Table of Contents

Database Information Management

Database Information Management

Four features are provided with Cisco Secure  ACS  2.3 for Windows  NT Server (CiscoSecure  ACS):

• System Backup---Backs up the system configuration information to the local hard drive
  
  
• System Restore---Restores the system configuration information from a backup file
  
  
• Database Replication---Copies the CiscoSecure  ACS database information to another CiscoSecure  ACS for backup purposes
  
  
• Relational Database Management System (RDBMS) Synchronization---Synchronizes database information among the RDBMS database sources on the network
  
  

A command-line utility, CSUtil.exe, is also provided. For information on CSUtil.exe see "CiscoSecure ACS Command-Line Database Utility."

These utilities help automate the process of keeping your CiscoSecure  ACS database and network and system configurations current.

The system backup and system restore features help automate the process of updating your CiscoSecure  ACS system configuration. These features allow you to back up your system information to a backup file and restore it from any such file on the local hard drive. This minimizes downtime if the system information is corrupted or misconfigured.

Database replication is used to copy the CiscoSecure  ACS database information to another CiscoSecure  ACS for backup purposes.

RDBMS synchronization allows CiscoSecure  ACS to tightly integrate with other RDBMS data sources. It is not normally used to build fault-tolerant multiserver installations; however, in some configurations, it can be used for this purpose.

To use these features, you must enable them in the Interface Configuration: Advanced Options window.

Service Interruption During Processes

During the replication, synchronization, backup, and restore processes, authentication, authorization, and accounting (AAA) services are halted momentarily. For replication and synchronization, services are stopped on both machines, although not at the same time. Service is normal while the replication set is being transmitted between servers.

ACS System Backup

The System Backup process backs up your system information to a backup file on the local hard drive and restores it from any such file. This minimizes downtime if the system information is corrupted or misconfigured. It is a good idea to copy the files to another system's hard drive in case the primary system's hardware fails.

File Names and Locations

Assuming that you installed CiscoSecure  ACS on the c: drive, the default directory for the backup files is:

c:\directory\CSAuth\System Backups

where directory is the directory in which you installed CiscoSecure  ACS. You can change the location of the backup files in the System Configuration: ACS Backup window.

Components Backed Up

The ACS System Backup utility backs up the CiscoSecure  ACS user database and CiscoSecure  ACS Registry information. The user database backup includes all of the user information, including username, password, and authentication information. The Windows Registry information includes any system information that is stored in the Windows Registry, such as Network Device Group information, NAS configuration, administrator accounts, and so on.

Scheduled versus Manual Backup

You can choose to manually back up the CiscoSecure  ACS system or establish a regular schedule, either every X minutes or at selected days and times. For instructions on establishing schedules, see "Step-by-Step Configuration for CiscoSecure ACS."

Directory Management

You can configure the number of backup files to keep and the number of days after which these files are deleted. The more complex your configuration and the more often you back up the system, the more diligent you need to be about clearing out old databases from the server's hard drive.

Reports

When a system backup takes place, whether it was manually generated or scheduled, the event is logged in the Administration Audit report and the ACS Backup and Restore report. You can view any of the last several reports in the Reports and Activity window of CiscoSecure  ACS.

ACS System Restore

The System Restore feature allows you to restore your system configuration from any CiscoSecure  ACS-generated backup file on the local hard drive. This minimizes downtime if the system information is corrupted or misconfigured.

File Names and Locations

The ACS System Restore utility restores the CiscoSecure  ACS user database and CiscoSecure  ACS Windows Registry information from a file on the hard drive that was created during ACS System Backup. You can either restore from the latest backup file, or, if you suspect that the latest backup was incorrect, you can select an earlier backup file to restore from. Backup files are listed in the System Configuration: ACS Backup window in the Select Backup to Restore From section. Files are listed in chronological order, with the newest file at the top of the list.

Assuming that you installed CiscoSecure  ACS on the c: drive, the default directory for the backup files is:

c:\directory\CSAuth\System Backups

where directory is the directory in which you installed CiscoSecure  ACS.

Filenames are in the following format:

dd-mmm-yyyy hh-nn-ss.dmp

where:

dd is the date the backup started

mmm is the month, abbreviated in alpha characters

yyyy is the year. Note that these files are year-2000 compliant.

hh is the hour, in 24-hour format

nn is the minute

ss is the second at which the backup started

For example, a backup that was started on October 13, 1998, at 11:41:35 am would generate a file named:

13-Oct-1998 11-41-35.dmp

If you are not sure of the location of the latest backup file, you can check their location in the System Configuration: ACS System Backup window.

