.

Router Configuration

Add the following statements to the SET USER LAN section of the Cisco 76x/77x device's configuration file:

Add the following statements to the configuration file to create a host NAS profile:

Client Configuration

Configure the CAA for Single Authentication mode. See your CAA documentation for instructions.

Tips

Consider the following:

Double Authentication Using CiscoSecure ACS and the CAA

Some token cards require you to use double authentication with an ISDN connection. See your token card documentation to see if your particular card requires this feature.

Double authentication consists of a two-part challenge.

In the first challenge, either CHAP or PAP authenticates the SOHO NAS and allows the NAS to establish the connection to the NAS. PPP then negotiates with the AAA server to authorize the SOHO NAS to access the NAS's network. This challenge also triggers CiscoSecure ACS to download the first access control list (ACL) and apply it against the ISDN port of the NAS. The ACL assigns the network access privileges, and the SOHO and its users are only allowed to Telnet to the NAS.

In the second challenge, SOHO users must Telnet to the NAS to be user-authenticated. When SOHO users log in, they are authenticated with AAA login authentication. CAA users can simply right-click to access the Connect option and establish the required Telnet session. Users are automatically prompted to enter the username and password. The Telnet service negotiates with CiscoSecure ACS to authorize users to access the NAS network. When authorization is complete, users have been double-authenticated and can access the network according to their per-user network privileges. The second challenge also triggers the second ACS to download the ACS and apply it against the ISDN port on the NAS to which the SOHO connection has already been established.

Windows NT Server Configuration

No special Windows NT server configuration is required.

CiscoSecure ACS Configuration

Define the access control lists (ACLs) and network access privileges of the SOHO and its users on CiscoSecure ACS.

Network Configuration

Follow these steps in the Network Configuration window:

Step 2   Add or edit a NAS.

Step 3   Enter the name of the NAS.

Step 4   Enter the IP address of the NAS.

Step 5   Enter the shared secret (key) of the NAS and CiscoSecure ACS.

Step 6   Select TACACS+ (Cisco) as the security control protocol.

External User Databases Configuration

Configure the database for the token card you are using. See the "External User Databases" section in "Step-by-Step Configuration for CiscoSecure ACS," for instructions.

User Setup

Add or edit a user.

Group Setup

Add an ISDN SOHO group. The following TACACS+ statements must be included in the double-authentication user's or group's profile. Users on the same SOHO 802.3 segment inherit the capabilities and limitations of the first session established.

Step 2   In the Custom Attributes section, assign PPP/IP to the group by adding the following statement:

Make sure PPP LCP and ppp multilink are checked.

Step 3   Add the SOHO device to the first authentication group and assign it a standard CHAP password.

Step 4   Add a second authentication group which will include the actual users.

Step 5   In the Custom Attributes section, assign PPP/IP to the group by adding the following statements:

Make sure PPP LCP, Shell (exec), and AutoCommand are checked. AutoCommand is defined for the access profile only at the per-user level.

Step 6   Map the CHAP password user or token card user to the second authentication group.

NAS Configuration

Add the following configuration to the NAS.

SOHO Router Configuration

Enter the following commands in the configuration file on the SOHO router:

Tips

Consider the following:

Authentication Using CiscoSecure ACS and an MCIS LDAP Database

This sample configuration supports authentication via the Microsoft Commercial Internet System (MCIS) Lightweight Directory Access Protocol (LDAP) authenticator.

Windows NT Server Configuration

To use MCIS LDAP authentication, you must have Microsoft Site Server 3.0 or MCIS 2.0 installed on the server. See your Microsoft documentation for more information.

Follow these steps on the membership server:

Step 2   Enable clear text/basic authentication for the LDAP directory instance.

Step 3   The password is in clear text and is not encrypted. To increase security, click the Use Secure Authentication check box, the Use Encryption check box, or both.

Step 4   Make sure user objects are located in the Members container (ou=members) and are of the type "Member."

Step 5   Make sure the common name (cn=MarySmith) property exactly matches the username entered during dial-in.

Step 6   Make sure the user-object's Account-Status property is set to Active (1).

CiscoSecure ACS Configuration

Configure these items in the CiscoSecure ACS.

