Release Notes for Cisco Secure Access Control System 5.7
Available Languages
Table of Contents
Release Notes for Cisco Secure Access Control System 5.7
Supported Virtual Environments
Supported Device and User Repositories
New Features in ACS 5.7 Release
Exporting Additional Columns From ACS Administrator Entitlement Summary Report
Disable User Account After N Days of Inactivity
Disable and Delete Host Accounts After N Days of Inactivity
Support for Storing Password Hashes
Sending Notification Email to Users and Administrators About Their Password Expiry
Maximum Failed Attempts Count Policy
New Sub-Attributes for Service Type RADIUS IETF Attribute
Supporting SNMP Traps for Monitoring Disk Utilization
Log Message for CLI Administrator Account Locked Out
Establishing New Connection from Sybase if Oracle is down
Length Included Flags in Access Policies for TWLU Clients
ACS CLI Changes to TCP Parameters
New Light Weight REST API (getAllDevices)
RSA Public Key Authentication for SFTP Repository
Upgrading Cisco Secure ACS Software
Monitoring and Reports Data Export Compatibility
Installation and Upgrade Notes
Installing, Setting Up, and Configuring CSACS-1121
Installing, Setting Up, and Configuring Cisco SNS-3495 or Cisco SNS-3415
Resolved Issues in Cumulative Patch ACS 5.7.0.15.1
New Features introduced in ACS 5.7.0.15.1
Authenticating Administrators against RADIUS Identity and RSA SecurID Servers
Exporting Policies from ACS Web Interface
Changing Internal User Password from REST API
Resolved Issues in Cumulative Patch ACS 5.7.0.15.2
Resolved Issues in Cumulative Patch ACS 5.7.0.15.3
Resolved Issues in Cumulative Patch ACS 5.7.0.15.4
Limitations in ACS Deployments
Supplemental License Agreement
Obtaining Documentation and Submitting a Service Request
Release Notes for Cisco Secure Access Control System 5.7
This release notes pertain to the Cisco Secure Access Control System (ACS), Release 5.7, hereafter referred to as ACS 5.7. This release notes describes the features, limitations and restrictions (caveats), and related documentation for Cisco Secure ACS. The release notes supplement the Cisco Secure ACS documentation that is included with the product hardware and software release.
■
New Features in ACS 5.7 Release
■Upgrading Cisco Secure ACS Software
■Monitoring and Reports Data Export Compatibility
■Installation and Upgrade Notes
■Resolved Issues in Cumulative Patch ACS 5.7.0.15.1
■Resolved Issues in Cumulative Patch ACS 5.7.0.15.2
■Resolved Issues in Cumulative Patch ACS 5.7.0.15.3
■Resolved Issues in Cumulative Patch ACS 5.7.0.15.4
■Limitations in ACS Deployments
■Supplemental License Agreement
■Obtaining Documentation and Submitting a Service Request
Introduction
ACS is a policy-driven access control system and an integration point for network access control and identity management.
The ACS 5.7 software runs on a dedicated Cisco SNS-3495 appliance, on a Cisco SNS-3415 appliance, on a Cisco 1121 Secure Access Control System (CSACS-1121) or on a VMware server. ACS 5.7 ships on Cisco SNS-3495 and Cisco SNS-3415 appliances. However, ACS 5.7 continues to support CSACS-1121 appliance. You can upgrade to ACS 5.7 from any of the previous releases of ACS that runs on CSACS-1121 appliance. For more information on upgrade paths, see Upgrading Cisco Secure ACS Software.
This release of ACS provides new and enhanced functionality. Throughout this document, Cisco SNS-3495, Cisco SNS-3415 and CSACS-1121 refer to the appliance hardware, and ACS server refers to ACS software.
Note: Cisco runs a security scan on the ACS application during every major release. We do not recommend you run a security scanning in the ACS production environment because such an operation carries risks that could impact the ACS application. You can execute the security scan operation in a pre-production environment.
System Requirements
■Supported Virtual Environments
■Supported Device and User Repositories
Note: For more details on Cisco Secure ACS hardware platform and installation, see the Installation and Upgrade Guide for Cisco Secure Access Control System 5.7.
Note: No third-party software such as anti-virus or anti-malware, is supported in Cisco Secure ACS.
Supported Hardware
Cisco Secure ACS is packaged with your appliance or image for installation. Cisco Secure ACS 5.7 ships on the following platforms:
| ■ |
|
| ■ |
|
Cisco 1121 Secure Access Control System Hardware (CSACS-1121) |
■ |
■ ■ ■ ■ |
Supported Virtual Environments
ACS 5.7 supports the following VMware versions:
For information on VMware machine requirements and installation procedures, see the “ Installing ACS in a VMware Virtual Machine” chapter in the Installation and Upgrade Guide for Cisco Secure Access Control System 5.7.
Supported Browsers
You can access the ACS 5.7 administrative user interface using the following browsers:
–Mozilla Firefox version 24.4 ESR
–Mozilla Firefox version 45.0.2 ESR
■Windows 7 32-bit and Windows 7 64-bit
–Internet Explorer version 10.x
–Internet Explorer version 11.x
–Mozilla Firefox version 31.4.0 ESR
–Mozilla Firefox version 31.5.0 ESR
–Mozilla Firefox version 31.6.0 ESR
–Mozilla Firefox version 45.0.2 ESR
–Internet Explorer version 11.x
–Mozilla Firefox version 31.0 ESR
–Mozilla Firefox version 31.3.0 ESR
–Mozilla Firefox version 31.4.0 ESR
–Mozilla Firefox version 31.6.0 ESR
–Mozilla Firefox version 45.0.2 ESR
Note: Mozilla Firefox version 46.x or later is supported only after installing ACS 5.7 patch 3 or later.
