Feedback
Table Of Contents
Introduction to Cisco Secure ACS Remote Agents
Configuring ACS SE for a Remote Agent
Introduction to Cisco Secure ACS Remote Agents
This chapter introduces Cisco Secure Access Control Server (ACS) Remote Agent for Windows and Cisco Secure ACS Remote Agent for Solaris.
This chapter contains the following topics:
•
Configuring ACS SE for a Remote Agent
Overview
ACS Remote Agent for Windows and ACS Remote Agent for Solaris are applications that support Cisco Secure ACS Solution Engine (ACS SE) for remote logging. Forwarding all accounting data from an appliance to a remote agent preserves disk space on the appliance. It also improves AAA performance by eliminating the frequent and time-consuming disk writes required for local logging on an appliance.
The Windows remote agent also supports Microsoft Windows authentication. If you want to support Microsoft Windows authentication with ACS SE, you must use ACS Remote Agent for Windows. Windows authentication requests must be submitted from a computer that is a member of a trusted Microsoft Windows domain. Because an ACS SE cannot be a member of a Microsoft Windows domain, we provide ACS Remote Agent for Windows. As an application running on a computer that belongs to a trusted Microsoft Windows domain, the remote agent can successfully pass authentication requests to the domain. The remote agent submits to Microsoft Windows each authentication request it receives from an appliance. When it receives the authentication response, the remote agent forwards the response to the appliance that initiated the request.
All communication between a remote agent and ACS SE is encrypted by using the Blowfish algorithm and a 128-bit key. Additionally, encryption session keys are randomized and exchanged between the remote agent and the appliances it services by using a public key exchange protocol.
For more information, see Remote Agent Concepts.
Limitations
We designed ACS Remote Agent with the following limitations.
•
•
Remote Agent Concepts
This section contains information about concepts fundamental to the operation and configuration of remote agents.
This section contains the following topics:
Configuration Tools
ACS Remote Agent has no graphical user interface or command-line interface. Instead, it derives its configuration from two sources:
•
•
Configuration Provider
Although a remote agent can accept inbound communication from many appliances, it accepts configuration instructions from only a single appliance that you specify in the CSAgent.ini file. This special appliance is called a configuration provider.
When a remote agent starts, it reads its CSAgent.ini file to determine which services should be available and which appliance is its configuration provider. Then it contacts the configuration provider and requests its configuration.
After receiving its configuration from the configuration provider, the remote agent is available to provide the services configured in CSAgent.ini. The main service, CSAgent, controls overall remote agent startup and service availability. See Figure 1-1. For more information about the CSAgent service, see CSAgent.
Figure 1-1 Configuration Provider and a Remote Agent
Logging Overview
The remote agent is particularly dependent on its configuration provider for logging configuration. The configuration provider determines the content of each log. You can configure remote agent logging on the Logging page of the System Configuration section of the configuration provider HTML interface. For more information, see User Guide for Cisco Secure ACS Solution Engine.
All ACS SE appliances that are configured to use the remote agent send logging data directly to the remote agent logging service, CSLogAgent. CSLogAgent writes the logging data to hard disk in the location specified by the configuration provider. The logs contain the columns specified by the configuration provider. See Figure 1-2. For more information about the CSLogAgent service, see CSLogAgent.
Figure 1-2 Multiple Appliances Logging to a Single Remote Agent
Authentication Overview
The Microsoft Windows authentication service, CSWinAgent, is available only in ACS Remote Agent for Windows. CSWinAgent processes several types of authentication-related requests from appliances. These include requests for user authentication, user lookup for EAP-TLS support, user group membership lookup, user dial-in permission lookup, and group enumeration (used for configuring group mapping on an appliance). All appliances configured to use the remote agent send Microsoft Windows authentication-related requests to CSWinAgent. See Figure 1-3.
Figure 1-3 Multiple Appliances Using Remote Agent for Windows Authentication
CSWinAgent acts as a middle-man, handling requests for multiple appliances. CSWinAgent passes requests to the operating system. The operating system returns the results of the requests to CSWinAgent. In turn, CSWinAgent passes the results of requests to the appliances originating the requests. See Figure 1-4. For more information about CSWinAgent, see CSWinAgent.
Figure 1-4 Windows Authentication Messaging
Remote Agent Services
This section describes the three separate services that make up ACS Remote Agent:
CSAgent
CSAgent is the main service. It controls the other services, CSLogAgent and, if you are using the Windows remote agent, CSWinAgent. When an appliance first contacts a remote agent, it queries CSAgent for its available services, as determined by the configuration of the CSAgent.ini file. If you use the Windows remote agent, it is the only service that is registered at installation as a Microsoft Windows service, named Cisco Secure ACS Agent.
This document provides information about the following aspects of the CSAgent service.
•
•
•
•
•
•
•
CSLogAgent
CSLogAgent is the logging service. CSAgent controls the logging service but receives logging data from appliances directly. When CSLogAgent starts, it requests its configuration from the configuration provider specified in the CSAgent.ini file. After it has received its configuration, it is ready to perform logging services. If CSLogAgent encounters problems receiving its configuration from the configuration provider, it restarts periodically until it succeeds in receiving its configuration.
This document provides information about the following aspects of the CSLogAgent service:
•
•
•
•
•
CSWinAgent
The CSWinAgent service is included only in the Windows remote agent. It is the service that supports Microsoft Windows authentication. It is controlled by CSAgent but it receives authentication requests from appliances directly on the ports on which it is configured to listen. It supports authentication of users and machines, user password changes, and retrieval of group memberships. CSWinAgent makes no decisions about user access. Instead, it passes the results of its Microsoft Windows queries to the appliance initiating the query.
CSWinAgent maintains an open pool of connections to provide better throughput during peaks in requests from appliances.
For PAP and EAP-GTC authentication requests, ACS SE converts the plaintext password to MS-CHAP credentials before sending the request to a remote agent. This conversion is extra security, because all communication between a remote agent and an appliance is 128-bit encrypted.
This document provides information about the following aspects of the CSWinAgent service.
•
•
•
•
Configuring ACS SE for a Remote Agent
You can configure how ACS SE uses a remote agent. On the appliance that is configured as a configuration provider, the logging configuration determines how the remote agent performs its logging service.
The User Guide for Cisco Secure ACS Solution Engine contains information about the following topics:
•
•
•
