Table of Contents

Overview

The CiscoSecure ACS 2.1 for Windows NT (CiscoSecure ACS) network security software helps you authenticate users by controlling dial-in access to a Cisco network access server (NAS) or a Cisco PIX Firewall. The CiscoSecure access control server (ACS) operates as a Windows NT service and controls the authentication, authorization, and accounting of users accessing networks.

The CiscoSecure ACS supports the centralization of access control and accounting for dialup access servers and firewalls and management of access to routers and switches. With it, service providers can quickly administer accounts and globally change levels of service offerings for entire groups of users. Because of its tight integration with the Windows NT operating system, companies can leverage the working knowledge and the investment already made into building a Windows NT network.

The CiscoSecure ACS supports different Cisco NASes (such as the Cisco 2509, 2511, 3620, 3640, and AS5200) and the Cisco PIX firewall. It is an ACS for Windows NT Server Version 4.0. CiscoSecure uses the Terminal Access Controller Access Control System (TACACS+) and Remote Access Dial-In User Service (RADIUS) protocols to provide Authentication, Authorization, and Accounting (AAA) to ensure a secure environment. CiscoSecure can authenticate users against either the Windows NT User Database, the CiscoSecure User Database, a token-card server's database, or a Novell Directory Services (NDS) Database.

The NAS directs all dial-in user access requests to the CiscoSecure ACS for authentication and authorization of privileges. Using either the RADIUS or TACACS+ protocol, the NAS sends authentication requests to the CiscoSecure server, which verifies the username and password. The CiscoSecure server then returns a success or failure response to the NAS, which permits or denies user access. When the user has been authenticated, the CiscoSecure ACS sends a set of authorization attributes to the NAS, and the accounting functions take effect.

CiscoSecure Features

This section describes the CiscoSecure ACS 2.1 for Windows NT features:

Specifications

The CiscoSecure ACS 2.1 for Windows NT software conforms to the following specifications:

The CiscoSecure ACS 2.1 for Windows NT software conforms to the TACACS+ protocol as defined by Cisco Systems in draft 1.77. See your Cisco IOS software documentation or Cisco Connection Online (www.cisco.com) for more information.

The CiscoSecure ACS 2.1 for Windows NT software conforms to the RADIUS protocol as defined in draft April 1997 and in the following RFCs:

System Requirements

Your Windows NT server must meet the following minimum requirements.

Hardware Requirements

Your Windows NT server must meet the following minimum hardware requirements:

Software Requirements

Your Windows NT server must meet the following minimum software requirements:

CiscoSecure ACS Concepts and Functions

This section describes some of the different components that work together with the CiscoSecure ACS to provide network security.

CiscoSecure ACS 2.1 for Windows NT and the Access Device

The access device (NAS, firewall, or router) is configured to direct all user access requests to the CiscoSecure ACS for authentication and authorization of privileges. Using the TACACS+ or RADIUS protocol, the access device sends authentication requests to the CiscoSecure ACS, which verifies the username and password against either the Windows NT User Database or the CiscoSecure ACS User Database. The CiscoSecure ACS then returns a success or failure response to the NAS, which permits or denies user access.

When the user has been successfully authenticated, a set of session attributes can be sent to the access device to provide additional security and control of privileges. These attributes can include the IP address pool to pull from, and access control list and the type of connection (for example, IP, IPX, or Telnet).

TACACS+ and RADIUS

Both TACACS+ and RADIUS security protocols can be used by the CiscoSecure ACS. See Table 1-1.

Authentication

Authentication determines a user's identity, and then it verifies that information. Authentication can take many forms. Traditional authentication uses a name and a fixed password. More modern and secure methods use one-time passwords (OTPs) such as PAP and token cards. CiscoSecure provides support for these authentication methods.

A fundamental relationship between authentication and authorization is that the more authorization privileges a user receives, the stronger the authentication should be. The CiscoSecure ACS offers this capability by providing various methods of authentication.

Username and password is the most popular, simplest, and least expensive method used for authentication. This fits under the category of "something you know." No special equipment is required. This is a popular method for service providers because of its easy application by the client. The disadvantage is that what you know can be told to someone else, guessed, or captured. Username and password is not considered a strong authentication mechanism; therefore, you would use it for low authorization or privilege level such as Internet access, and it can be sufficient.

To reduce the risk of password capturing on the network, use encryption. Client and server access control protocols, such as Terminal Access Controller Access Control System (TACACS+) and Remote Authentication Dial-In User Service (RADIUS) encrypt passwords to prevent them from being captured within a network. However, TACACS+ and RADIUS operate between the NAS and the ACS. Clear-text passwords can be captured between a client host dialing up over a phone line or an Integrated Service Digital Network (ISDN) line terminating at a NAS.

Service providers offering increased levels of security services and corporate customers who want to lessen the chance of intruder access resulting from password capturing, can use an OTP. The CiscoSecure ACS supports several types of OTP solutions, including PAP for Point-to-Point Protocol (PPP) remote-node logon. Token cards are considered one of the strongest OTP authentication mechanisms available today. With token cards, authentication requires something you have and something you know, and it results in an OTP that prevents password captures.

The CRYPTOCard token-card server software is included with the CiscoSecure ACS. All you need is the CRYPTOCard token card.