To change the directory location from which to restore, in the System Configuration: ACS Restore window, double-click in the Directory text box and enter the name of the applicable directory. The directory must already exist; CiscoSecure  ACS will not create it for you. Then click OK.

Components Restored

You can select the components to restore: the user and group databases, the system configuration, or both.

Reports

When a system restore takes place, the event is logged in the Administration Audit report and the ACS Backup and Restore report. You can view any of the last several reports in the Reports and Activity window of CiscoSecure  ACS.

Files are in comma-separated-value (csv) format, so you can import them into spreadsheets using most popular spreadsheet application software. See your spreadsheet software manufacturer's documentation for instructions.

Files are listed in chronological order, with the newest file, Backup and Restore.csv, at the top of the list. Older files are named in the following format:

Backup and Restore yyyy-mm-dd.csv

where:

yyyy is the year the backup was started. Note that these files are year-2000 compliant.

mm is the month of the backup, in numeric characters

dd is the date of the backup

For example, a log file that was generated on October 13, 1998, would be named:

Backup and Restore 1998-10-13.csv

Database Replication

Database Replication helps make your AAA environment more fault-tolerant. Database Replication helps create mirror systems of the CiscoSecure  ACS by duplicating parts of the primary server setup to one or more client systems. These mirror systems can then be used as backup or secondary servers if the primary system fails or is unreachable.

Database Replication allows you to:

• Select the parts of the primary system's configuration to be replicated
  
  
• Control the timing of the replication process, including creating schedules
  
  
• Export selected configuration items from the primary system
  
  
• Securely transport selected configuration data from the primary system to one or more client systems
  
  
• Update the client systems to create matching configurations
  
  

Database Replication Versus Database Backup

Do not confuse Database Replication with System Backup. Database Replication is not a complete replacement for System Backup. While dealing with many of the same issues (protection from partial or complete server loss), the two processes deal with the issues in a different way.

System Backup archives data into a format that you can later use to restore the configuration if the system fails or the data becomes corrupted. The backup data is stored on the local hard drive and can be copied and removed from the system for long-term storage. You can store several generations of the database backup.

Although unlikely, it is possible that a corrupted database could be propagated to the backup clients. Cisco therefore strongly recommends that if you are using CiscoSecure  ACS in mission-critical environments, you implement an adequate backup plan, whether or not you use Database Replication. See the "ACS System Backup" section and "ACS System Restore" section or "CiscoSecure ACS Command-Line Database Utility," for more information on backing up the system or database.

Database Replication provides fairly comprehensive replication of the CiscoSecure  ACS servers, but it does not replicate all of the CiscoSecure  ACS setup. Because CiscoSecure  ACS relies on several communication dynamic link libraries (DLLs), Database Replication does not include external authentication sources. Because the system administrator manually determines which DLLs are installed, Database Replication cannot rely on the necessary DLLs being present. Use the System Backup utility to back up these parts of the CiscoSecure  ACS configuration.

Server Configuration

Configure the following items for Database Replication in the CiscoSecure  ACS HTML user interface:

• Replication Components---What information is replicated
  
  
• Replication Scheduling---When and how often replication takes place
  
  
• Replication Partners---Which systems are replicated
  
  
• Reports and Event (Error) Handling---What information to include in the logs
  
  

Selecting Data to be Replicated

Database Replication allows you to select only some of the configuration data elements to be transferred to the client system. However, to create a mirror system, all items must be selected.

You can select the following items to be replicated:

• User and Group Information---All aspects of the CiscoSecure  ACS user database including group setup.
  
  
• Network Access Server Table---Network access server (NAS) host table information, including name, IP address, shared secret, and so on.
  
  
• Distribution Table---Proxy table information.
  
  
• Interface Configuration---Configuration components displayed to the system administrator.
  
  
• Interface Security Settings---Details of the system's administrator database (usernames, passwords, and access policies).
  
  
• Password Validation Settings---Details of the password requirements you have configured.
  
  

For each item, there are 2 check boxes, one labeled Send and the other labeled Receive. For configuration of the primary (source) system, only the Send check box is relevant; the Receive check box refers to the Client setup.

Replication Scheduling

You can configure Database Replication to perform replication in one of the following ways:

• Manually---No automatic Database Replication is performed.
  
  
• Automatically Triggered Cascade---Cascade replication to the configured list of clients upon completion of an incoming Database Replication session from a higher-level primary system. This allows you to build a propagation tree hierarchy of CiscoSecure  ACSes.
  