Note: Adobe Flash Player 11.2.0.0 or above must be installed on the system running the client browser.
When you import or export a .csv file from ACS 5.x, you must turn off the pop-up blocker.
You can launch the ACS web interface using IPv6 addresses only in Internet Explorer 7.x or later and Mozilla Firefox 3.x versions.
New Features in ACS 5.7 Release
The following sections briefly describe the new features in the 5.7 release:
■Exporting Additional Columns From ACS Administrator Entitlement Summary Report
■Disable User Account After N Days of Inactivity
■Disable and Delete Host Accounts After N Days of Inactivity
■Support for Storing Password Hashes
■Sending Notification Email to Users and Administrators About Their Password Expiry
■Maximum Failed Attempts Count Policy
■New Sub-Attributes for Service Type RADIUS IETF Attribute
■Supporting SNMP Traps for Monitoring Disk Utilization
■Log Message for CLI Administrator Account Locked Out
■Establishing New Connection from Sybase if Oracle is down
■Length Included Flags in Access Policies for TWLU Clients
■ACS CLI Changes to TCP Parameters
■New Light Weight REST API (getAllDevices)
■RSA Public Key Authentication for SFTP Repository
Exporting Additional Columns From ACS Administrator Entitlement Summary Report
In ACS 5.6, while exporting the ACS Administrator Entitlement Summary Report, ACS exports the following two columns from the reports table to a comma separated value file:
But, in ACS 5.7, while exporting the ACS Administrator Entitlement Summary Report, ACS exports one additional column “Resources and Privileges” along with the “Administrator” and “Roles” column. The Resources and Privileges section contains the resources and privileges that are available for the respective administrator accounts.
New Administrator Roles
ACS 5.7 supports two new administrator roles named OperationsAdmin and ProvisioningAdmin.
These two administrator roles are comprised of the resources and privileges from a few existing administrator roles along with some extra resources and privileges.
To view the resources and privileges of the two new administrator roles:
1. Choose System Administration > Administrators > Roles from ACS web interface.
2. Click the radio button near OperationsAdmin or ProvisioningAdmin.
ACS displays the resources and privileges associated with ProvisioningAdmin.
The OperationsAdmin and ProvisioningAdmin can be used as a two different administrator accounts separately. You cannot use these two administrator roles together or along with any other administrator roles while creating administrator accounts.
If you try to create an administrator account using these two administrator roles together or along with any other administrator roles, ACS displays the following error:
You cannot assign these two administrator accounts as a recovery administrator account.
Disable User Account After N Days of Inactivity
ACS 5.7 allows the administrators to disable the user accounts based on the number of days they are not logged in to the network. The administrators can configure the maximum number of days in ACS web interface after which the user account should be disabled if the user is not logged in to the network. For this feature to work properly, the log collector server in the deployment should be running and receiving the syslog messages from all the nodes in the deployment and the log recovery must be enabled. This configuration is available in System Administration > Users > Authentication Settings > Advanced page. The administrator can enable the disabled user accounts. The subsequent calculation for the inactivity will be from the last enabled date. For more information on Disabling user account after n days of inactivity, see User Guide for Cisco Secure Access Control System 5.7.
Disable and Delete Host Accounts After N Days of Inactivity
ACS 5.7 allows the administrators to disable the host accounts if they are inactive for the configured number of days. Further, the administrator can delete the host accounts if they are inactive for configured number of days after the host account is disabled. For this feature to work properly, the log collector server in the deployment should be running and receiving the syslog messages from all the nodes in the deployment and the log recovery must be enabled. This configuration is available in System Administration > Hosts > Authentication Settings page. The administrator can enable the disabled host accounts. The subsequent calculation for the inactivity will be from the last enabled date. For more information on Disabling host account after n days of inactivity and Deleting host accounts after n+x days of inactivity, see User Guide for Cisco Secure Access Control System 5.7.
Support for Storing Password Hashes
To enhance security to internal users passwords, ACS 5.7 introduced the new feature “Enable Password Hash”. If you enable this option, the user password is converted to hashes using the PBKDF2 of Cisco SSL hashing algorithm and stored in the ACS internal user database as hashes. This feature is only applicable for password based authentications. Therefore, when this option is enabled, you cannot use CHAP and MSCHAP authentications. For information on how to enable or disable password hashing for internal users, see User Guide for Cisco Secure Access Control System 5.7.
Customizing the TACACS+ port
ACS 5.7 allows the administrator to customize the TACACS+ port from ACS web interface. In releases prior to ACS 5.7, the TACACS+ port field is a non-editable field. But in ACS 5.7, you can configure the TACACS+ port with number 49 and numbers ranging from 1024 to 65535. This operation restarts the ACS runtime and all registered instances.
Sending Notification Email to Users and Administrators About Their Password Expiry
ACS 5.7 allows the administrators to send an email every day to the internal users and administrators about their password expiry n days before their password expires. The administrators can configure the email address and the number of days from the ACS web interface. If this feature is configured in ACS, ACS verifies the users and administrators about their password expiry immediately after 5 minutes from the time of management processes are restarted. The subsequent verifications are performed every 24 hours from the last verified time. For information on this, see User Guide for Cisco Secure Access Control System 5.7.
