Table of Contents

Setting Up and Managing User Groups

This chapter provides information about setting up and managing user groups in Cisco Secure Access Control Server (Cisco Secure ACS) for Windows Server version 3.1 to control authorization. Cisco Secure ACS enables you to group together network users for more efficient administration. Each user can belong to only one group in Cisco Secure ACS. You can establish up to 500 different groups to effect different levels of authorization.

Cisco Secure ACS also supports external database group mapping; that is, if your external user database distinguishes user groups, these groups can be mapped into Cisco Secure ACS. And if the external database does not support groups, you can map all users from that database to a Cisco Secure ACS user group. For information about external database mapping, see Database Group Mappings.

Before you configure Group Setup, you should understand how this section functions. Cisco Secure ACS dynamically builds the Group Setup section interface depending on the configuration of your network devices and the security protocols being used. That is, what you see under Group Setup is affected by both your system's network configuration and your settings in the Interface Configuration section.

This chapter contains the following sections:

User Group Setup Features and Functions

The Group Setup section of the Cisco Secure ACS HTML interface is the centralized location for operations regarding user group configuration and administration. For information about network device groups (NDGs), see Network Device Group Configuration.

Default Group

If you have not configured group mapping for an external user database, Cisco Secure ACS assigns users who are authenticated by the Unknown User Policy to the Default Group the first time they log in. The privileges and restrictions for the default group are applied to first-time users. If you have upgraded from a previous version of Cisco Secure ACS and kept your database information, Cisco Secure ACS retains the group mappings you configured before upgrading.

Group TACACS+ Settings

Cisco Secure ACS enables a full range of settings for TACACS+ at the group level. If a AAA client has been configured to use TACACS+ as the security control protocol, you can configure standard service protocols, including PPP IP, PPP LCP, ARAP, SLIP, and Shell (exec), to be applied for the authorization of each user who belongs to a particular group.

Note   You can also configure TACACS+ settings at the individual user level. User-level settings always override group level settings.

Cisco Secure ACS also enables you to enter and configure new TACACS+ services. For information about how to configure a new TACACS+ service to appear on the group setup page, see Protocol Configuration Options for TACACS+.

If you have configured Cisco Secure ACS to interact with a Cisco device-management application, new TACACS+ services may appear automatically, as needed, to support the device-management application. For more information about Cisco Secure ACS interaction with device-management applications, see Support for Cisco Device-Management Applications.

You can use the Shell Command Authorization Set feature to configure TACACS+ group settings. This feature enables you to apply shell commands to a particular user group in the following ways:

For more information about shell command authorization sets, see "Setting Up and Managing Shared Profile Components."

Common User Group Settings

This section presents the basic activities you perform when configuring a new user group. This section contains the following procedures:

Enabling VoIP Support for a User Group

Note   If this feature does not appear, click Interface Configuration, click Advanced Options, and then select the Voice-over-IP (VoIP) Group Settings check box.

Perform this procedure to enable support for the null password function of VoIP. This enables users to authenticate (session or telephone call) on only the user ID (telephone number).

When you enable VoIP at the group level, all users in this group become VoIP users, and the user IDs are treated similarly to a telephone number. VoIP users do not need to enter passwords to authenticate.

Caution   Enabling VoIP disables password authentication and most advanced settings, including password aging and protocol attributes.

To enable VoIP support for a group, follow these steps:

Result: The Group Setup Select page opens.

Step 2   From the Group list, select the group you want to configure for VoIP support, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 3   In the Voice-over-IP Support table, select the check box labeled This is a Voice-over-IP (VoIP) group - and all users of this group are VoIP users.

Step 4   To save the group settings you have just made, click Submit.
For more information, see Saving Changes to User Group Settings.

Step 5   To continue, and specify other group settings, perform other procedures in this chapter, as applicable.

Setting Default Time-of-Day Access for a User Group

Note   If this feature does not appear, click Interface Configuration, click Advanced Options, and then select the Default Time-of-Day / Day-of-Week Specification check box.

To define the times during which users in a particular group are permitted or denied access, follow these steps:

Result: The Group Setup Select page opens.

Step 2   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 3   In the Default Time-of-Day Access Settings table, select the Set as default Access Times check box.

---

Note    You must select the Set as default Access Times check box to limit access based on time or day.

---

Result: Times at which the system permits access are highlighted in green on the day and hour matrix.

---

Note    The default sets accessibility during all hours.

---

Step 4   In the day and hour matrix, click the times at which you do not want to permit access to members of this group.

Tip Clicking times of day on the graph deselects those times; clicking again reselects them. At any time, you can click Clear All to clear all hours, or you can click Set All to select all hours.

Step 5   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 6   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Setting Callback Options for a User Group

Callback is a command string that is passed back to the access server. You can use callback strings to initiate a modem to call the user back on a specific number for added security or reversal of line charges. There are three options, as follows:

To set callback options for a user group, follow these steps:

Result: The Group Setup Select page opens.

Step 2   Select a group from the Group list, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 3   In the Callback table, select one of the following three options:

Step 4   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 5   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Setting Network Access Restrictions for a User Group

The Network Access Restrictions table in Group Setup enables you to apply network access restrictions (NARs) in three distinct ways:

---

Note    You can also use the CLI/DNIS-based access restrictions area to specify other values. For more information, see About Network Access Restrictions.