  
• Every X minutes---Perform replication on a set frequency. The unit of measurement is minutes, with a default update frequency of 60 minutes.
  
  
• At specific times...---Define a schedule when backups will take place. The minimum resolution is one hour, and the replication takes place on the hour selected.
  
  
• Replicate Now---Manually perform an immediate replication to the selected list of backup clients.
  
  

To select the desired mode of operation, check the appropriate button and configure the parameters as appropriate.

If mirroring the entire database with another CiscoSecure  ACS might send confidential information, such as Distribution Tables, from the primary AAA server's site, you can configure Database Replication to send only a specific category of database information.

Replication Frequency

This setting can have important implications for overall AAA service performance; you as administrator should be aware of the trade-offs in system performance. With shorter frequencies, the backup AAA server will be more up-to-date with the primary server, allowing for a more current backup if the primary system fails, and a more current view of the CiscoSecure  ACS user database. However, the greater the currency, the higher the load on the overall AAA system and network environment. First, because the data is being transferred more often, the network traffic load is much higher. Second, the processing load on the synchronizing systems is increased. This process consumes system resources, and the more often the process is repeated, the greater the impact on the AAA server's authentication/authorization/accounting performance.

This issue is more apparent with very large databases, very dynamic databases (frequent changes are made to the database), or both. Database Replication is a non-incremental, destructive backup. In other words, it completely replaces the database and configuration on the client system every time it is run. Therefore, if the database being transferred is very large, the amount of data being transferred can be substantial, and the processing overhead can also be large.

Replication Partners

Database Replication supports replication to one or more target or client CiscoSecure  ACS systems. To select client systems for replication, follow these steps:

Step 1 Click System Configuration: CiscoSecure Database Replication.

Step 2 In the Replication Partners section in the AAA Servers column, click the name of the system you want to be the target.

Step 3 Click the right arrow button to move the selection into the Replication column.

Step 4 Repeat this process as required.

To deselect a replication target, reverse the above procedure, using the left arrow button to move the server name into the AAA Servers column.

Important Notes

• Only Database Replication to other CiscoSecure  ACS hosts is supported. All primary and client systems participating in Database Replication must be running the same level of release of CiscoSecure  ACS Release.
  
  
• Only suitably configured, valid CiscoSecure  ACS hosts can be selected as Database Replication clients. To add replication targets, select the applicable AAA server from the AAA Server Table in the Network Configuration window. When a CiscoSecure  ACS host is added to the Hosts Table, it automatically appears for selection as a Database Replication client in the Replication Partners: AAA Servers column.
  
  
• Replication of clients takes place sequentially in the order listed.
  
  
• The client or target system must also be configured to accept Database Replication from the primary system. To configure a client system to accept Database Replication instructions, see the "Client System Database Replication Configuration" section.
  
  

Client System Database Replication Configuration

Database Replication uses a sophisticated client/server relationship to provide strong security and control to sites using this feature. For Database Replication to work, both the server and client must be correctly configured; if the client is not configured to receive replication instructions, it rejects them. The client's receive configuration is set using the same user interface windows as the server. To configure a client to receive replication, follow these steps:

Step 1 Click System Configuration: CiscoSecure Database Replication.

Step 2 In the Replication Components section, check the Receive check box for each of the fields in which you want data to be accepted.

Step 3 Configure the information in the Replication Scheduling section to match the information configured on the primary AAA server.

Step 4 In the Replication Partners section, in the Accept Replication From drop-down box, click the name of the primary AAA server.

Reports and Event (Error) Handling

Because system replication is a critical process, Database Replication provides visual alerts and logging to notify the system administrator of any problems that occurred during a replication event.

Database Replication Event Error Alert Notification

If replication fails, CiscoSecure  ACS displays an error message in red at the top of the Database Replication window. Besides notifying you of errors, the message also displays the error code generated by the last unsuccessful run and suggests you check the error log messages generated for previous failures. To acknowledge and close the message, click OK.

Database Replication Logging

Events are logged in two Database Replication files: the Windows  NT Event Log and a dedicated CSV log file. All events are logged, whether they are successful or not. To view the Windows  NT Event Log, use the Windows  NT administration utilities. To view the Database Replication Event log, click Reports and Activity: Database Replication and click the name of the file to view. You can also import the csv files into spreadsheets using most popular spreadsheet application software. See your spreadsheet software manufacturer's documentation for instructions.