Maximum Failed Attempts Count Policy
ACS 5.7 allows the administrator to disable the user accounts after n successive failed attempts. This feature is applicable only for internal users. ACS 5.7 introduces the login failed attempt count configuration for users and identity groups. The global login failed attempt count configuration is already available in ACS. The login failed attempt count at user level takes the precedence. If the maximum login failed attempts count is not configured at user level, then ACS proceeds to the identity group to which the user is associated. If the maximum login failed attempts count is not configured at the identity group level, then ACS proceeds to the parent group until it reaches the root in the hierarchy. If the login failed attempt count is not configured at the identity group level, then ACS proceeds to the global login failed attempt count configuration. If the user is configured less number of login failed attempt and the user group is configured with more number of login failed attempt count, ACS considers the login failed attempt count at the user level even though it is less. For more information on Maximum Failed Attempts Count Policy, see User Guide for Cisco Secure Access Control System 5.7.
New Sub-Attributes for Service Type RADIUS IETF Attribute
ACS 5.7 provides a set of standard IETF RADIUS attributes with a set of predefined sub-attributes and values. You can not edit these RADIUS IETF attributes. In ACS 5.7, you have two new sub-attributes for the RADIUS IETF attribute “Service Type” and they are:
You can use these two sub-attributes in policy conditions. These two sub-attributes are specifically designed for the HP devices to understand permissions of the user.
Supporting SNMP Traps for Monitoring Disk Utilization
ACS 5.7 allows you to send SNMP traps to an SNMP host if any of the above ACS partitions reaches its configured threshold disk utilization value. ACS introduces a new CLI command snmp-server trap dskThresholdLimit <value> to configure the threshold percentage for disk utilization. The threshold value in the above command represents the percentage of the available free space. After you configure this command from ACS CLI, a kron job starts running every minute and monitors the ACS partitions. If any one of the partitions reaches its threshold limit, then ACS sends a trap to the configured SNMP server with the disk path and the threshold limit value. You can view the SNMP traps using the traps receiver in a MIB browser. For information on how to configure SNMP Traps for Monitoring Disk Utilization, See User Guide for Cisco Secure Access Control System 5.7.
Log Message for CLI Administrator Account Locked Out
In ACS CLI, the administrator can enable the Lock Account option and configure the number of maximum failed attempts. If the administrator enters the wrong password for the number of times determined by the configuration, it leads to the account being locked out. Previous releases of ACS displayed the “Access Denied” message even though the account was locked due to the number of failed attempts count exceeding the threshold limit that was configured. This led to the failure of the customer in identifying the root cause of the login failure which was the maximum number of attempts being exceeded. Previous releases of ACS logged a log message in /var/log/secure file in the file system. Administrators cannot access that log messages. However, ACS 5.7 displays a log message in the ADE.log file when a CLI administrator's maximum failed attempt count exceeds the threshold limit. This helps the administrator to understand the proper reason for login failure and fix it accordingly. ACS 5.7 runs a kron job for every minute which identifies the locked accounts and sends those details to ADE logs. Administrators can verify the ADE logs if the access is denied to check if their maximum failed attempt count exceeds.
ACS displays the following log in ADE logs if the maximum failed attempt count exceeds:
Account for <username> is locked after 6 failed attempts and the latest attempt is from the host <host IP address> at <date> <time>.
Establishing New Connection from Sybase if Oracle is down
ACS 5.7 supports re-establishing the connection to Oracle database if the existing connection breaks due to a connectivity problem. When you export logs from ACS (Sybase) to Oracle database, ACS establishes a connection with the Oracle database and exports the log information. If the Oracle database goes down for some reason, previous releases of ACS did not try to establish a new connection with Oracle database, instead, it used the old connection even after the Oracle database comes up and running. To overcome this issue, ACS 5.7 establishes a new connection with the Oracle database after the Oracle database comes up and running. This feature does not require any configuration from ACS web interface.
Length Included Flags in Access Policies for TWLU Clients
Many Airplanes use Honeywell Terminal Wireless Local Area Network Unit (TWLU) clients that allows them to join a wireless network at various airports using WPA2-Enterprise EAP-TLS authentication method. The TWLU clients expects a key exchange message with L flag set in it. RFC 5216 does not require the length included flag to be set in the EAP-TLS authentications.
■The L bit (length included) is set to indicate the presence of the four-octet TLS message length field and must be set for the first fragmented TLS message or set of messages.
■The M bit (more fragments) is set on all fragments except the last fragment.
The S bit (EAP-TLS start) is set in an EAP-TLS start message. This differentiates the EAP-TLS start message from a fragment acknowledgment.
To make this authentication more secure, ACS introduces a new authentication protocol called “EAP-TLS L-bit” protocol under allowed protocols section of Default Network Access page in ACS web interface. This option adds a length included flag (L-bit) in the change cipher suite specification irrespective of the number of fragments present in it. Therefore, the Honeywell TWLU clients that are looking for L flag in the change cipher suite messages will get the L flag and the EAP-TLS authentication will be successful.
Change cipher specifications and encrypted handshake message fits inside a single packet. The recommended way of implementation is to create a separate group of all TWLU units and create an access policy with L flag included in it and use that access policy for all the TWLU units so that it will not disturb the other clients.