---

Typically, you define (shared) NARs from within the Shared Components section so that these restrictions can be applied to more than one group or user. For more information, see Shared Network Access Restrictions Configuration. You must have enabled the Group-Level Shared Network Access Restriction check box on the Advanced Options page of the Interface Configuration section for these options to appear in the Cisco Secure ACS HTML interface.

However, Cisco Secure ACS also enables you to define and apply a NAR for a single group from within the Group Setup section. You must have enabled the Group-Level Network Access Restriction setting under the Advanced Options page of the Interface Configuration section for single group IP-based filter options and single group CLI/DNIS-based filter options to appear in the Cisco Secure ACS HTML interface.

Note   When an authentication request is forwarded by proxy to a Cisco Secure ACS server, any NARs for TACACS+ requests are applied to the IP address of the forwarding AAA server, not to the IP address of the originating AAA client.

To set NARs for a user group, follow these steps:

Result: The Group Setup Select page opens.

Step 2   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 3   To apply a previously configured shared NAR to this group, follow these steps:

---

Note    To apply a shared NAR, you must have configured it under Network Access Restrictions in the Shared Profile Components section. For more information, see Shared Network Access Restrictions Configuration.

---

Tip To view the server details of the shared NARs you have selected to apply, you can click either View IP NAR or View CLID/DNIS NAR, as applicable.

Step 4   To define and apply a NAR, for this particular user group, that permits or denies access to this group based on IP address, or IP address and port, follow these steps:

Tip You should define most NARs from within the Shared Components section so that the restrictions can be applied to more than one group or user. For more information, see Shared Network Access Restrictions Configuration.

Result: The specified the AAA client, port, and address information appears in the NAR Access Control list.

Step 5   To permit or deny access to this user group based on calling location or values other than an established IP address, follow these steps:

---

Note    You must type an entry in each box. You can use the wildcard asterisk (*) for all or part of a value. The format you use must match the format of the string you receive from your AAA client. You can determine this format from your RADIUS Accounting Log.

---

Tip This is also the selection to use if you want to restrict access based on other values, such as a Cisco Aironet client MAC address. For more information, see About Network Access Restrictions.

Tip This is also the selection to use if you want to restrict access based on other values, such as a Cisco Aironet AP MAC address. For more information, see About Network Access Restrictions.

Result: The information, specifying the AAA client, port, CLI, and DNIS appears in the list.

Step 6   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 7   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Setting Max Sessions for a User Group

Note   If this feature does not appear, click Interface Configuration, click Advanced Options, and then select the Max Sessions check box.

Perform this procedure to define the maximum number of sessions available to a group, or to each user in a group, or both. The settings are as follows:

Tip As an example, Sessions available to group is set to 10 and Sessions available to users of this group is set to 2. If each user is using the maximum 2 simultaneous sessions, no more than 5 users can log in.

Note   A session is any type of connection supported by RADIUS or TACACS+, such as PPP, NAS prompt, Telnet, ARAP, IPX/SLIP.

Note   The default setting for group Max Sessions is Unlimited for both the group and the user within the group.

To configure the max sessions settings for a user group, follow these steps:

Result: The Group Setup Select page opens.

Step 2   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 3   In the Max Sessions table, under Sessions available to group, select one of the following options:

Step 4   In the lower portion of the Max Sessions table, under Sessions available to users of this group, select one of the following two options:

---

Note    Settings made in User Setup override group settings. For more information, see Setting Max Sessions Options for a User.

---

Step 5   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 6   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Setting Usage Quotas for a User Group

Note   If this feature does not appear, click Interface Configuration, click Advanced Options, and then select the Usage Quotas check box.

Perform this procedure to define usage quotas for members of a group. Session quotas affect each user of a group individually, not the group collectively. You can set quotas for a given period in two ways:

If you make no selections in the Usage Quotas section for a group, no usage quotas are enforced on users assigned to that group, unless you configure usage quotas for the individual users.

Note   The Usage Quotas section on the Group Settings page does not show usage statistics. Usage statistics are available only on the settings page for an individual user. For more information, see Setting User Usage Quotas Options.

When a user exceeds his or her assigned quota, Cisco Secure ACS denies that user access upon attempting to start a session. If a quota is exceeded during a session, Cisco Secure ACS allows the session to continue.

You can reset the usage quota counters for all users of a group from the Group Settings page. For more information about resetting usage quota counters for a whole group, see Resetting Usage Quota Counters for a User Group.

Tip To support time-based quotas, we recommend enabling accounting update packets on all AAA clients. If update packets are not enabled, the quota is updated when the user logs off. If the AAA client through which the user is accessing your network fails, the quota is not updated. In the case of multiple sessions, such as with ISDN, the quota is not updated until all sessions terminate. This means that a second channel will be accepted even if the first channel has exhausted the quota for the user.

To set user usage quotas for a user group, follow these steps:

Result: The Group Setup Select page opens.

Step 2   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 3   To define usage quotas based on duration of sessions, follow these steps:

---

Note    Up to 5 characters are allowed in the to x hours box.