Network Configuration

Follow these steps in the Network Configuration window:

Step 2   Add or edit a NAS.

Step 3   Enter the name of the NAS.

Step 4   Enter the IP address of the NAS.

Step 5   Enter the shared secret (key) of the NAS and CiscoSecure ACS.

Step 6   Select TACACS+ (Cisco) as the security control protocol.

Administration Control

To allow the administrator to configure MCIS LDAP options, in the Administrator Privileges section, check User & Group Setup, External User Databases, and any other applicable check boxes.

External User Databases Configuration

Configure these items in the External User Databases window:

For more information, see the "MCIS LDAP Configuration" section in "Step-by-Step Configuration for CiscoSecure ACS."

User Setup

Add or edit the user profile and either assign the user to an MCIS LDAP group, or overwrite the group profile.

Group Setup

Configure an MCIS LDAP group.

NAS Configuration

No special NAS configuration is required.

Client Configuration

No special client configuration is required.

Tips

Consider the following:

PIX Firewall Authentication/Authorization Using the Windows NT User Database with TACACS+

This is a typical configuration that you can use in a Windows NT network that resides behind a PIX firewall and uses only the Windows NT user database to maintain authentication information. Businesses with a significant investment or strategic direction based on Windows NT can use this configuration to control connectivity through a PIX firewall using Windows NT for authentication and the CiscoSecure ACS for authorization.

Windows NT Server Configuration

Because it depends greatly on Windows NT management functions, this configuration requires significant configuration of the Windows NT server.

Configure these items in the User Manager of your Windows NT server running CiscoSecure ACS:

CiscoSecure ACS Configuration

Configure these items in the CiscoSecure ACS.

Network Configuration

Follow these steps in the Network Configuration window:

Step 2   Add or edit a PIX (NAS).

Step 3   Enter the name of the PIX (NAS).

Step 4   Enter the IP address of the PIX (NAS).

Step 5   Enter the shared secret (key) between the PIX (NAS) and the CiscoSecure ACS.

Step 6   Select TACACS+ (Cisco) as the security control protocol.

External User Databases Configuration

If CiscoSecure ACS was initially installed so that it did not authenticate usernames against the Windows NT database, you must add a new configuration to allow this function.

Step 2   Click Create a new configuration.

Step 3   Click Submit to accept the default name.

Step 4   Click Configure to allow Grant dialin permission to user. CiscoSecure ACS verifies that dialup permission is granted for this user in the Windows NT user database. If users without dialup permission on the Windows NT server try to log in, authentication fails, even if they use the correct password. If you do not want to use this feature, clear the check box and click Submit.

Step 5   The Unknown User Policy window controls how CiscoSecure ACS behaves when a username is not found in the CiscoSecure ACS user database. Configure this option to ensure that all authentications without matching usernames in the CiscoSecure ACS user database are checked against the Windows NT database. If this authentication succeeds, a record is automatically generated in the CiscoSecure ACS database indicating the database to use for password authentication. User records added to the database this way automatically become members of the selected group.

Interface Configuration

Follow these steps in the Interface Configuration window:

Note When you select any PPP protocol, you must also enable PPP LCP.

Step 2   To add more controls for dial-in access, check the applicable features in the Interface Configuration: Advanced Options window to display the options in the user interface. Select the features in this section to reduce the level of complexity or enhance the detail of your access security.

Group Setup

Follow these steps in Group Setup for the Windows NT Users group:

Step 2   Enable Shell (Exec) to allow the client to run Telnet sessions for FTP and HTTP. With the commands:

in addition to authentication, when a user tries to do FTP, Telnet, or HTTP inbound, command authorization requests come in to CiscoSecure ACS. If you want users to be able to do "http 1.1.1.1," all Telnets, and "ftp 2.2.2.2," add command authorization to CiscoSecure ACS as follows:

User Setup

User setup is not required; users who successfully authenticate against the Windows NT user database are automatically added to the CiscoSecure ACS user database; you can reassign them later to groups with different authorization levels.

PIX Configuration

This sample configuration for a Cisco PIX firewall allows any inbound traffic (HTTP, FTP, or Telnet) as long as the user is authenticated and authorized. Notations have been added to this configuration to allow variations to be configured to deny authentication and/or authorization:

Client Configuration

No other client configuration is necessary for this application; however, you might need to enable authentication forwarding support on your browser.