ACS CLI Changes to TCP Parameters
ACS 5.7 introduces a few new commands to fine tune the TCP parameters when there is a huge TACACS+ traffic. The following new commands are introduced:
For more information on these commands, see CLI Reference Guide for Cisco Secure Access Control System 5.7.
New Light Weight REST API (getAllDevices)
ACS 5.7 introduces a light weight getAllDevices API method that helps you to get all network resources and AAA clients information without the Network Device Group information. This API method returns only the minimal or basic information about the network resources and AAA clients in ACS. The basic information includes the name, IP address, description, device ID, version, and other authentication related details. This light weight API method does not retrieve the network device group information. This new light weight “getAllDevices” API method increases the response time to retrieve data from ACS.
If you use “getAll” API method to retrieve device information from ACS, when you have 10 devices, or 100 devices, it retrieves all information about the network devices including the network device groups quickly. But, when you have 10K devices and you try to retrieve device information using “getAll” API method, it takes around 30 minutes to process the request. Therefore, in such cases, you need to use the light weight “getAllDevices” API method. This light weight “getAllDevices” API method retrieves the limited basic information from ACS. You can use the name or ID of the device and use “getByName” or “getById” API methods to get all related information of that device and perform CRUD operations on the retrieved objects.
If you are going to use the light weight “getAllDevices” API method, you must add a version field in your database. The version field indicates that the number of times an object is modified. This version field must be increased by one every time when you update that object. When you retrieve data using “getAllDevices” method, the version field is also retrieved from ACS. You need to compare the object version in your database with the retrieved objects version from ACS. You need to compare the versions in your database with the records that are fetched from ACS. If the retrieved version of the object is different from what you have it in your database, then you need to update that object using the “getByName” or “getById” API methods.
RSA Public Key Authentication for SFTP Repository
In general, when you want to configure an SFTP repository in ACS, you need to configure it with a username and password in ACS 5.x. The password of SFTP users are changing frequently according to the system requirement. Every time when there is a change in the user password, user needs to update the password in ACS repository configuration which is troublesome. To overcome this issue, ACS allows you to configure SFTP repository with RSA public key based authentication.
In ACS 5.7, you can configure an SFTP repository with a username and RSA public key using which you can authenticate the users against the SFTP repository. For more information on configuring SFTP repository with RSA public key authentication, see User Guide for Cisco Secure Access Control System 5.7.
Upgrading Cisco Secure ACS Software
Cisco Secure Access Control System (ACS) supports upgrades from different versions of ACS 5.x to ACS 5.7. The supported upgrade paths include:
■Cisco Secure ACS, Release 5.5, recommended with latest patch applied
■Cisco Secure ACS, Release 5.6, recommended with latest patch applied
Follow the upgrade instructions in the Installation and Upgrade Guide for Installation and Upgrade Guide for Cisco Secure Access Control System 5.7. to upgrade to Cisco Secure ACS, Release 5.7.
Monitoring and Reports Data Export Compatibility
Exporting monitoring and troubleshooting records to a remote database does not work if the remote database is an Oracle database and it is configured in a cluster setup.
Installation and Upgrade Notes
This section provides information on the installation tasks and configuration process for ACS 5.7.
■Installing, Setting Up, and Configuring CSACS-1121
■Installing, Setting Up, and Configuring Cisco SNS-3495 or Cisco SNS-3415
Installing, Setting Up, and Configuring CSACS-1121
This section describes how to install, set up, and configure the CSACS-1121 series appliance. The CSACS-1121 series appliance is preinstalled with the software.
To set up and configure the CSACS-1121:
1. Open the box containing the CSACS-1121 Series appliance and verify that it includes:
■The CSACS-1121 Series appliance
■ Regulatory Compliance and Safety Information for Cisco Secure Access Control System 5.7
2. Go through the specifications of the CSACS-1121 Series appliance.
For more details, see the Installation and Upgrade Guide for Cisco Secure Access Control System 5.7 .
3. Read the general precautions and safety instructions that you must follow before installing the CSACS-1121 Series appliance.
For more details, see the Installation and Upgrade Guide for Cisco Secure Access Control System 5.7 and pay special attention to all safety warnings.
4. Install the appliance in the 4-post rack, and complete the rest of the hardware installation.
For more details on installing the CSACS-1121 Series appliance, see the Installation and Upgrade Guide for Cisco Secure Access Control System 5.7.
5. Connect the CSACS-1121 Series appliance to the network, and connect either a USB keyboard and Video Graphics Array (VGA) monitor or a serial console to the serial port.
Figure 1 shows the back panel of the CSACS-1121 Series appliance and the various cable connectors.
Note: For the initial setup, you must have either a USB keyboard and VGA monitor or a serial console running terminal emulation software.
For more details, see the Installation and Upgrade Guide for Cisco Secure Access Control System 5.7.
For information on installing ACS 5.7 on VMware, see the “ Installing ACS in a VMware Virtual Machine” chapter in the Installation and Upgrade Guide for Cisco Secure Access Control System 5.7.
Figure 1 CSACS 1121 Series Appliance Rear View
The following table describes the callouts in Figure 1.
6. After completing the hardware installation, power up the appliance.
The first time you power up the appliance, you must run the setup program to configure the appliance. For more information, see Running the Setup Program.