Files are listed in chronological order, with the newest file, Database Replication.csv, at the top of the list. Older files are named in the following format:

Database Replication yyyy-mm-dd.csv

where:

yyyy is the year the replication was started. Note that these files are year-2000 compliant.

mm is the month of the replication, in numeric characters

dd is the date of the replication

For example, a log file that was generated on October 13, 1998, would be named:

Database Replication 1998-10-13.csv

Disabling Replication

To disable replication completely, follow these steps:

Step 1 Click System Configuration: CiscoSecure Database Replication.

Step 2 In the Replication Components section, clear all the check boxes.

Step 3 In the Replication Scheduling section, click Manually. This prevents any automated replication from being performed.

Step 4 In the Replication Partners section, if there are any AAA servers listed in the Replication column, click their names and click the left arrow button to move them back into the AAA Servers column.

RDBMS  Synchronization

The RDBMS Synchronization feature simplifies the integration of CiscoSecure  ACS with a third-party RDBMS application. RDBMS Synchronization automates the synchronization with other RDBMS data sources and lets you perform the following functions:

• Specify an Open Database Connectivity (ODBC) data source to use for synchronizing data shared by CiscoSecure  ACS and the other RDBMS application and to provide control of the CiscoSecure  ACS updates to the external application
  
  
• Control the timing of and create schedules for the import/synchronization process
  
  
• Control which systems are to be synchronized
  
  

The RDBMS Synchronization feature consists of 2 components:

• CSDBSync---A dedicated Windows  NT Service that performs automated user and group account management services for CiscoSecure  ACS. To configure CSDBSync, click System Configuration: RDBMS Synchronization. If this feature is not displayed, click Interface Configuration: Advanced Options and check the RDBMS Synchronization check box.
  
  
• An ODBC data store (table)---This table specifies the format of the records. Each record holds user or group information that corresponds with the data stored for each user in the CiscoSecure  ACS database. Additionally, each record contains other fields, including an action code for the record. Any application can write to this table, and CSDBSync reads from it and takes actions on each record it finds in the table (for example, add user, delete user, and so on) as determined by the action code. After it processes the action for each record, CSDBSync deletes the record from the table. For full details of the RDBMS Synchronization table format and available actions, see the "ODBC Import Definitions" section.
  
  

Transaction Log Maintenance/Recovery of a CiscoSecure  ACS

RDBMS Synchronization processes each record in the ODBC Import Table and then deletes the record. Therefore, the ODBC import table can be considered a transaction queue; the data placed in the table is transient. This means that RDBMS Synchronization does not maintain a transaction log/audit trail. If a log is required, the external RDBMS application must create it. Unless the external RDBMS application can recreate the entire transaction history into the ODBC Import Table, we strongly advise that you construct a transaction log file for recovery purposes. You can do this by mirroring all of the transactions in the ODBC Import Table to a second table under the external RDBMS application's control.

If the database is large, it is not practical to recreate the CiscoSecure  ACS database by replaying the transaction log for the entire history of the system. Instead, create regular checkpoint backups of the CiscoSecure  ACS database and replay the transaction logs from the time of the checkpoint to bring the CiscoSecure  ACS's database back up to date (in sync with the external RDBMS application's database). For information on creating a checkpoint backup file, see "Database Backup and Restore Utility" section in "CiscoSecure ACS Command-Line Database Utility."

Replaying transaction logs that slightly predate the checkpoint will not damage the CiscoSecure  ACS database, although some transactions might be invalid and reported as errors. As long as the entire transaction log is replayed, the CiscoSecure  ACS database will be consistent with the external RDBMS application's database.

Server Configuration

The user interface window provided in CSAdmin for configuring RDBMS Synchronization provides control of the following items:

• System Data Source Name (DSN) Specification---Which ODBC data source to use
  
  
• Synchronization Scheduling---When synchronization takes place
  
  
• Synchronization Targets---Which systems are synchronized
  
  

System DSN Specification

RDBMS Synchronization provides control of the following System DSN parameters:

• System DSN name---System DSN to use
  
  
• DSN username---DSN username to use
  
  
• DSN password---DSN password to use
  
  

To configure RDBMS Synchronization to use a particular DSN, click the desired system DSN in the pull-down list of available DSNs and enter the appropriate username and password into the fields provided.

System DSN Configuration

RDBMS Synchronization takes its data from a valid ODBC data source. To display in the CiscoSecure  ACS user interface, the data source must first be correctly installed from the Windows  NT ODBC Control Panel applet. A Microsoft Access database file (CiscoSecure Transactions.mdb) is supplied with CiscoSecure  ACS for use by RDBMS Synchronization. During installation, this ODBC data source is added to the available System DSNs with the name "CiscoSecure DBSync." Using this data source requires no additional ODBC data source configuration because it is installed as the default System DSN for RDBMS Synchronization. By default, the username and password parameters are set to null. For increased data security, the defaults should be changed after installation.

