Cisco Secure Access Control Server Solution Engine

Table Of Contents

Supported and Interoperable
Devices and Software Tables for Cisco Secure ACS Solution Engine Release 4.0

Introduction

Tested Network Elements and Software

Tested Network Elements

Tested Software

Supported ACS Software Versions

Remote Agent Support

Windows Support for the Remote Agent

Solaris Support for the Remote Agent

Tested Windows Security Patches

Security Patch Process

Windows Server 2003 Patches

Windows 2000 Server Patches

Supported Upgrades

Supported Migrations

Third-party RADIUS and TACACS+ Clients

Supported and Interoperable Devices and Software

Supported and Interoperable
Devices and Software Tables for Cisco Secure ACS Solution Engine Release 4.0

---

Revised: June 27, 2007, OL-8616-03

Introduction

The Cisco Secure Access Control Server Solution Engine Release 4.0, hereafter referred to as ACS, works with hundreds of devices. Given the number of devices, this device list might significantly differ from other Cisco products. Use this list to find:

•Tested devices and software that we support.

•Interoperable devices and software.

---

Note Cisco officially supports only tested devices and software. However, Cisco also supports any standard TACACS+ or RADIUS client.

---

For information on ACS SE hardware platforms and supported ACS software versions, see Supported ACS Software Versions. For details regarding limitations and known problems, see the Release Notes for Cisco Secure ACS Solution Engine 4.0.

This document contains the following sections:

•Tested Network Elements and Software

•Supported ACS Software Versions

•Remote Agent Support

•Tested Windows Security Patches

•Supported Upgrades

•Supported Migrations

•Third-party RADIUS and TACACS+ Clients

•Supported and Interoperable Devices and Software

Tested Network Elements and Software

This section lists the network elements and software that have been tested with ACS 4.0.

Tested Network Elements

Cisco has tested the following network elements:

•Routers

–Cisco 800

–Cisco 1600

–Cisco 1700

–Cisco 2600

–Cisco 3600

–Cisco 3810

–Cisco 7100

–Cisco 7200

–Cisco uBR7114E

–Cisco AS5300

•Switches

–Catalyst 3550

–Catalyst 4500

–Catalyst 6500/Cisco 7600

•Security Appliances

–PIX 500 Series Firewall

–VPN 3000

•Wireless Access Points

–AP350

–AP1100

–AP1200

–Airespace controller

–Airespace controller

Cisco has not tested the following network elements:

•Routers:

–Cisco 1800

–Cisco 2800

–Cisco 3800

•Switches:

–Catalyst 3560

–Catalyst 3750

Tested Software

Cisco has tested the following Cisco and third-party software:

•Cisco Trust Agent (CTA), v.2.x

•Microsoft IIS 5.0

•Microsoft IIS 6.0

•Microsoft Internet Explorer, v.6.0 (SP1)

•Microsoft OS (Windows 2000 Server SP4, Windows 2003 Standard Edition, Windows 2003 Enterprise Edition)

•NAI VirusScan Enterprise, v.8.0

•Netscape Communicator for Microsoft Windows, v.8.0

•Novell Directory NetWare, v.6.5

•Novell NDS eDirectory, v.8.6

•Red Hat Linux Enterprise, v.3.0 WS

•RSA ACE/Server, v.6.0

•Safeword Premier Access, v.3.1, 3.2

•Secure RSA agent for Windows, v.5.6

•Secure RSA Server (OTP), v.5.2

•Solaris 8 for SPARC

•Sun Java Plug-in, v.1_5_0_02

•SunONE Identity Server (Formerly iPlanet Directory), v.5.2

•Supplicants for supported protocols (1 for each)

•Third-party Auditing Servers (tested with QualysGuard Appliance by Qualys and Wholesecurity by Symantec)

•Trend Micro Antibody Server Corporate Edition, v.6.5

•Trend Micro OfficeScan Server Corporate Edition, v.6.5

•Win XP(SP2) and a Hotfix for the MS PEAP fast reconnect defect, for dialup clients used as 802.1x supplicants

Supported ACS Software Versions

Table 1 details the Cisco Secure ACS software versions that each Cisco Secure ACS platform supports.

Table 1 Supported Versions

Cisco Secure ACS Solution Engine Platform	Cisco Secure ACS version 4.0	Cisco Secure ACS version 3.3	Cisco Secure ACS version 3.2
Cisco 1111	Yes	Yes1	Yes
Cisco 1112	Yes2	Yes	No
Cisco 1113	Yes	No	No

1 To upgrade an existing Cisco 1111 platform to Cisco Secure ACS version 3.3, see Supported Upgrades. 2 To upgrade an existing Cisco 1112 or 1113 platform to Cisco Secure ACS version 4.0, see Supported Upgrades.