Installing, Setting Up, and Configuring Cisco SNS-3495 or Cisco SNS-3415
The Cisco SNS-3495 and Cisco SNS-3415 appliances do not have a DVD drive. You must use the CIMC on the appliance or a bootable USB to install, set up, and configure ACS 5.7 on this appliance. For more details, see the Installation and Upgrade Guide for the Cisco Secure Access Control System 5.7 .
This section describes how to install, set up and configure the Cisco SNS-3495 and Cisco SNS-3415 appliance. The Cisco SNS-3495 and Cisco SNS-3415 appliance are preinstalled with the software.
To set up and configure the Cisco SNS-3495 and Cisco SNS-3415:
1. Open the box containing the Cisco SNS-3495 and Cisco SNS-3415 appliances and verify that it includes:
■The Cisco SNS-3495 and Cisco SNS-3415 appliance
■ Regulatory Compliance and Safety Information for Cisco Secure Access Control System 5.7
2. Go through the specifications of the Cisco SNS-3495 or Cisco SNS-3415 appliance.
For more details, see the Installation and Upgrade Guide for the Cisco Secure Access Control System 5.7 .
3. Read the general precautions and safety instructions that you must follow before installing the Cisco SNS-3415 or Cisco SNS-3495 appliance.
For more details, see the Installation and Upgrade Guide for the Cisco Secure Access Control System 5.7 and pay special attention to all safety warnings.
4. Install the appliance in the 4-post rack, and complete the rest of the hardware installation.
For more details on installing the Cisco SNS-3495 or Cisco SNS-3415 appliance, see the
Installation and Upgrade guide for the Cisco Secure Access Control System 5.7.
5. Connect the Cisco SNS-3495 or Cisco SNS-3415 appliance to the network and connect either a USB keyboard and Video Graphics Array (VGA) monitor or a serial console to the serial port.
See the Installation and Upgrade guide for Cisco Secure Access Control System 5.7 for illustrations of the front and back panel of the Cisco SNS-3495 and Cisco SNS-3415 appliance and the various cable connectors.
Note: For the initial setup, you must have either a USB keyboard and VGA monitor or a serial console running terminal-emulation software.
For more details, see the Installation and Upgrade Guide for the Cisco Secure Access Control System 5.7 .
For information on installing ACS 5.7 on VMware, see the” Installing ACS in a VMware Virtual Machine” chapter in the Installation and Upgrade Guide for the Cisco Secure Access Control System 5.7.
6. After completing the hardware installation, power up the appliance.
The first time you power up the appliance, you must run the setup program to configure the appliance. For more information, see the Installation and Upgrade Guide for the Cisco Secure Access Control System 5.7.
Running the Setup Program
The setup program launches an interactive CLI that prompts you for the required parameters. An administrator can use the console or a dumb terminal to configure the initial network settings and enter the initial administrator credentials for the ACS 5.7 server that is using the setup program. The setup process is a one-time configuration task.
At the login prompt, enter setup and press Enter.
The console displays a set of parameters. You must enter the parameters as described in Table 2.
Note: You can interrupt the setup process at any time by typing Ctrl-C before the last setup value is entered.
After you enter the parameters, the console displays:
After the ACS server is installed, the system reboots automatically. Now, you can log into ACS with the CLI username and password that was configured during the setup process.
You can use this username and password to log in to ACS only through the CLI. To log in to the web interface, you must use the predefined username ACSAdmin and password default.
When you access the web interface for the first time, you are prompted to change the predefined password for the administrator. You can also define access privileges for other administrators who will access the web interface.
Licensing in ACS 5.7
To operate ACS, you must install a valid license. ACS prompts you to install a valid license when you first access the web interface.
Each ACS instance (primary or secondary) in a distributed deployment requires a unique base license.
Types of Licenses
Table 3 lists the types of licenses that are available in ACS 5.7.
ACS 5.7 does not support auto installation of the evaluation license. Therefore, if you need an evaluation version of ACS 5.7, then you must obtain the evaluation license from Cisco.com and install ACS 5.7 manually.
If you do not have a valid SAS contract with any of the ACS products, you will not be able to download the ISO image from Cisco.com. In such case, you need to contact your local partner or the Cisco representative to get the ISO image.
Upgrading an ACS Server
If you have ACS 5.5 or ACS 5.6 installed on your machine, you can upgrade to ACS 5.7 using one of the following two methods:
■Upgrading an ACS server using the Application Upgrade Bundle
■Re imaging and upgrading an ACS server
You can perform an application upgrade on a Cisco appliance or a virtual machine only if the disk size is greater than or equal to 500 GB. If your disk size is lesser than 500 GB, you must re image to ACS 5.7, followed by a restore of the backup taken in ACS 5.5 or ACS 5.6, to move to ACS 5.7 Release.
See the Installation and Upgrade Guide for Cisco Secure Access Control System 5.7 for information on upgrading your ACS server.
Note: Upgrading to ACS 5.7 may fail if any LDAP identity store is configured without groups or attributes in it and AD identity store is not configured. To avoid this issue, before upgrading to ACS 5.7, you need to either add groups or attributes to the LDAP identity store or configure an AD identity store.
Note: You must provide full permission to NFS directory when you configure the NFS location using the backup-stagging-url command in ACS 5.7 to perform a successful On Demand Backup.
Note: You must disable FIPS before upgrading ACS 5.5 or ACS 5.6 to ACS 5.7 as FIPS cannot be disabled post-upgrade if protocols such as PAP and EAP-MD5 are needed for network access.