To use a different file or database, such as Microsoft SQL Server or Oracle, you must define a System DSN for this data source that RDBMS Synchronization can use. CiscoSecure  ACS provides SQL scripts to help you generate a table in the correct format for both Microsoft SQL Server and Oracle's Oracle8 RDBMS servers.

RDBMS Synchronization Scheduling

You can configure RDBMS Synchronization for one of the following schedules:

• Manual synchronization---Do not synchronize automatically.
  
  
• Every X minutes---Perform synchronization at a set frequency. The unit of measurement is minutes. The default update frequency is 60 minutes.
  
  
• Synchronize at specific times...---Defines a schedule when backups will take place. The minimum resolution is one hour, and the backup takes place on the hour specified.
  
  
• Synchronize Now---Manually perform an immediate synchronization of the data in the CiscoSecure  ACS DSN table to the internal CiscoSecure  ACS database.
  
  

To select the desired mode of operation, click the appropriate radio button and configure the parameters as appropriate.

By default, RDBMS Synchronization is disabled. To configure Synchronization, click System Configuration: RDBMS Synchronization. If this feature is not displayed, click Interface Configuration: Advanced Options and check the RDBMS Synchronization check box.

Synchronization Targets

RDBMS Synchronization allows you to select one or more target CiscoSecure  ACS systems. To select a target system for synchronization, click the desired target system in the left list box and press the right arrow button to move the selection into the right list box of configured target systems. Repeat this process as required.

To deselect a synchronization target, reverse the above procedure using the left arrow button.

Reports and Event (Error) Handling

Because RDBMS  Synchronization is a critical process, CSDB  Sync provides visual alerts and logging to notify the system administrator of any problems that occurred during a synchronization event.

ODBC Import Definitions

If you have an existing ODBC-compliant database, such as Microsoft Access or Oracle, you can import it to a CiscoSecure  ACS database. Follow the instructions in this section.

Importing Account Data

Importing user/group information into one or more ACS servers uses a single table. The CSAccupdate service processes the table and updates local and remote ACS installations as configured.

Because the structure is "flat," not all the fields in the table are required for every type of transaction. The tables in the following sections specify which fields must be present for each transaction type or action.

The following fields are required:

• Action
  
  
• DateTime
  
  
• SequenceID
  
  
• UserName or GroupName---note that these are mutually exclusive.
  
  

Therefore, these fields are not included when discussing per-action mandatory fields.

Any modification to the database format or the value set that can be assigned to a user or group must be made with reference to this section; otherwise, third-party account information systems might set incorrect user information.

Table Specification (Account Actions)

CSAccupdate opens an ODBC system DSN called "CiscoSecureImport." This DSN contains a table named "accountActions." The Update table has the fields listed in Table 7-1. The database that contains the table can be from any vendor, provided that the ODBC drivers can be used with multithreaded services.

Records are read from the table in ascending order by Sequence ID and priority. Most systems writing to this table will do so in batch mode, with priority equal to 0. This allows a STAT user addition to occur ahead of the queue if an online user addition is required. When changing transaction priorities, be careful that they are processed in the correct order; for example, the user must be created before the user's password is created.

You can use the MessageNo field to stall related transactions; for example, the addition of a user and subsequent actions to set password values and status. This field is used primarily for third-party billing systems to facilitate an audit trail.

Action Codes

Table 7-2 lists the valid action codes. The Required column indicates which fields should be completed via the field Mnemonic name, except for the mandatory fields, which are assumed. If an action can be applied to either a user or group, "UN|GN" is listed. To make the action affect only the user, leave the group name empty, and vice versa.

UN="fred," AI="APP_CSAUTH," 
VN="My 
Value"V2="TYPE_MULTI_STRING," 
V1="str1<tab>str2<tab>str3"

NAS01,tty0,0898-69696969
 

01732-875374,0898-69696969
 

10.45.6.123,tty0
 

Adding a User

Despite the many actions available, adding a user requires only one transaction: ADD_USER. All other user attributes can safely be left with their default values. Table 7-3 describes the attributes available for both users and groups, as well as type and limits, where applicable. The term NULL is not simply an empty string, but means not set, that is, the value will not be processed. Some features are processed only if they have a value assigned to them.