---

Step 4   To define user session quotas based on number of sessions, follow these steps:

---

Note    Up to 5 characters are allowed in the to x sessions box.

---

Step 5   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 6   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Configuration-specific User Group Settings

This section details procedures that you perform only as applicable to your particular network security configuration. For instance, if you have no token server configured, you do not have to set token card settings for each group.

This section contains the following procedures:

The content of these subsections is dynamic and based on two factors as follows:

Setting Token Card Settings for a User Group

Note   If this section does not appear, configure a token server. Then, click External User Databases, click Database Configuration, and then add the applicable token card server.

Perform this procedure to allow a token to be cached. This means users can use a second B channel without having to enter a second one-time password (OTP).

Caution   This option is for use with token caching only for ISDN terminal adapters. You should fully understand token caching and ISDN concepts and principles before implementing this option. Token caching allows you to connect to multiple B channels without having to provide a token for each channel connection. Token card settings are applied to all users in the selected group.

Options for token caching include the following:

To set token card settings for a user group, follow these steps:

Result: The Group Setup Select page opens.

Step 2   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 3   From the Jump To list at the top of the page, choose Token Cards.

Step 4   In the Token Card Settings table, to cache the token for the entire session, select Session.

Step 5   Also in the Token Card Settings table, to cache the token for a specified time period (measured from the time of first authentication), follow these steps:

Step 6   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 7   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Setting Enable Privilege Options for a User Group

Note   If this section does not appear, click Interface Configuration and then click TACACS+ (Cisco). At the bottom of the page in the Advanced Configuration Options table, select the Advanced TACACS+ features check box.

Perform this procedure to configure group-level TACACS+ enable parameters. The three possible TACACS+ enable options are as follows:

---

Note    To define levels in this manner, you must have configured the option in Interface Configuration; if you have not done so already, click Interface Configuration, click Advanced Settings, and then select the Network Device Groups check box.

---

If you are using NDGs, this option lets you configure the NDG for enable-level mapping rather than having to do it for each user in the group.

To set enable privilege options for a user group, follow these steps:

Result: The Group Setup Select page opens.

Step 2   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 3   From the Jump To list at the top of the page, choose Enable Options.

Step 4   Do one of the following:

Result: The association of NDG and maximum privilege level appears in the table.

Step 5   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 6   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Enabling Password Aging for the CiscoSecure User Database

The password aging feature of Cisco Secure ACS enables you to force users to change their passwords under one or more of the following conditions:

Varieties of Password Aging Supported by Cisco Secure ACS

Cisco Secure ACS supports four distinct password aging mechanisms, as follows:

Tip The CAA software is available at http://www.cisco.com.

Also, to run password aging for transit sessions, the AAA client can be running either RADIUS or TACACS+; and the AAA client must be using Cisco IOS Release 11.2.7 or later and be configured to send a watchdog accounting packet (aaa accounting new-info update) with the IP address of the calling station. (Watchdog packets are interim packets sent periodically during a session. They provide an approximate session length in the event that the AAA client fails and, thereby, no stop packet is received to mark the end of the session.)

You can control whether Cisco Secure ACS propagates passwords changed by this feature. For more information, see Local Password Management.

Cisco Secure ACS supports password aging using the RADIUS protocol under MS CHAP versions 1 and 2. Cisco Secure ACS does not support password aging over Telnet connections using the RADIUS protocol.

Caution   If a user with a RADIUS connection tries to make a Telnet connection to the AAA client during or after the password aging warning or grace period, the change password option does not appear, and the user account is expired.

Password Aging Feature Settings

This section details only the Password Aging for Device-hosted Sessions and Password Aging for Transit Sessions mechanisms. For information on the Windows NT/2000 Password Aging mechanism, and the Windows 2000 DUN client, see Enabling Password Aging for Users in Windows Databases. For information on configuring local password validation options, see Local Password Management.

The password aging feature in Cisco Secure ACS has the following major and minor options:

---

Note    All passwords expire at midnight, not the time at which they were set.

---

Tip To allow users to log in an unlimited number of times without changing their passwords, type -1.

Tip To allow users to log in an unlimited number of times without changing their passwords, type -1.

The password aging rules are not mutually exclusive; a rule is applied for each check box that is selected. For example, users can be forced to change their passwords every 20 days, and every 10 logins, and to receive warnings and grace periods accordingly.

If no options are checked, passwords never expire.

Unlike most other parameters, which have corresponding settings at the user level, password aging parameters are configured only on a group basis.

Users who fail authentication because they have not changed their passwords and have exceeded their grace periods are logged in the Failed Attempts log. The accounts expire and appear in the Accounts Disabled list.

Before You Begin

To set password aging rules for a user group, follow these steps:

Result: The Group Setup Select page opens.

Step 2   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 3   From the Jump To list at the top of the page, choose Password Aging.

Result: The Password Aging Rules table appears.

Step 4   To set password aging by date, select the Apply age-by-date rules check box and type the number of days for the following options, as applicable:

---

Note    Up to 5 characters are allowed in each field.

---

Step 5   To set password aging by use, select the Apply age-by-uses rules check box and type the number of logins for each of the following options, as applicable:

---

Note    Up to 5 characters are allowed in each field.