Remote Agent Support

Cisco Secure ACS 4.0 supports Cisco Secure ACS Remote Agent on the Microsoft Windows and Solaris operating systems. The following sections describe ACS Remote Agent support.

Windows Support for the Remote Agent

The Remote Agent runs on following English-language versions of the Windows operating system and service pack:

---

Note You must use only English-language versions of the operating system and the service pack.

---

•Windows 2000 Server, with Service Pack 4 installed

•Windows 2000 Advanced Server

–with Service Pack 4 installed

–without features specific to Windows 2000 Advanced Server enabled

•Windows Server 2003, Enterprise Edition, with Service Pack 1 installed

•Windows Server 2003, Standard Edition, with Service Pack 1 installed

---

Note The following restrictions apply to support for Microsoft Windows operating systems:

•We have not tested and cannot support the multiprocessor feature of any supported operating system. However, we did test ACS with dual-processor computers.

•We cannot support the Microsoft clustering service on any supported operating system.

•We do not support Windows 2000 Datacenter Server.

---

When running ACS on Windows Server 2003, you might encounter event messages that falsely indicate that ACS services have failed. Bug CSCea91690 documents this issue. For details, see the Release Notes for Cisco Secure ACS Solution Engine 4.0.

Solaris Support for the Remote Agent

The Cisco Secure ACS Remote Agent for Solaris runs on Solaris 8.

---

Note The Solaris Remote Agent requires the libstdc++.so library (C++ runtime). Without this library, the Remote Agent is not operational. The default path is set in the environment variable LD_LIBRARY_PATH and the directory /router/lib.

---

Tested Windows Security Patches

---

Note The list of tested patches will be updated as additional patches are identified and tested.

---

Security Patch Process

Cisco Systems officially supports and encourages the installation of all Microsoft security patches for Windows 2000 Server and Windows Server 2003 when they are used with Cisco Secure ACS.

Cisco experience has shown that these patches do not cause problems with the operation of Cisco Secure ACS. If the installation of security patches does cause a problem with Cisco Secure ACS, please contact the Cisco TAC and Cisco will resolve the problem as quickly as possible.

For information about our process for evaluating and releasing Microsoft security patches for Cisco Secure ACS, see the Cisco Secure ACS Q&A area in the Product Literature area for the Cisco Secure Access Control Server Solution Engine at http://www.cisco.com.

Windows Server 2003 Patches

We tested ACS with the Windows Server 2003 patches that are documented in the following Microsoft Knowledge Base Articles:

•819696

•823182

•823559

•824105

•824141

•824146

•825119

•828028

•828035

•828741

•832894

•835732

•837001

•837009

•839643

•840374

Windows 2000 Server Patches

We tested ACS with the Windows 2000 Server patches that are documented in the following Microsoft Knowledge Base Articles:

•329115

•823182

•823559

•823980

•824105

•824141

•824146

•825119

•826232

•828035

•828741

•828749

•835732

•837001

•839643

Supported Upgrades

We tested upgrades of the Solution Engine from releases 3.2.3 and 3.3.3 to release 4.0. To upgrade the Solution Engine from an earlier release (3.2.1, 3.2.2, 3.3.1, and 3.3.2), you must first upgrade to release 3.3.3 and then upgrade to release 4.0. For more information, see Installation and Setup Guide for Cisco Secure ACS Solution Engine.

Supported Migrations

We support migration from ACS for Windows releases 3.0.4, 3.1.2, 3.2.3, 3.3.3, and 4.0 to release 4.0 or to release 4.0.1 of the ACS Solution Engine. To migrate from an earlier release of ACS for Windows (3.3.1, 3.3.2, 3.2.2, 3.2.1, 3.1.2, and 3.0.4), you must first upgrade to release 3.3.3 and then upgrade to release 4.0. For more information, see Installation and Setup Guide for Cisco Secure ACS Solution Engine.

To migrate the software running on a previous Cisco Secure Solution Engine hardware device (the Cisco 1111 or Cisco 1112), use the backup and restore feature of Cisco Secure ACS. For more information, see Installation and Setup Guide for Cisco Secure ACS Solution Engine.

Third-party RADIUS and TACACS+ Clients

ACS fully interoperates with third-party RADIUS and TACACS+ client devices that adhere to the governing protocols. Support for RADIUS and TACACS+ functions depends on the device-specific implementation. For example, on a specific device:

•TACACS+ might not be available for user authentication and authorization.

•RADIUS might not be available for administrative authentication and authorization.

For TACACS+ devices, ACS conforms to the TACACS+ protocol as defined by Cisco Systems in draft 1.78, which is available at http://www.cisco.com.

