Table of Contents

Preface

Preface

This section discusses the objectives, audience, and organization of the Cisco Secure Access Control Server for Windows NT/2000 Servers Version 3.0 User Guide.

Document Objectives

The objective of this document is to help you configure and use the Cisco Secure Access Control Server for Windows NT/2000 Servers Version 3.0 (Cisco Secure ACS) software and its features and utilities.

Who Should Read This Guide

This publication was written for system administrators who are using the Cisco Secure ACS software and are responsible for setting up and maintaining accounts and dial-in network security.

How This Guide is Organized

The Cisco Secure ACS User Guide is organized into the following chapters:

• "Overview of Cisco Secure ACS." An overview of Cisco Secure ACS and its features, network diagrams, and system requirements.
  
  
• "Deploying Cisco Secure ACS." A guide to deploying the Cisco Secure ACS that includes requirements, options, trade-offs, and suggested sequences.
  
  
• "Setting Up the Cisco Secure ACS HTML Interface." Concepts and procedures regarding how to use the Interface Configuration section of the Cisco Secure ACS to configure the user interface.
  
  
• "Setting Up and Managing Network Configuration." Concepts and procedures for Cisco Secure ACS network configuration and establishing a distributed system.
  
  
• "Setting Up and Managing Shared Profile Components." Concepts and procedures regarding Cisco Secure ACS shared profile components: network access restrictions and device command sets.
  
  
• "Setting Up and Managing User Groups." Concepts and procedures for establishing and maintaining Cisco Secure ACS user groups.
  
  
• "Setting Up and Managing User Accounts". Concepts and procedures for establishing and maintaining Cisco Secure ACS user accounts.
  
  
• "Establishing Cisco Secure ACS System Configuration." Concepts and procedures regarding the System Configuration portion of Cisco Secure ACS.
  
  
• "Working with Logging and Reports." Concepts and procedures regarding Cisco Secure ACS logging and reports.
  
  
• "Setting Up and Managing Administrators and Policy." Concepts and procedures for establishing and maintaining Cisco Secure ACS administrators.
  
  
• "Working with User Databases." Concepts and procedures for establishing user databases.
  
  
• "Administering External User Databases." Concepts and procedures for administering and maintaining user databases external to Cisco Secure ACS.
  
  

This guide also comprises the following appendixes:

• "Troubleshooting Information for Cisco Secure ACS." How to identify and solve certain problems you might have with Cisco Secure ACS.
  
  
• "System Messages." A list and explanation of most system messages you might encounter.
  
  
• "TACACS+ Attribute-Value Pairs." A list of supported TACACS+ AV pairs and accounting AV pairs.
  
  
• "RADIUS Attributes." A list of supported RADIUS AV pairs and accounting AV pairs.
  
  
• "Cisco Secure ACS Command-Line Database Utility." Instructions for using the database import utility, CSUtil, to import an ODBC database, and back up, maintain, or restore the Cisco Secure ACS database.
  
  
• "Cisco Secure ACS and Virtual Private Dial-up Networks." An introduction to Virtual Private Dial-up Networks (VPDN), including stripping and tunneling, with instructions for enabling VPDN on Cisco Secure ACS.
  
  
• "ODBC Import Definitions." A list of ODBC import definitions, for use with the RDBMS Synchronization feature.
  
  
• "Cisco Secure ACS Internal Architecture." A description of Cisco Secure ACS architectural components.
  
  

Conventions Used in This Guide

This guide uses the following typographical conventions:

Tip Means the following information will help you solve a problem. The tip's information might not be troubleshooting or even an action, but could be useful information.

Note   Means reader take note. Notes contain helpful suggestions or references to materials not covered in the manual.

Caution   Means reader be careful. In this situation, you might do something that could result in equipment damage, loss of data, or a breach in your network security.

Warning Means danger. You are in a situation that could cause bodily injury. Before you work on any equipment, you must be aware of the hazards involved with electrical circuitry and be familiar with standard practices for preventing accidents. To see translated versions of the warning, refer to the Regulatory Compliance and Safety document that accompanied the device.

Related Documentation

Included in the Cisco Secure ACS HTML interface are two sources of information:

• Online Help contains information for each associated page in the Cisco Secure ACS HTML interface.
  
  
• Online Documentation is a complete copy of the Cisco Secure ACS 3.0 for Windows 2000/NT Servers User Guide.
  
  

We recommend that you read Release Notes for Cisco Secure Access Control Server Version 3.0 for Windows 2000/NT Servers. While a printed copy of this document comes with Cisco Secure ACS, check Cisco.com for the latest version.

You should also read the README.TXT file for additional important information.

Cisco Secure ACS includes an installation guide, Installing Cisco Secure ACS 3.0 for Windows 2000/NT Servers, to help you install the software efficiently and correctly.

Web Server Installation for Cisco Secure ACS for Windows 2000/NT User-Changeable Passwords contains information on installing and configuring the optional user-changeable password feature.

You can find other product literature, including white papers, data sheets, and product bulletins, at:

http://www.cisco.com/warp/public/cc/pd/sqsw/sq/prodlit/index.shtml.