---

Step 6   To force the user to change the password on the first login after an administrator has changed it, select the Apply password change rule check box.

Step 7   To enable a Greetings message display, select the Generate greetings for successful logins check box.

Step 8   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 9   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Enabling Password Aging for Users in Windows Databases

Cisco Secure ACS supports two types of password aging for users in Windows databases. Both types of Windows password aging mechanisms are separate and distinct from the other Cisco Secure ACS password aging mechanisms. For information on the requirements and settings for the password aging mechanisms that control users in the CiscoSecure user database, see Enabling Password Aging for the CiscoSecure User Database.

Note   You can run both the Windows NT/2000 Password Aging and the Cisco Secure ACS Password Aging for Transit Sessions mechanisms concurrently, provided that the users authenticate from the two different databases.

The two types of password aging in Windows databases are as follows:

Tip For information on enabling MS CHAP for password changes, see Configuring a Windows NT/2000 External User Database. For information on enabling MS CHAP in System Configuration, see Global Authentication Setup.

Tip For information on enabling PEAP in System Configuration, see Global Authentication Setup.

Users whose Windows accounts reside in "remote" domains (that is, not the domain within which Cisco Secure ACS is running) can only use the Windows-based password aging if they supply their domain names.

The methods and functionality of Windows password aging differ according to whether you are using Windows NT or Windows 2000, and whether you employ Active Directory (AD) or Security Accounts Manager (SAM). Setting password aging for users in the Windows NT/2000 database is only one part of the larger task of setting security policies in Windows. For comprehensive information on Windows procedures, refer to your Windows NT/2000 system documentation.

Setting IP Address Assignment Method for a User Group

Perform this procedure to configure the way Cisco Secure ACS assigns IP addresses to users in the group. The four possible methods are as follows:

To set an IP address assignment method for a user group, follow these steps:

Result: The Group Setup Select page opens.

Step 2   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 3   From the Jump To list at the top of the page, choose IP Address Assignment.

Step 4   In the IP Assignment table, do one of the following:

---

Note    If there is more than one pool in the Selected Pools list, the users in this group are assigned to the first available pool in the order listed.

---

Tip To change the position of a pool in the list, select the pool name and click Up or Down until the pool is in the position you want.

Step 5   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 6   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Assigning a Downloadable PIX ACL to a Group

The Downloadable ACLs feature enables you to assign a PIX ACL at the group level.

Note   You must have established one or more PIX ACLs before attempting to assign one. For instructions on how to add a downloadable PIX ACL using the Shared Profile Components section of the Cisco Secure ACS HTML interface, see Adding a Downloadable PIX ACL, page 5-4.

Tip The Downloadable ACLs table does not appear if it has not been enabled. To enable the Downloadable ACLs table, click Interface Configuration, click Advanced Options, and then select the Group-Level Downloadable ACLs check box.

To assign a downloadable PIX ACL to a group, follow these steps:

Result: The Group Setup Select page opens.

Step 2   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 3   From the Jump To list at the top of the page, choose Downloadable ACLs.

Step 4   Under the Downloadable ACLs section, click the Assign PIX ACL check box.

Step 5   Select a PIX ACL from the list.

Step 6   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 7   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Configuring TACACS+ Settings for a User Group

Perform this procedure to configure and enable the service/protocol parameters to be applied for the authorization of each user who belongs to the group. For information on how to configure settings for the Shell Command Authorization Set, see Configuring a Shell Command Authorization Set for a User Group.

Note   To display or hide additional services or protocols, click Interface Configuration, click TACACS+ (Cisco IOS), and then select or clear items in the group column, as applicable.

To configure TACACS+ settings for a user group, follow these steps:

Result: The Group Setup Select page opens.

Step 2   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 3   From the Jump To list at the top of the page, choose TACACS+.

Result: The system displays the TACACS+ Settings table section.

Step 4   To configure services and protocols in the TACACS+ Settings table to be authorized for the group, follow these steps:

To employ custom attributes for a particular service, you must select the Custom attributes check box under that service, and then specify the attribute/value in the box below the check box.

For more information about attributes, see "TACACS+ Attribute-Value Pairs," or your AAA client documentation.

Tip For ACLs and IP address pools, the name of the ACL or pool as defined on the AAA client should be entered. (An ACL is a list of Cisco IOS commands used to restrict access to or from other devices and users on the network.)

---

Note    Leave the attribute value box blank if the default (as defined on the AAA client) should be used.

---

---

Note    You can define and download an ACL. Click Interface Configuration, click TACACS+ (Cisco IOS), and then select Display a window for each service selected in which you can enter customized TACACS+ attributes. A box opens under each service/protocol in which you can define an ACL.

---

Step 5   To allow all services to be permitted unless specifically listed and disabled, you can select the Default (Undefined) Services check box under the Checking this option will PERMIT all UNKNOWN Services table.

Warning This is an advanced feature and should only be used by administrators who understand the security implications.

Step 6   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 7   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Configuring a Shell Command Authorization Set for a User Group

Use this procedure to specify the shell command authorization set parameters for a group. There are four options:

To specify shell command authorization set parameters for a user group, follow these steps:

Result: The Group Setup Select page opens.