For RADIUS, ACS conforms to the following RFCs:

• RFC 2138—Remote Authentication Dial In User Service (RADIUS)

• RFC 2139—RADIUS Accounting

• RFC 2865—Remote Authentication Dial In User Service (RADIUS)

• RFC 2866—RADIUS Accounting

• RFC 2867—RADIUS Accounting for Tunnel Protocol Support

• RFC 2868—RADIUS Attributes for Tunnel Protocol Support

• RFC 2869—RADIUS Extensions

---

Note For details regarding the implementation of vendor-specific attributes (VSAs), see the User Guide for Cisco Secure Access Control Server Solution Engine.

---

For TACACS+ devices, ACS conforms to the TACACS+ protocol as defined by Cisco Systems in draft 1.78, which is available at http://www.cisco.com.

Supported and Interoperable Devices and Software

This section contains the following tables:

•Table 2, Web Browsers

•Table 3, Device Operating Systems

•Table 4, Routers

•Table 5, Access Devices/Universal Gateways

•Table 6, Cable Devices

•Table 7, Content Networking Devices

•Table 8, Security and VPN Devices

•Table 9, Storage Networking Devices

•Table 10, Switches

•Table 11, Cisco Aironet Software (Access Points for Wireless LAN)

•Table 12, CiscoWorks VMS

•Table 13, PKI/Certificate Servers

•Table 14, Token Servers

•Table 15, LDAP Servers

•Table 16, User Databases

•Table 17, Proxy Support

You can find information about new device support at http://www.cisco.com.

---

Note To ensure full ACS capabilities, you must use the most recent operating system release on the clients that you deploy. See Table 3, Device Operating Systems, for the minimum acceptable client operating system versions.

---

Table 2 Web Browsers¹  

Program	Versions	Notes
Microsoft Internet Explorer	Version 6.0 •Service Pack 1 for Microsoft Windows (English and Japanese Language versions) •Microsoft Java Virtual Machine (JVM, version 5.00.3810) •Sun Java Plug-in, v.1.5	Tested
Microsoft Internet Explorer	Version 5.5 •Service Pack 1 for Microsoft Windows •Japanese Language version •Sun Java Plug-in, v.1.4.2_04	Not Tested
Netscape Communicator	Version 8.0 for Microsoft Windows •English Language version •Sun Java Plug-in, v.1.5 Version 7.1 for Microsoft Windows •Japanese Language version •Sun Java Plug-in, v.1.5	Tested
Netscape Communicator	Versions 7.0, 7.1, and 7.2 for Microsoft Windows •English and Japanese Language versions •Sun Java Plug-in, v.1.4.2_04	Not Tested

1 To use a web browser to access the ACS web interface, you must enable Java and JavaScript in the browser. You must also disable the HTTP proxy in the browser.

Table 3 Device Operating Systems  

Operating System	Minimum Version	Notes
PIX	515E	PixOS 7.0(3)
IOS	11.2	For full RADIUS support.
CatOS	7.2	Cisco products—and other third-party products that are RFC compliant—will work with ACS when running earlier versions of CatOS. However, full functionality, including the 802.1x VLAN assignment, is supported only when using the listed version.

Table 4 Routers 

Series	Notes
Cisco 1400	End-Of-Life (EOL) Status
Cisco 1600	RADIUS and TACACS+ interoperability
Cisco 1700	RADIUS and TACACS+ interoperability
Cisco 2500	EOL
Cisco 2600	RADIUS and TACACS+ interoperability
Cisco 3600	RADIUS and TACACS+ interoperability
Cisco 3700	RADIUS and TACACS+ interoperability
Cisco 7100	RADIUS and TACACS+ interoperability
Cisco 7200	RADIUS and TACACS+ interoperability
Cisco 7300	RADIUS and TACACS+ interoperability
Cisco7400	RADIUS and TACACS+ interoperability
Cisco 7500	RADIUS and TACACS+ interoperability
Cisco 10000	RADIUS interoperability
Cisco 10720	RADIUS and TACACS+ interoperability

Table 5 Access Devices/Universal Gateways 

Series	Notes
6400 Series	RADIUS and TACACS+ interoperability
AS2600 Series	RADIUS and TACACS+ interoperability
AS5350 Series	RADIUS and TACACS+ interoperability
AS5300 Series	RADIUS and TACACS+ interoperability
AS5400 Series1	RADIUS and TACACS+ interoperability
AS5850 Series	RADIUS and TACACS+ interoperability
DSL Series/6015, 6100, 6130, 6160, 6260	RADIUS and TACACS+ interoperability
MGX Series/8220, 8250, 8800, 8950	TACACS+ interoperability