Applying Patches in ACS 5.7
Periodically, patches will be posted on Cisco.com that provide fixes to ACS 5.7. These patches are cumulative. Each patch includes all the fixes that were included in previous patches for the release.
In ACS 5.7, you must first install the ACS 5.7 Base patch before installing the Cumulative patch ACS 5.7.0.15.1. For subsequent patch installations, you can directly install the corresponding cumulative patches.
Applying ACS 5.7 Base Patch
This patch addresses the issues found in ACS 5.7 patch installation process. You must install the ACS 5.7 Base Patch from the Download Software location before you start installing ACS 5.7 Cumulative Patches.
To install the ACS 5.7 base patch, complete the following steps:
1. Login to Cisco.com and navigate to Products > Security > Access Control and Policy > Secure Access Control System > Secure Access Control System 5.7.
2. Download the ACS 5.7 Base Patch.
3. Login to ACS CLI using the administrator credentials.
4. Enter the patch install command in the EXEC mode to install the base patch.
patch install ACS57BasePatch.tar.gz repository-name
ACS displays the following confirmation message:
6. The ACS 5.7 patch upgrade bundle displays the md5 and sha256 checksum. Compare it with the value displayed on Cisco.com at the download site. Do one of the following:
■Enter Y if the crypto hashes match. If you enter Y, ACS proceeds with the installation steps and displays the following message:
The ACS version is upgraded to the base patch.
7. Enter show application command in EXEC mode to verify the base patch installation.
ACS CLI displays the following output:
You can observe that the CLI output displays Patch 1. If you see “Patches: 1” in the CLI output, then it indicates that the ACS 5.7 base patch is installed successfully.
8. You can also enter the show version history command to view more details such as installation time, name of the patch, and the repository used information about the base patch.
ACS CLI displays the following output:
Note: The base patch installation does not require a restart of ACS services.
■Enter N if the crypto hashes do not match. If you enter N, ACS stops the installation process.
Removing ACS 5.7 Base Patch
1. Login to ACS CLI using the administrator credentials.
2. Enter the following command in EXEC mode of ACS CLI:
ACS displays the following message:
ACS displays the following message after successfully removing the patch from ACS.
Applying Cumulative Patches
*You can download ACS 5.7 cumulative patches from the following location:
http://software.cisco.com/download/navigator.html
Note: In ACS 5.7, you must install ACS 5.7 Base patch before installing the cumulative patch ACS 5.7.0.15.1.
To download and apply the patches:
1. Log in to Cisco.com and navigate to Products > Security > Access Control and Policy > Policy and Access Management > Cisco Secure Access Control System > Cisco Secure Access Control System 5.7.
3. Install the ACS 5.7 cumulative patch. To do so:
Enter the following acs patch command in EXEC mode to install the ACS patch:
acs patch install patch-name .tar.gpg repository repository-name
ACS displays the following confirmation message:
Installing an ACS patch requires a restart of ACS services.
Would you like to continue? yes/no
Saved the ADE-OS running configuration to startup successfully
Getting bundle to local machine...
md5: aa45b77465147028301622e4c590cb84
sha256: 3b7f30d572433c2ad0c4733a1d1fb55cceb62dc1419b03b1b7ca354feb8bbcfa
% Please confirm above crypto hash with what is posted on download site.
5. The ACS 5.7 upgrade bundle displays the md5 and sha256 checksum. Compare it with the value displayed on Cisco.com at the download site. Do one of the following:
■Enter Y if the crypto hashes match. If you enter Y, ACS proceeds with the installation steps.
% Installing an ACS patch requires a restart of ACS services.
Would you like to continue? yes/no
■Enter N if the crypto hashes do not match. If you enter N, ACS stops the installation process.
The ACS version is upgraded to the applied patch. Check whether all services are running properly, using the show application status acs command from EXEC mode.
7. Enter the show application version acs command in EXEC mode and verify if the patch is installed properly or not.
Resolved ACS Issues
Table 4 lists the issues that are resolved in ACS 5.7.
Resolved Issues in Cumulative Patch ACS 5.7.0.15.1
ACS 5.7 allows you to install the cumulative patch ACS 5.7.0.15.1 only after installing ACS 5.7 Base patch. You must install the ACS 5.7 Base patch first and then install the cumulative patch ACS 5.7.0.15.1. Refer to Applying Patches in ACS 5.7 for instructions on how to apply the patches to your system. You can download the ACS 5.7 Base patch and 5.7.0.15.1 Cumulative patch from the Download Software location.
Table 5 lists the issues that are resolved in the ACS 5.7.0.15.1 cumulative patch.
New Features introduced in ACS 5.7.0.15.1
ACS 5.7 patch 1 introduces the following new features:
■Authenticating Administrators against RADIUS Identity and RSA SecurID Servers
Authenticating Administrators against RADIUS Identity and RSA SecurID Servers
Previous releases of ACS supports authenticating administrators only against Active Directory or LDAP. But, after installing ACS 5.7 patch 1, ACS supports authenticating administrators against RADIUS Identity Server and RSA SecurID Servers. This feature is available in both ACS web interface and acs-config mode of ACS CLI. This feature enhances security to administrator authentications using the One Time Password (OTP) that RADIUS Identity servers or RSA SecurID servers generate. For more information on this feature, see User Guide for Cisco Secure Access Control System 5.7.