Step 2   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 3   From the Jump To list at the top of the page, choose TACACS+.

Result: The system displays the TACACS+ Settings table section.

Step 4   Use the vertical scrollbar to scroll to the Shell Command Authorization Set feature area.

Step 5   To prevent the application of any shell command authorization set, select (or accept the default of) the None option.

Step 6   To assign a particular shell command authorization set to be effective on any configured network device, follow these steps:

Step 7   To create associations that assign a particular shell command authorization set to be effective on a particular NDG, for each association, follow these steps:

Tip You can select a Command Set that will be effective for all Device Groups, that are not otherwise assigned, by assigning that set to the <default> Device Group.

Result: The associated NDG and shell command authorization set appear in the table.

Step 8   To define the specific Cisco IOS commands and arguments to be permitted or denied at the group level, follow these steps:

If you select Permit, users can issue all commands not specifically listed. If you select Deny, users can issue only those commands listed.

Warning This is a powerful, advanced feature and should be used by an administrator skilled with Cisco IOS commands. Correct syntax is the responsibility of the administrator. For information on how Cisco Secure ACS uses pattern matching in command arguments, see About Pattern Matching.

Tip To enter several commands, you must click Submit after specifying a command. A new command entry box appears below the box you just completed.

Configuring a PIX Command Authorization Set for a User Group

Use this procedure to specify the PIX command authorization set parameters for a user group. There are three options:

Before You Begin

To specify PIX command authorization set parameters for a user group,

Result: The Group Setup Select page opens.

Step 2   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 3   From the Jump To list at the top of the page, choose TACACS+.

Result: The system displays the TACACS+ Settings table section.

Step 4   Scroll down to the PIX Command Authorization Set feature area within the TACACS+ Settings table.

Step 5   To prevent the application of any PIX command authorization set, select (or accept the default of) the None option.

Step 6   To assign a particular PIX command authorization set to be effective on any configured network device, follow these steps:

Step 7   To create associations that assign a particular PIX command authorization set to be effective on a particular NDG, for each association, follow these steps:

Result: The associated NDG and PIX command authorization set appear in the table.

---

Note    To remove or edit an existing PIX command authorization set association, you can select the association from the list, and then click Remove Association.

---

Configuring Device-Management Command Authorization for a User Group

Use this procedure to specify the device-management command authorization set parameters for a group. Device-management command authorization sets support the authorization of tasks in Cisco device-management applications that are configured to use Cisco Secure ACS for authorization. There are three options:

To specify device-management application command authorization for a user group, follow these steps:

Result: The Group Setup Select page opens.

Step 2   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 3   From the Jump To list at the top of the page, choose TACACS+.

Result: The system displays the TACACS+ Settings table section.

Step 4   Use the vertical scrollbar to scroll to the device-management application feature area, where device-management application is the name of the applicable Cisco device-management application.

Step 5   To prevent the application of any command authorization set for the applicable device-management application, select the None option.

Step 6   To assign a particular command authorization set that affects device-management application actions on any network device, follow these steps:

Step 7   To create associations that assign a particular command authorization set that affects device-management application actions on a particular NDG, for each association, follow these steps:

Result: The associated NDG and command authorization set appear in the table.

Configuring IETF RADIUS Settings for a User Group

These parameters appear only when both the following are true:

RADIUS attributes are sent as a profile for each user from Cisco Secure ACS to the requesting AAA client. To display or hide any of these attributes, see Protocol Configuration Options for RADIUS. For a list and explanation of RADIUS attributes, see "RADIUS Attributes". For more information about how your AAA client uses RADIUS, refer to your AAA client vendor documentation.

To configure IETF RADIUS attribute settings to be applied as an authorization for each user in the current group, follow these steps:

Result: The Group Setup Select page opens.

Step 2   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 3   From the Jump To list at the top of the page, choose RADIUS (IETF).

Step 4   For each IETF RADIUS attribute you need to authorize for the current group, select the check box next to the attribute and then define the authorization for the attribute in the field or fields next to it.

Step 5   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 6   To configure the vendor-specific attributes (VSAs) for any RADIUS network device vendor supported by Cisco Secure ACS, see the appropriate section:

Step 7   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Configuring Cisco IOS/PIX RADIUS Settings for a User Group

The Cisco IOS/PIX RADIUS parameters appear only when both the following are true:

Cisco IOS/PIX RADIUS represents only the Cisco VSAs. You must configure both the IETF RADIUS and Cisco IOS/PIX RADIUS attributes.

Note   To hide or display Cisco IOS/PIX RADIUS attributes, see Setting Protocol Configuration Options for Non-IETF RADIUS Attributes. A VSA applied as an authorization to a particular group persists, even when you remove or replace the associated AAA client; however, if you have no AAA clients of this (vendor) type configured, the VSA settings do not appear in the group configuration interface.

To configure and enable Cisco IOS/PIX RADIUS attributes to be applied as an authorization for each user in the current group, follow these steps:

Step 2   For the Cisco attributes, determine the attributes to be authorized for the group by selecting the check box next to the attribute, and then type the commands (such as TACACS+ commands) to be packed as a RADIUS VSA.