1 Tested on version 3.2, not retested on version 3.3.

Table 6 Cable Devices  

Devices	Notes
uBR71001	RADIUS and TACACS+ interoperability

1 Tested on version 3.2, not retested on version 3.3.

Table 7 Content Networking Devices¹  

Series/Devices	Notes
CE7300/CE 7320	RADIUS and TACACS+ interoperability
CDM4600/CDM4630, CDM4650	RADIUS and TACACS+ interoperability
4400 Content Routers/CR4430	RADIUS and TACACS+ interoperability

1 Tested on version 3.2, not retested on version 3.3.

Table 8 Security and VPN Devices  

Series/Devices	Notes
3000 Series Concentrator/ 3005, 3015, 3030, 3060, 3080	Tested with 3015 RADIUS and TACACS+ interoperability
PIX 500 Series Firewall/ 501, 506E, 515, 515E, 525, 535	Tested with 515 and PIX OS v6.3.5 RADIUS and TACACS+ interoperability
5000 Series Concentrator	EOL Status

Table 9 Storage Networking Devices  

Series	Devices Supported	Notes
MDS 9000	MDS 9216, MDS9509	RADIUS and TACACS+ interoperability

Table 10 Switches  

Series/Devices	Notes
Catalyst 3550	Tested with IOS 12.1(13)EA1a RADIUS and TACACS+ interoperability
Catalyst 4500	Tested with IOS 12.2(25)SG(1.93) RADIUS and TACACS+ interoperability
Catalyst 5000	EOL status
Catalyst 6500	Tested with CatOS 8.5.0(114)JAC RADIUS and TACACS+ interoperability
Catalyst 7600	Tested with CatOS 8.5.0(114)JAC Note You can run CatOS on the supervisor engine installed in a 7600-series chassis. Cisco does not market the 7600 series with the CatOS. RADIUS and TACACS+ interoperability

Table 11 Cisco Aironet Software (Access Points for Wireless LAN)  

Series	Notes
AP1100	RADIUS interoperability with IOS v12.3(4)JA
AP1200	RADIUS interoperability with IOS v12.3(4)JA

Table 12 CiscoWorks VMS  

Series	Version	Notes
IOS/Router MC	1.3.1	Tested with VMS 2.3 TACACS+ interoperability
Firewall MC	1.3	Tested with VMS2.3 TACACS+ interoperability
IDS MC	1.1	TACACS+ interoperability
HSE	1.7	TACACS+ interoperability

Table 13 PKI/Certificate Servers  

Platform	Versions	Notes
Microsoft CA Certificate Server	Windows 2000 Windows 2000 with Service Pack 4 Windows 2003 Enterprise and Standard editions	Tested
Entrust PKI	6.0	Not Tested
Verisign Onsite	5.0	Not Tested

Table 14 Token Servers¹  

Platform	Version	Client Requirement	Notes
ActivCard Server	3.1	—	Not Tested
CRYPTOCard CRYPTOAdmin	5.16	—	Not Tested
PassGo Defender	4.1.3	—	Not Tested
RSA ACE/Server	6.0	—	Tested
RSA ACE/Server	5.2	—	Tested
Safeword Premier Access	3.1, 3.2	—	Tested
Vasco Vacman Server	6.0.2	—	Not Tested

1 Cisco Secure ACS uses a RADIUS interface to support all token servers, with the exception of the RSA ACE/Server. For more information, see Changes to Token Server Support.

Table 15 LDAP Servers 

Platform	Version	Notes
SunONE Identity Server	5.2	Tested with Windows 2003, Enterprise Edition Tested with Solaris 8
Microsoft Active Directory		Tested with Windows 2003, Enterprise Edition
Open-LDAP	2.2.23	Tested with RedHat Enterprise Linux AS, Release 3 Tested with Open-SSL 0.9.7e
Novell NetWare Directory Services (NDS)	6.5	Tested
Novell eDirectory	8.7.1	Tested

Table 16 User Databases¹  

Platform	Version	Requirement
AD on Windows 2003	—	Tested with Service Pack 1
AD on Windows 2000	—	Tested with Service Pack 4
SAM on Windows 2000	—	Tested with Service Pack 4
SAM on Windows NT 4.0	—	Not Tested
LDAP	Generic	See Table 15
Novell NetWare	6.5	Not Tested
LEAP Proxy RADIUS servers	—	Tested

1 See also Table 14, Token Servers.

Table 17 Proxy Support  

Platform	Version	Notes
Cisco Secure ACS	—	Tested with version 4.0.1
Funk Steel Belted Radius	Enterprise Edition	Not Tested

Copyright © 2006 Cisco Systems, Inc.
All rights reserved.