Exporting Policies from ACS Web Interface
ACS 5.7, after installing patch 1, allows you to export the following policies and policy elements from ACS web interface as an XML file to a configured remote repository or to the configured email ids:
■Device Administration Policies
You must have an administrator account with SuperAdmin role to export policies from ACS web interface. ACS does not export access service policies of type external proxy. For more information, see User Guide for Cisco Secure Access Control System.
Changing Internal User Password from REST API
ACS, after installing patch 1, allows you to change the user password from REST API. You can use the GET method from REST API to retrieve the change password XML file from ACS. You can enter the old password and new password in the retrieved XML file and use the PUT method to update the same in ACS. This feature is applicable only for the internal users. For more information, see Software Developers’ Guide for Cisco Secure Access Control System.
Resolved Issues in Cumulative Patch ACS 5.7.0.15.2
Note: You must install 5.7 base patch before installing 5.7.0.15.2 if you are installing the cumulative patch 5.7.0.15.2 directly.
Table 6 lists the issues that are resolved in the ACS 5.7.0.15.2 cumulative patch.Refer to Applying Patches in ACS 5.7 for instructions on how to apply the patches to your system. You can download the ACS 5.7 Base patch and 5.7.0.15.2 Cumulative patch from the Download Software location.
Resolved Issues in Cumulative Patch ACS 5.7.0.15.3
ACS 5.7 allows you to install the cumulative patch ACS 5.7.0.15.3 only after installing ACS 5.7 Base patch. You must install the ACS 5.7 Base patch first and then install the cumulative patch ACS 5.7.0.15.3. Refer to Applying Patches in ACS 5.7 for instructions on how to apply the patches to your system. You can download the ACS 5.7 Base patch and 5.7.0.15.3 Cumulative patch from the Download Software location.
Table 7 lists the issues that are resolved in the ACS 5.7.0.15.3 cumulative patch.
Resolved Issues in Cumulative Patch ACS 5.7.0.15.4
ACS 5.7 allows you to install the cumulative patch ACS 5.7.0.15.4 only after installing ACS 5.7 Base patch. You must install the ACS 5.7 Base patch first and then install the cumulative patch ACS 5.7.0.15.4. Refer to Applying Patches in ACS 5.7 for instructions on how to apply the patches to your system. You can download the ACS 5.7 Base patch and 5.7.0.15.4 Cumulative patch from the Download Software location.
Table 8 lists the issues that are resolved in the ACS 5.7.0.15.4 cumulative patch.
Limitations in ACS Deployments
Table 9 describes the limitations in ACS deployments.
Known ACS Issues
Table 10 lists the known issues in ACS 5.7. You can also use the Bug Toolkit on Cisco.com to find any open bugs that do not appear here.
Documentation Updates
Table 11 lists the updates to Release Notes for Cisco Secure Access Control System 5.7.
Product Documentation
Note: It is possible for the printed and electronic documentation to be updated after original publication. Therefore, you should review the documentation on http://www.cisco.com for any updates.
Table 12 lists the product documentation that is available for ACS 5.7. To find end-user documentation for all the products on Cisco.com, go to: http://www.cisco.com/go/techdocs.
Select Products > Security > Access Control and Policy > Policy and Access Management > Cisco Secure Access Control System.
Notices
The following notices pertain to this software license.
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit ( http://www.openssl.org/).
This product includes cryptographic software written by Eric Young (eay@cryptsoft.com).
This product includes software written by Tim Hudson (tjh@cryptsoft.com).
The OpenSSL toolkit stays under a dual license, i.e. both the conditions of the OpenSSL License and the original SSLeay license apply to the toolkit. See below for the actual license texts. Actually both licenses are BSD-style Open Source licenses. In case of any license issues related to OpenSSL please contact openssl-core@openssl.org.
Copyright © 1998-2007 The OpenSSL Project. All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions, and the following disclaimer in the documentation and/or other materials provided with the distribution.
3. All advertising materials mentioning features or use of this software must display the following acknowledgment: “This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit ( http://www.openssl.org/)”.
4. The names “OpenSSL Toolkit” and “OpenSSL Project” must not be used to endorse or promote products derived from this software without prior written permission. For written permission, please contact openssl-core@openssl.org.
5. Products derived from this software may not be called “OpenSSL” nor may “OpenSSL” appear in their names without prior written permission of the OpenSSL Project.
6. Redistributions of any form whatsoever must retain the following acknowledgment:
“This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit ( http://www.openssl.org/)”.
THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT “AS IS”' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
This product includes cryptographic software written by Eric Young (eay@cryptsoft.com). This product includes software written by Tim Hudson (tjh@cryptsoft.com).
Copyright © 1995-1998 Eric Young (eay@cryptsoft.com). All rights reserved.
This package is an SSL implementation written by Eric Young (eay@cryptsoft.com).
The implementation was written so as to conform with Netscapes SSL.
This library is free for commercial and non-commercial use as long as the following conditions are adhered to. The following conditions apply to all code found in this distribution, be it the RC4, RSA, lhash, DES, etc., code; not just the SSL code. The SSL documentation included with this distribution is covered by the same copyright terms except that the holder is Tim Hudson (tjh@cryptsoft.com).