Step 3   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 4   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Configuring Cisco Aironet RADIUS Settings for a User Group

The Cisco Aironet RADIUS VSA appears only when both the following are true:

The single Cisco Aironet RADIUS VSA, Cisco-Aironet-Session-Timeout, is a specialized implementation of the IETF RADIUS Session-Timeout attribute (27). When Cisco Secure ACS responds to an authentication request from a Cisco Aironet Access Point and the Cisco-Aironet-Session-Timeout attribute is configured, Cisco Secure ACS sends to the wireless device this value in the IETF Session-Timeout attribute. The Cisco Aironet RADIUS VSA enables you to provide one session timeout value for wireless end-user clients and a different session timeout value for wired end-user clients.

Note   To hide or display the Cisco Aironet RADIUS VSA, see Setting Protocol Configuration Options for Non-IETF RADIUS Attributes. A VSA applied as an authorization to a particular group persists, even when you remove or replace the associated AAA client; however, if you have no AAA clients of this (vendor) type configured, the VSA settings do not appear in the group configuration interface.

To configure and enable the Cisco Aironet RADIUS attribute to be applied as an authorization for each user in the current group, follow these steps:

Step 2   In the navigation bar, click Group Setup.

Result: The Group Setup Select page opens.

Step 3   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 4   From the Jump To list at the top of the page, choose RADIUS (Cisco Aironet).

Step 5   In the Cisco Aironet RADIUS Attributes table, select the [5842\001] Cisco-Aironet-Session-Timeout check box.

Step 6   In the [5842\001] Cisco-Aironet-Session-Timeout box, type the session timeout value (in seconds) that Cisco Secure ACS is to send in the IETF RADIUS Session-Timeout (27) attribute when the AAA client is configured in Network Configuration to use the RADIUS (Cisco Aironet) authentication option. The recommended value is 600 seconds.

For more information about the IETF RADIUS Session-Timeout attribute, see "RADIUS Attributes," or your AAA client documentation.

Step 7   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 8   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Configuring Ascend RADIUS Settings for a User Group

The Ascend RADIUS parameters appear only when both the following are true:

Ascend RADIUS represents only the Ascend proprietary attributes. You must configure both the IETF RADIUS and Ascend RADIUS attributes. Proprietary attributes override IETF attributes.

The default attribute setting displayed for RADIUS is Ascend-Remote-Addr.

Note   To hide or display Ascend RADIUS attributes, see Setting Protocol Configuration Options for Non-IETF RADIUS Attributes. A VSA applied as an authorization to a particular group persists, even when you remove or replace the associated AAA client; however, if you have no AAA clients of this (vendor) type configured, the VSA settings do not appear in the group configuration interface.

To configure and enable Ascend RADIUS attributes to be applied as an authorization for each user in the current group, follow these steps:

Step 2   In the navigation bar, click Group Setup.

Result: The Group Setup Select page opens.

Step 3   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 4   From the Jump To list at the top of the page, choose RADIUS (Ascend).

Step 5   In the Ascend RADIUS Attributes table, determine the attributes to be authorized for the group by selecting the check box next to the attribute. Be sure to define the authorization for that attribute in the field next to it. For more information about attributes, see "RADIUS Attributes," or your AAA client documentation.

Step 6   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 7   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Configuring Cisco VPN 3000 Concentrator RADIUS Settings for a User Group

The Cisco VPN 3000 Concentrator RADIUS attribute configurations appear only if both the following are true:

Cisco VPN 3000 Concentrator RADIUS represents only the Cisco VPN 3000 Concentrator VSA. You must configure both the IETF RADIUS and Cisco VPN 3000 Concentrator RADIUS attributes.

Note   To hide or display Cisco VPN 3000 Concentrator RADIUS attributes, see Setting Protocol Configuration Options for Non-IETF RADIUS Attributes. A VSA applied as an authorization to a particular group persists, even when you remove or replace the associated AAA client; however, if you have no AAA clients of this (vendor) type configured, the VSA settings do not appear in the group configuration interface.

To configure and enable Cisco VPN 3000 Concentrator RADIUS attributes to be applied as an authorization for each user in the current group, follow these steps:

For more information about setting IETF RADIUS attributes, see Configuring IETF RADIUS Settings for a User Group.

Step 2   In the navigation bar, click Group Setup.

Result: The Group Setup Select page opens.

Step 3   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 4   From the Jump To list at the top of the page, choose RADIUS (Cisco VPN 3000).

Step 5   In the Cisco VPN 3000 Concentrator RADIUS Attributes table, determine the attributes to be authorized for the group by selecting the check box next to the attribute. Further define the authorization for that attribute in the field next to it.

For more information about attributes, see "RADIUS Attributes," or the documentation for network devices using RADIUS.

Step 6   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 7   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Configuring Cisco VPN 5000 Concentrator RADIUS Settings for a User Group

The Cisco VPN 5000 Concentrator RADIUS attribute configurations display only when both the following are true:

Cisco VPN 5000 Concentrator RADIUS represents only the Cisco VPN 5000 Concentrator VSA. You must configure both the IETF RADIUS and Cisco VPN 5000 Concentrator RADIUS attributes.