The CiscoSecure ACS also supports the following token-card servers for authentication:

The CiscoSecure ACS requires the client software for SDI's ACE server so that it calls the server when their token-card authentication solution. The AXENT token-card server is configured in the CiscoSecure ACS with an address and shared secret.

Passwords

The CiscoSecure ACS 2.1 for Windows NT supports all of the leading authentication protocols:

Passwords can be processed using these protocols based on the version and type of security control protocol used and the configuration of the NAS and client. The following sections outline the different conditions and functions of password handling.

The CiscoSecure ACS acts as a client to the token-card server. A secured communication link is required between the CiscoSecure ACS and the token-card server. This is done by either configuring a shared secret password between the two servers and defining the IP address, or by installing a file created by the token-card server containing the same information into the CiscoSecure ACS.

Basic Password Configurations

There are four basic password configurations:

Advanced Password Configurations

In addition to the four basic password configurations given above, the CiscoSecure ACS also provides for:

You can use the TACACS+ SENDAUTH feature to enable a NAS to authenticate itself to another NAS/client via an outbound authentication. The outbound authentication can be PAP, CHAP, or ARAP and results in the CiscoSecure ACS password being given out. By default, the user's ASCII/PAP or CHAP/ARAP password is used (depending on how this has been configured); however, it is recommended that the separate SENDAUTH password be configured for the user so that the CiscoSecure ACS inbound passwords are never compromised.

If you want to use outbound passwords and maintain the highest level of security, we recommend that you configure the CiscoSecure ACS with a separate outbound password that is different from the inbound password.

Cisco IOS Release 11.1 CHAP and ARAP Considerations

When using CHAP and ARAP authentication with a NAS configured to use TACACS+ with Cisco IOS Release 11.1, authentication is performed by the NAS and not by the CiscoSecure ACS TACACS+ server. This results in the CiscoSecure ACS returning a password to the NAS.

A NAS running Cisco IOS Release 11.1 generates TACACS+ SENDPASS requests in order to service a CHAP or ARAP authentication. The TACACS+ server replies with either the single ASCII PAP, CHAP, ARAP, or separate CHAP and ARAP password, depending on how the user is configured.

PAP, CHAP, and ARAP Support

Different levels of security can be used with the CiscoSecure ACS for different requirements. The basic level of user-to-network security is PAP. Although it does not represent the highest form of encrypted security, PAP does offer convenience and simplicity for the client. When using the Windows NT User Database, PAP allows authentication against that database. By using PAP and the Windows NT User Database, single login can be achieved. A higher level of security for encrypting passwords when communicating from a client to the network device, such as an access server, is CHAP. This can be used when using the CiscoSecure User Database. To support Apple clients, ARAP support is included.

Comparing PAP, CHAP, and ARAP

PAP, CHAP, and ARAP are authentication protocols used to encrypt passwords. However, each provides a different level of security.

Authorization

Authorization determines what a user is allowed to do. The CiscoSecure ACS can send user profile policies to a network device such as an access server to determine the network services they can access or the level of service subscribed to. You can configure authorization to give different users and groups different levels of service. For example, standard dialup users might not have the same access privileges as premium customers and users. You can also differentiate by levels of security, access times, and services.

The CiscoSecure ACS can enable Network Access Restrictions to permit or deny login based on time-of-day and day-of-week. For example, you could create a group for temporary accounts that can be set up to be disabled on specified dates. This would make it possible for a service provider to offer a 30-day free trial. The same authorization could be used to create a temporary account for a consultant with login permission limited to Monday through Friday, 9 a.m. to 5 p.m.

You can also restrict use by way of the Max Sessions feature, allowing a maximum number of concurrent sessions per user or group.

You can restrict users to any one or a combination of PPP, ARA, Serial Line Internet Protocol (SLIP), or EXEC services. After a service is selected, you can restrict Layer 2 and 3 protocols, such as IP and IPX, and you can apply individual access lists. Access lists on a per-user or per-group basis can restrict users from reaching parts of the network where critical information is stored. Access lists can prevent users from using certain services such as File Transfer Protocol (FTP) or Simple Network Management Protocol (SNMP).

One fast-growing service being offered by service providers and adopted by corporations is a service authorization for Virtual Private Dialup Networks (VPDNs). The CiscoSecure ACS can provide information to the network device for a specific user to configure a secure tunnel through a public network such as the Internet. The information can be for the access server (such as the Home Gateway for that user) or for the Home Gateway router to validate the user at the customer premise. In either case, the CiscoSecure ACS can be used for each end of the VPDN.

Accounting

Accounting is the action of recording what a user is doing or has done. The CiscoSecure ACS writes accounting records to a CSV log file daily. You can easily update this log file into popular database and spreadsheet applications for billing, security audits, and report generation. Among the types of accounting logs you can generate:

Max Sessions

Max Sessions is a useful feature for organizations that need to limit the number of concurrent sessions available to either a user or a group:

In addition to simple User and Group Max Sessions control, the CiscoSecure ACS allows the administrator to specify a Group Max Sessions value and a group-based User Max Sessions value; that is, a User Max Sessions value based on the user's group membership. For example, an administrator can allocate a Group Max Sessions value of 50 to the group Sales and also limit each member of group Sales to 5 sessions each. This way, no single member of a group account would be able to use more than five sessions at any one time, but the group could still have up to 50 active sessions.