Tips

With this configuration you can leverage all of the benefits of the Windows NT operating system such as Primary Domain Controller/Backup domain Controller (PDC/BDC) database replication and distribution.

VPDN Using the CiscoSecure ACS User Database with TACACS+

Use this configuration to create secure connections over a public infrastructure. You can use the CiscoSecure ACS to provide authentication, authorization, and accounting for Virtual Private Dialup Networks (VPDNs) using the L2F tunneling protocol. Service providers can use this method to create the service and procure it by the corporate customers. This configuration requires both types of users to have an ACS at both the NAS and home gateway (HG) locations.

The CiscoSecure ACS is used at the originating end of the VPDN tunnel (the site into which the VPDN user dials, often called the ISP NAS) and at the end of the tunnel (the private network that terminates the VPDN tunnel, called the home gateway or HG).

Figure 10-1   VPDN and the CiscoSecure ACS

The creation of a tunnel can be described in two major processes that take place after the client dials in:

1. Creating a VPDN Tunnel

2. Client Authentication and Authorization

Creating a VPDN Tunnel

1. The ISP NAS uses the VPDN domain to get information from the ACS (ISP) about where the tunnel should be built for that user (Tunnel ID and HG address).

2. The ISP NAS then uses the information (Tunnel ID) to request authentication for the tunnel from the NAS (HG).

3. The NAS forwards the information (Tunnel ID) to the ACS (HG) to authenticate the request.

4. When the information (Tunnel ID) is validated, the tunnel has been created.

Client Authentication and Authorization

1. The ISP NAS requests authentication for the user by the ACS (HG).

2. The ACS (HG) returns authentication and authorization responses to the ISP NAS.

3. After validation, the client has a secure connection through the tunnel with permissions assigned by the ACS at the corporate site (HG).

Windows NT Server Configuration (ISP)

No Windows NT server configuration is required; users do not need to exist in the Windows NT database unless they need to log in to the Windows NT network.

CiscoSecure ACS Configuration (ISP)

Configure these items on the CiscoSecure ACS at the ISP end of the VPDN connection.

Network Configuration

Follow these steps in the Network Configuration window:

Step 2   Add or edit the NAS.

Step 3   Enter the name of the NAS (this is only for identification by the administrator).

Step 4   Enter the IP address of the NAS.

Step 5   Enter the shared secret (key) of the NAS and the CiscoSecure ACS.

Interface Configuration

Follow these steps in the Interface Configuration window:

Note When you select any PPP protocol, you must also enable PPP LCP.

Step 2   Click PPP-VPDN and click Submit. This displays the PPP-VPDN option under Group Setup when it is time to configure that section.

Group Setup

Follow these steps in Group Setup for Group 1:

Step 2   Enter CISCO_TUNNEL. This is the Tunnel ID, which is the username.

Step 3   Enter the IP address of the HG NAS.

User Setup

Follow these steps in User Setup:

Step 2   Assign the user to Group 1.

Step 3   Add a second user to the CiscoSecure ACS user database for authentication. This username is the name of the Tunnel ID. For this example use cisco_tunnel. A legitimate password is needed for this entry. Enter cisco for this example. Do not configure any other parameters.

Step 4   Assign the second user to Group 1.

NAS Configuration (ISP)

The Cisco IOS configuration for the NAS depends on the network protocol, routing, IP address definition, access control list definition, and so on. The following sample configuration shows the minimum requirements for a Cisco 2509 access server using TACACS+ on a VPDN:

Enter the following command under each interface used for dial-in access:

Windows NT Server Configuration (HG)

No Windows NT server configuration is required; users do not need to exist in the Windows NT database unless they need to log in to the Windows NT network.

CiscoSecure ACS Configuration (HG)

Configure these items on the CiscoSecure ACS at the HG of the VPDN connection.

Network Configuration

Follow these steps in the Network Configuration window:

Step 2   Add or edit the NAS.

Step 3   Enter the name of the NAS (this is only for identification by the administrator).

Step 4   Enter the IP address of the NAS.

Step 5   Enter the shared secret (key) of the NAS and the CiscoSecure ACS.