Note   To hide or display Cisco VPN 5000 Concentrator RADIUS attributes, see Setting Protocol Configuration Options for Non-IETF RADIUS Attributes. A VSA applied as an authorization to a particular group persists, even when you remove or replace the associated AAA client; however, if you have no AAA clients of this (vendor) type configured, the VSA settings do not appear in the group configuration interface.

To configure and enable Cisco VPN 5000 Concentrator RADIUS attributes to be applied as an authorization for each user in the current group, follow these steps:

For more information about setting IETF RADIUS attributes, see Configuring IETF RADIUS Settings for a User Group.

Step 2   In the navigation bar, click Group Setup.

Result: The Group Setup Select page opens.

Step 3   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 4   From the Jump To list at the top of the page, choose RADIUS (Cisco VPN 5000).

Step 5   In the Cisco VPN 5000 Concentrator RADIUS Attributes table, select the attributes that should be authorized for the group by selecting the check box next to the attribute. Further define the authorization for each attribute in the field next to it.

For more information about attributes, see "RADIUS Attributes," or the documentation for network devices using RADIUS.

Step 6   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 7   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Configuring Microsoft RADIUS Settings for a User Group

Microsoft RADIUS provides VSAs supporting MPPE, which is an encryption technology developed by Microsoft to encrypt PPP links. These PPP connections can be via a dial-in line, or over a VPN tunnel. The Microsoft RADIUS attribute configurations appear only when both the following are true:

The following Cisco Secure ACS RADIUS protocols support the Microsoft RADIUS VSA:

Microsoft RADIUS represents only the Microsoft VSA. You must configure both the IETF RADIUS and Microsoft RADIUS attributes.

Note   To hide or display Microsoft RADIUS attributes, see Setting Protocol Configuration Options for Non-IETF RADIUS Attributes. A VSA applied as an authorization to a particular group persists, even when you remove or replace the associated AAA client; however, if you have no AAA clients of this (vendor) type configured, the VSA settings do not appear in the group configuration interface.

To configure and enable Microsoft RADIUS attributes to be applied as an authorization for each user in the current group, follow these steps:

For more information about setting IETF RADIUS attributes, see Configuring IETF RADIUS Settings for a User Group.

Step 2   In the navigation bar, click Group Setup.

Result: The Group Setup Select page opens.

Step 3   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 4   From the Jump To list at the top of the page, choose RADIUS (Microsoft).

Step 5   In the Microsoft RADIUS Attributes table, specify the attributes to be authorized for the group by selecting the check box next to the attribute. Where applicable, further define the authorization for that attribute in the field next to it. For more information about attributes, see "RADIUS Attributes", or the documentation for network devices using RADIUS.

---

Note    The MS-CHAP-MPPE-Keys attribute value is autogenerated by Cisco Secure ACS; there is no value to set in the HTML interface.

---

Step 6   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 7   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Configuring Nortel RADIUS Settings for a User Group

The Nortel RADIUS attribute configurations appear only when both the following are true:

Nortel RADIUS represents only the Nortel VSA. You must configure both the IETF RADIUS and Nortel RADIUS attributes.

Note   To hide or display Nortel RADIUS attributes, see Setting Protocol Configuration Options for Non-IETF RADIUS Attributes. A VSA applied as an authorization to a particular group persists, even when you remove or replace the associated AAA client; however, if you have no AAA clients of this (vendor) type configured, the VSA settings do not appear in the group configuration interface.

To configure and enable Nortel RADIUS attributes to be applied as an authorization for each user in the current group, follow these steps:

For more information about setting IETF RADIUS attributes, see Configuring IETF RADIUS Settings for a User Group.

Step 2   In the navigation bar, click Group Setup.

Result: The Group Setup Select page opens.

Step 3   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 4   From the Jump To list at the top of the page, choose RADIUS (Nortel).

Step 5   In the Nortel RADIUS Attributes table, specify the attributes to be authorized for the group by selecting the check box next to the attribute. Where applicable, further define the authorization for that attribute in the field next to it. For more information about attributes, see "RADIUS Attributes", or the documentation for network devices using RADIUS.

---

Note    The MS-CHAP-MPPE-Keys attribute value is autogenerated by Cisco Secure ACS; there is no value to set in the HTML interface.

---

Step 6   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 7   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Configuring Juniper RADIUS Settings for a User Group

Juniper RADIUS represents only the Juniper VSA. You must configure both the IETF RADIUS and Juniper RADIUS attributes.

Note   To hide or display Juniper RADIUS attributes, see Setting Protocol Configuration Options for Non-IETF RADIUS Attributes. A VSA applied as an authorization to a particular group persists, even when you remove or replace the associated AAA client; however, if you have no AAA clients of this (vendor) type configured, the VSA settings do not appear in the group configuration interface.

To configure and enable Juniper RADIUS attributes to be applied as an authorization for each user in the current group, follow these steps:

For more information about setting IETF RADIUS attributes, see Configuring IETF RADIUS Settings for a User Group.

Step 2   In the navigation bar, click Group Setup.

Result: The Group Setup Select page opens.

Step 3   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 4   From the Jump To list at the top of the page, choose RADIUS (Juniper).