You should refer to the documentation that came with your AAA clients for more information about those products. You might also want to consult the Cisco Systems publication Cisco Systems' Internetworking Terms and Acronyms.

Obtaining Documentation

The following sections explain how to obtain documentation from Cisco Systems.

World Wide Web

You can access the most current Cisco documentation on the World Wide Web at the following URL:

http://www.cisco.com

Translated documentation is available at the following URL:

http://www.cisco.com/public/countries_languages.shtml

Documentation CD-ROM

Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which is shipped with your product. The Documentation CD-ROM is updated monthly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual subscription.

Ordering Documentation

Cisco documentation is available in the following ways:

• Registered Cisco Direct Customers can order Cisco product documentation from the Networking Products MarketPlace:
  
  

http://www.cisco.com/public/ordsum.html

• Registered Cisco.com users can order the Documentation CD-ROM through the online Subscription Store:
  
  

http://www.cisco.com/go/subscription

• Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco corporate headquarters (California, USA) at 408 526-7208 or, elsewhere in North America, by calling 800 553-NETS (6387).
  
  

Documentation Feedback

If you are reading Cisco product documentation on Cisco.com, you can submit technical comments electronically. Click Feedback at the top of the Cisco Documentation home page. After you complete the form, print it out and fax it to Cisco at 408 527-0730.

You can e-mail your comments to bug-doc@cisco.com.

To submit your comments by mail, use the response card behind the front cover of your document, or write to the following address:

Cisco Systems
Attn: Document Resource Connection
170 West Tasman Drive
San Jose, CA 95134-9883

We appreciate your comments.

Obtaining Technical Assistance

Cisco provides Cisco.com as a starting point for all technical assistance. Customers and partners can obtain documentation, troubleshooting tips, and sample configurations from online tools by using the Cisco Technical Assistance Center (TAC) Web Site. Cisco.com registered users have complete access to the technical support resources on the Cisco TAC Web Site.

Cisco.com

Cisco.com is the foundation of a suite of interactive, networked services that provides immediate, open access to Cisco information, networking solutions, services, programs, and resources at any time, from anywhere in the world.

Cisco.com is a highly integrated Internet application and a powerful, easy-to-use tool that provides a broad range of features and services to help you to

• Streamline business processes and improve productivity
  
  
• Resolve technical issues with online support
  
  
• Download and test software packages
  
  
• Order Cisco learning materials and merchandise
  
  
• Register for online skill assessment, training, and certification programs
  
  

You can self-register on Cisco.com to obtain customized information and service. To access Cisco.com, go to the following URL:

http://www.cisco.com

Technical Assistance Center

The Cisco TAC is available to all customers who need technical assistance with a Cisco product, technology, or solution. Two types of support are available through the Cisco TAC: the Cisco TAC Web Site and the Cisco TAC Escalation Center.

Inquiries to Cisco TAC are categorized according to the urgency of the issue:

• Priority level 4 (P4)—You need information or assistance concerning Cisco product capabilities, product installation, or basic product configuration.
  
  
• Priority level 3 (P3)—Your network performance is degraded. Network functionality is noticeably impaired, but most business operations continue.
  
  
• Priority level 2 (P2)—Your production network is severely degraded, affecting significant aspects of business operations. No workaround is available.
  
  
• Priority level 1 (P1)—Your production network is down, and a critical impact to business operations will occur if service is not restored quickly. No workaround is available.
  
  

Which Cisco TAC resource you choose is based on the priority of the problem and the conditions of service contracts, when applicable.

Cisco TAC Web Site

The Cisco TAC Web Site allows you to resolve P3 and P4 issues yourself, saving both cost and time. The site provides around-the-clock access to online tools, knowledge bases, and software. To access the Cisco TAC Web Site, go to the following URL:

http://www.cisco.com/tac

All customers, partners, and resellers who have a valid Cisco services contract have complete access to the technical support resources on the Cisco TAC Web Site. The Cisco TAC Web Site requires a Cisco.com login ID and password. If you have a valid service contract but do not have a login ID or password, go to the following URL to register:

http://www.cisco.com/register/

If you cannot resolve your technical issues by using the Cisco TAC Web Site, and you are a Cisco.com registered user, you can open a case online by using the TAC Case Open tool at the following URL:

http://www.cisco.com/tac/caseopen

If you have Internet access, it is recommended that you open P3 and P4 cases through the Cisco TAC Web Site.

Cisco TAC Escalation Center

The Cisco TAC Escalation Center addresses issues that are classified as priority level 1 or priority level 2; these classifications are assigned when severe network degradation significantly impacts business operations. When you contact the TAC Escalation Center with a P1 or P2 problem, a Cisco TAC engineer will automatically open a case.

To obtain a directory of toll-free Cisco TAC telephone numbers for your country, go to the following URL:

http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml

Before calling, please check with your network operations center to determine the level of Cisco support services to which your company is entitled; for example, SMARTnet, SMARTnet Onsite, or Network Supported Accounts (NSA). In addition, please have available your service agreement number and your product serial number.