Copyright remains Eric Young’s, and as such any Copyright notices in the code are not to be removed. If this package is used in a product, Eric Young should be given attribution as the author of the parts of the library used. This can be in the form of a textual message at program startup or in documentation (online or textual) provided with the package.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
3. All advertising materials mentioning features or use of this software must display the following acknowledgement:
“This product includes cryptographic software written by Eric Young (eay@cryptsoft.com)”.
The word ‘cryptographic’ can be left out if the routines from the library being used are not cryptography-related.
4. If you include any Windows specific code (or a derivative thereof) from the apps directory (application code) you must include an acknowledgement: “This product includes software written by Tim Hudson (tjh@cryptsoft.com)”.
THIS SOFTWARE IS PROVIDED BY ERIC YOUNG “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
The license and distribution terms for any publicly available version or derivative of this code cannot be changed. i.e. this code cannot simply be copied and put under another distribution license [including the GNU Public License].
Supplemental License Agreement
END USER LICENSE AGREEMENT SUPPLEMENT FOR CISCO SYSTEMS ACCESS CONTROL SYSTEM SOFTWARE:
This End User License Agreement Supplement (“Supplement”) contains additional terms and conditions for the Software Product licensed under the End User License Agreement ("EULA") between you and Cisco (collectively, the "Agreement"). Capitalized terms used in this Supplement but not defined will have the meanings assigned to them in the EULA. To the extent that there is a conflict between the terms and conditions of the EULA and this Supplement, the terms and conditions of this Supplement will take precedence.
In addition to the limitations set forth in the EULA on your access and use of the Software, you agree to comply at all times with the terms and conditions provided in this Supplement. DOWNLOADING, INSTALLING, OR USING THE SOFTWARE CONSTITUTES ACCEPTANCE OF THE AGREEMENT, AND YOU ARE BINDING YOURSELF AND THE BUSINESS ENTITY THAT YOU REPRESENT (COLLECTIVELY, "CUSTOMER") TO THE AGREEMENT. IF YOU DO NOT AGREE TO ALL OF THE TERMS OF THE AGREEMENT, THEN CISCO IS UNWILLING TO LICENSE THE SOFTWARE TO YOU AND (A) YOU MAY NOT DOWNLOAD, INSTALL OR USE THE SOFTWARE, AND (B) YOU MAY RETURN THE SOFTWARE (INCLUDING ANY UNOPENED CD PACKAGE AND ANY WRITTEN MATERIALS) FOR A FULL REFUND, OR, IF THE SOFTWARE AND WRITTEN MATERIALS ARE SUPPLIED AS PART OF ANOTHER PRODUCT, YOU MAY RETURN THE ENTIRE PRODUCT FOR A FULL REFUND. YOUR RIGHT TO RETURN AND REFUND EXPIRES 30 DAYS AFTER PURCHASE FROM CISCO OR AN AUTHORIZED CISCO RESELLER, AND APPLIES ONLY IF YOU ARE THE ORIGINAL END USER PURCHASER.
For purposes of this Supplement, the Product name(s) and the Product description(s) you may order as part of Access Control System Software are:
A. Advanced Reporting and Troubleshooting License
Enables custom reporting, alerting and other monitoring and troubleshooting features.
Allows deployment to support more than 500 network devices (AAA clients that are counted by configured IP addresses). That is, the Large Deployment license enables the ACS deployment to support an unlimited number of network devices in the enterprise.
C. Advanced Access License (not available for Access Control System Software 5.0, will be released with a future Access Control System Software release)
Enables Security Group Access policy control functionality and other advanced access features.
2. ADDITIONAL LICENSE RESTRICTIONS
■Installation and Use. The Cisco Secure Access Control System (ACS) Software component of the Cisco SNS 3495, SNS 3415, and CSACS 1121 Hardware Platforms are preinstalled. CDs containing tools to restore this Software to the SNS 3495, SNS 3415, and CSACS 1121 hardware are provided to Customer for reinstallation purposes only. Customer may only run the supported Cisco Secure Access Control System Software Products on the Cisco SNS 3495, SNS 3415, and CSACS 1121 Hardware Platforms designed for its use. No unsupported Software product or component may be installed on the Cisco SNS 3495, SNS 3415, and CSACS 1121 Hardware Platform.
■Software Upgrades, Major and Minor Releases. Cisco may provide Cisco Secure Access Control System Software upgrades for the Cisco SNS 3495, SNS 3415, and CSACS 1121 Hardware Platforms as Major Upgrades or Minor Upgrades. If the Software Major Upgrades or Minor Upgrades can be purchased through Cisco or a recognized partner or reseller, the Customer should purchase one Major Upgrade or Minor Upgrade for each Cisco SNS 3495, SNS 3415, and CSACS 1121 Hardware Platforms. If the Customer is eligible to receive the Software release through a Cisco extended service program, the Customer should request to receive only one Software upgrade or new version release per valid service contract.
■Reproduction and Distribution. Customer may not reproduce nor distribute software.
Major Upgrade means a release of Software that provides additional software functions. Cisco designates Major Upgrades as a change in the ones digit of the Software version number [(x).x.x].
Minor Upgrade means an incremental release of Software that provides maintenance fixes and additional software functions. Cisco designates Minor Upgrades as a change in the tenths digit of the Software version number [x.(x).x].
4. DESCRIPTION OF OTHER RIGHTS AND LIMITATIONS
Please refer to the Cisco Systems, Inc., End User License Agreement.
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What’s New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What’s New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS Version 2.0.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)