Step 5   In the Juniper RADIUS Attributes table, specify the attributes to be authorized for the group by selecting the check box next to the attribute. Where applicable, further define the authorization for that attribute in the field next to it. For more information about attributes, see "RADIUS Attributes", or the documentation for network devices using RADIUS.

---

Note    The MS-CHAP-MPPE-Keys attribute value is autogenerated by Cisco Secure ACS; there is no value to set in the HTML interface.

---

Step 6   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 7   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Configuring BBSM RADIUS Settings for a User Group

BBSM RADIUS represents only the BBSM RADIUS VSA. You must configure both the IETF RADIUS and BBSM RADIUS attributes.

Note   To hide or display BBSM RADIUS attributes, see Setting Protocol Configuration Options for Non-IETF RADIUS Attributes. A VSA applied as an authorization to a particular group persists, even when you remove or replace the associated AAA client; however, if you have no AAA clients of this (vendor) type configured, the VSA settings do not appear in the group configuration interface.

To configure and enable BBSM RADIUS attributes to be applied as an authorization for each user in the current group, follow these steps:

For more information about setting IETF RADIUS attributes, see Configuring IETF RADIUS Settings for a User Group.

Step 2   In the navigation bar, click Group Setup.

Result: The Group Setup Select page opens.

Step 3   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 4   From the Jump To list at the top of the page, choose RADIUS (BBSM).

Step 5   In the BBSM RADIUS Attributes table, specify the attribute to be authorized for the group by selecting the check box next to the attribute. Where applicable, further define the authorization for that attribute in the field next to it. For more information about attributes, see "RADIUS Attributes," or the documentation for network devices using RADIUS.

---

Note    The MS-CHAP-MPPE-Keys attribute value is autogenerated by Cisco Secure ACS; there is no value to set in the HTML interface.

---

Step 6   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 7   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Configuring Custom RADIUS VSA Settings for a User Group

User-defined, custom Radius VSA configurations appear only when all the following are true:

You must configure both the IETF RADIUS and the custom RADIUS attributes.

To configure and enable custom RADIUS attributes to be applied as an authorization for each user in the current group, follow these steps:

For more information about setting IETF RADIUS attributes, see Configuring IETF RADIUS Settings for a User Group.

Step 2   In the navigation bar, click Group Setup.

Result: The Group Setup Select page opens.

Step 3   From the Group list, select a group, and then click Edit Settings.

Result: The Group Settings page displays the name of the group at its top.

Step 4   From the Jump To list at the top of the page, choose RADIUS (custom name).

Step 5   In the RADIUS (custom name) Attributes table, specify the attributes to be authorized for the group by selecting the check box next to the attribute. Where applicable, further define the authorization for that attribute in the field next to it. For more information about attributes, see "RADIUS Attributes," or the documentation for network devices using RADIUS.

---

Note    The MS-CHAP-MPPE-Keys attribute value is autogenerated by Cisco Secure ACS; there is no value to set in the HTML interface.

---

Step 6   To save the group settings you have just made, click Submit.

For more information, see Saving Changes to User Group Settings.

Step 7   To continue specifying other group settings, perform other procedures in this chapter, as applicable.

Group Setting Management

This section describes how to use the Cisco Secure ACS Group Setup section to perform a variety of managerial tasks.

This section contains the following procedures:

Listing Users in a User Group

To list all users in a specified group, follow these steps:

Result: The Group Setup Select page opens.

Step 2   From the Group list, select the group.

Step 3   Click Users in Group.

Result: The User List page for the particular group selected opens in the display area.

Step 4   To open a user account (to view, modify, or delete a user), click the name of the user in the User List.

Result: The User Setup page for the particular user account selected appears.

Resetting Usage Quota Counters for a User Group

You can reset the usage quota counters for all members of a group, either before or after a quota has been exceeded.

To reset usage quota counters for all members of a user group, follow these steps:

Result: The Group Setup Select page opens.

Step 2   From the Group list, select the group.

Step 3   In the Usage Quotas section, select the On submit reset all usage counters for all users of this group check box.

Step 4   Click Submit at the bottom of the browser page.

Result: The usage quota counters for all users in the group are reset. The Group Setup Select page appears.

Renaming a User Group

To rename a user group, follow these steps:

Result: The Group Setup Select page opens.

Step 2   From the Group list, select the group.

Step 3   Click Rename Group.

Result: The Renaming Group: Group Name page appears.

Step 4   Type the new name in the Group field. Group names cannot contain angle brackets (< or >).

Step 5   Click Submit.

---

Note    The group remains in the same position in the list. The number value of the group is still associated with this group name. Some utilities, such as the database import utility, use the numeric value associated with the group.

---

Result: The Select page opens with the new group name selected.

Saving Changes to User Group Settings

After you have completed configuration for a group, be sure to save your work.

To save the configuration for the current group, follow these steps:

Tip To save your changes and apply them immediately, click Submit + Restart.

Result: The group attributes are applied and services are restarted. The Edit page opens.

---

Note    Restarting the service clears the Logged-in User Report and temporarily interrupts all Cisco Secure ACS services. This affects the Max Sessions counter.

---

Step 2   To verify that your changes were applied, select the group and click Edit Settings. View the settings.