Step 6   Select TACACS+ as the security control protocol.

Interface Configuration

Follow these steps in the Interface Configuration window:

Note When you select any PPP protocol, you must also enable PPP LCP.

Step 2   To add more controls for dial-in access, check the applicable features in the Interface Configuration: Advanced Options window to display the options in the user interface. Select the features in this section to reduce the level of complexity or enhance the detail of your access security.

Group Setup

Do not configure any parameters in Group Setup for the CISCO_TUNNEL user's group (for example, Group 1). CISCO_TUNNEL is only used for authentication of the tunnel.

Follow these steps in Group Setup for the Group where the user username@CISCO has been placed (for example, Group 2):

Step 2   To permit or deny users to call only from a particular location, enter the applicable information in the Network Access Restrictions field. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Step 3   To allow the NAS to support dialup clients running IP over a PPP (async or ISDN) connection, enable PPP-IP. If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

Step 4   To make CiscoSecure ACS a "DHCP-like" server, enable IP Pool and enter the IP Pool name defined on the NAS. To use a NAS-name pool, leave the field blank.

Step 5   To allow the NAS to support dialup clients running IPX over a PPP (async or ISDN) connection, enable PPP-IPX. If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

Step 6   To allow the client to run Telnet sessions or to allow CiscoSecure ACS to also be used for NAS management, enable Shell (Exec). If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

User Setup

Follow these steps in the User Setup window of CiscoSecure ACS:

Step 2   Assign the username@cisco to a group, for example, the Windows NT Users group.

Step 3   To permit or deny users to call only from a particular location, enter the applicable information in the Network Access Restrictions field. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Step 4   If you are using dial-in, to assign a particular IP address to the user, enter it in the Static IP Address field.

Step 5   To set expiration or aging conditions for the user, configure them here.

Step 6   Add a second user to the CiscoSecure ACS user database for authentication. This username is actually the same name used at the ISP as the Tunnel ID. For this example, use cisco_tunnel. The same legitimate password is needed for this entry. For this example, enter cisco. Do not configure any other parameters.

Step 7   Assign the second user to Group 1.

Administration Control

To allow users to configure CiscoSecure ACS from another workstation, either on the LAN or from a dial-in client, the user must be registered as an administrator. In the Administration Control window, enter the administrator's username and password, and assign the applicable administrator privileges. This username and password have no association with the dialup authentication username and password.

NAS Configuration (HG)

The Cisco IOS configuration for the NAS depends on the network protocol, routing, IP address definition, access control list definition, and so on. The following sample configuration shows the minimum requirements for a Cisco 2509 access server using TACACS+ on a VPDN:

Enter the following command under each interface used for dial-in access:

Client Configuration

The client can be an async or ISDN client.

The client must dial in to the ISP NAS with the name defined at the HG ACS (for example, username@corporation).

Windows 95 Client

Follow these steps in the Dial-Up Networking section of Windows 95:

Step 2   Right-click the Connection icon and click Properties.

Step 3   Click the Server Type tab.

Step 4   For the Type of Dial-Up Server, select PPP.

Step 5   Under Advanced options, check the Log on to Network check box to log on to the Windows NT domain.

Step 6   Clear the Require encrypted password check box.

Step 7   Under Allowed network protocols, check IP and/or IPX.

Step 8   If the NAS is using an IP pool, rather than assigning the IP address at the client, set TCP/IP settings to server assigned IP Address and server assigned name.

Step 9   When you make a connection, enter the same username and password for the user account in the Windows NT user database.

Tips

Consider the following:

Virtual Profiles Using the CiscoSecure ACS User Database with TACACS+

This section outlines how you can achieve greater flexibility in supporting access security with virtual profiles. Virtual profiles are specific access profiles you define in CiscoSecure ACS.

Virtual profiles allow you to:

In this example, an access list is applied to a user's dial-in connections. When the user dials in and authenticates, a virtual profile is created and the access list is applied.

Windows NT Server Configuration

No Windows NT server configuration is required; users do not need to exist in the Windows NT database unless they need to log in to the Windows NT network.

CiscoSecure ACS Configuration

Configure these items in the CiscoSecure ACS.

Network Configuration

Follow these steps in the Network Configuration window:

Step 2   Add or edit the NAS.

Step 3   Enter the name of the NAS (this is only for identification by the administrator).

Step 4   Enter the IP address of the NAS.

Step 5   Enter the shared secret (key) of the NAS and the CiscoSecure ACS.

Step 6   Select TACACS+ as the security control protocol.

External User Database Configuration

Follow these steps in the External User Databases window:

Step 2   Click Database Configuration.

Step 3   Click Windows NT.

Step 4   Clear the Grant dialin permission to user check box.

This sets CiscoSecure ACS to deny authentication unless the user has an active account in the CiscoSecure ACS database.

Interface Configuration

Follow these steps in the Interface Configuration window:

Note When you select any PPP protocol, you must also enable PPP LCP.

Step 2   Click Display a window for each service selected in which you can enter customized TACACS+ attributes in the TACACS+(Cisco) window.

Step 3   To add more controls for dial-in access, check the applicable features in the Interface Configuration: Advanced Options window to display the options in the user interface. Select the features in this section to reduce the level of complexity or enhance the detail of your access security.

Group Setup

Follow these steps in Group Setup for the Default Group:

Step 2   To permit or deny users to call only from a particular location, enter the applicable information in the Network Access Restrictions field. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Step 3   To control the number of simultaneous sessions allowed to a group, and to specify the number of sessions allowed to users in the groups, enter the appropriate number in the MaxSessions fields. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Note The Max Sessions count defined in the User Setup window overrides the Max Sessions per user count in the Group Setup window.

Step 4   CiscoSecure ACS can store ISDN passwords to authenticate the second B channel when it is brought into service. Select one of these token caching methods:

Step 5   Enable IP and click the Custom Attributes check box. In the text window enter:

Step 6   To allow the NAS to support dialup clients running IP over a PPP (async or ISDN) connection, enable PPP-IP. If this parameter is not displayed, configure it in the Interface Configuration: TACACS+ (Cisco) window.

Step 7   Enable LCP and check Custom Attributes. In the text window, enter:

User Setup

Follow these steps in the User Setup window of CiscoSecure ACS:

Step 2   Select CiscoSecure Database as the method for password authentication.

Step 3   Enter and confirm the password in the first set of the CiscoSecure ACS user database password fields.

Step 4   Assign the user to a group. You can use the Default Group, but it is better to use a different group, such as Group 1.

Note All groups can be renamed, but the CiscoSecure ACS tracks all groups by their original number.

Step 5   To permit or deny users to call only from a particular location, enter the applicable information in the Network Access Restrictions field. If this parameter is not displayed, enable it in the Interface Configuration: Advanced Options window.

Step 6   If you are using dial-in, to assign a particular IP address to the user, enter the address in the Static IP Address field.

Step 7   To set expiration or aging conditions for the user, configure them here.

NAS Configuration

The Cisco IOS configuration for the NAS depends on the network protocol, routing, IP address definition, access control list definition, and so on. The following sample configuration shows the minimum requirements for a Cisco 2509 access server using TACACS+ that can authorize NAS commands and grant privilege-level authentication. CHAP can be used because the CiscoSecure ACS user database is being used:

virtual-profile virtual-template1

Enter one of the following commands under each interface used for dial-in access:

or

Client Configuration

The client can be an async or ISDN client or reside on the network.

Windows 95 Client

Follow these steps in the Dial-Up Networking section of Windows 95.

Step 2   Right-click the Connection icon and select Properties.

Step 3   Click the Server Type tab.

Step 4   For the Type of Dial-Up Server, select PPP.

Step 5   Under Advanced options, check the Log on to Network check box to log on to the Windows NT domain.

Step 6   Clear the Require encrypted password check box.

Step 7   Under Allowed network protocols, check IP and/or IPX.

Step 8   If the NAS is using an IP pool, rather than assigning the IP address at the client, set TCP/IP settings to server assigned IP Address and server assigned name.

Step 9   When you make a connection, enter the CiscoSecure ACS user database username and password.

Tips

Because the CiscoSecure ACS user database can store PAP and CHAP passwords, you can use PAP or CHAP as the authentication protocol. To use PAP authentication, substitute the word PAP in place of CHAP in the NAS configuration example earlier in this section.