-
User Guide for Cisco Secure Access Control Server 4.1
-
Preface
-
Overview
-
Using the Web Interface
-
Network Configuration
-
Shared Profile Components
-
User Group Management
-
User Management
-
System Configuration: Basic
-
System Configuration: Advanced
-
System Configuration: Authentication and Certificates
-
Logs and Reports
-
Administrators and Administrative Policy
-
User Databases
-
Posture Validation
-
Network Access Profiles
-
Unknown User Policy
-
User Group Mapping and Specification
-
Troubleshooting
-
TACACS+ Attribute-Value Pairs
-
RADIUS Attributes
-
CSUtil Database Utility
-
VPDN Processing
-
RDBMS Synchronization Import Definitions
-
Internal Architecture
-
Index
-
Feedback
Table Of Contents
System Configuration: Advanced
ACS Internal Database Replication
About ACS Internal Database Replication
Important Implementation Considerations
Database Replication Versus Database Backup
Replication Components Options
Implementing Primary and Secondary Replication Setups on ACSs
Disabling ACS Database Replication
Configuring Automatic Change Password Replication
Database Replication Event Errors
Custom RADIUS Vendors and VSAs
RDBMS Synchronization Components
About the accountActions Table (ACS for Windows)
About the accountActions File (ACS SE)
ACS Database Recovery Using the accountActions Table
Reports and Event (Error) Handling
Preparing to Use RDBMS Synchronization
Configuring a System Data Source Name for RDBMS Synchronization (ACS for Windows)
RDBMS Setup Options (ACS for Windows)
Synchronization Scheduling Options
Synchronization Partners Options
Performing RDBMS Synchronization Immediately
Scheduling RDBMS Synchronization
Disabling Scheduled RDBMS Synchronizations
RDBMS Synchronization Failure Codes
Allowing Overlapping IP Pools or Forcing Unique Pool Address Ranges
Refreshing the AAA Server IP Pools Table
Enabling IP Pool Address Recovery
NAC Attribute Management (ACS Solution Engine Only)
Posture Validation Attribute Definition File
Exporting (Dumping) Attributes
Default Posture Validation Attribute Definition File
System Configuration: Advanced
This chapter addresses the ACS internal database replication and RDBMS synchronization features in the System Configuration section of the Cisco Secure Access Control Server Release 4.1, hereafter referred to as ACS.
This chapter contains the following sections:
•
ACS Internal Database Replication
•
ACS Internal Database Replication
This section provides information about the ACS internal database replication feature, including procedures for implementing this feature and configuring the ACSs involved.
Note
This section contains the following topics:
•
•
•
–
•
•
•
•
About ACS Internal Database Replication
Database replication creates mirror systems of ACSs by duplicating parts of the primary ACS setup to one or more secondary ACSs. You can configure your AAA clients to use these secondary ACSs if the primary ACS fails or is unreachable. With a secondary ACS whose ACS internal database is a replica of the ACS internal database on the primary ACS, if the primary ACS goes out of service, incoming requests are authenticated without network downtime, provided that your AAA clients are configured to fail over to the secondary ACS.
You can use database replication to:
•
•
•
•
•
The following items cannot be replicated:
•
•
•
•
•
•
•
Tip
With regard to database replication, we make the following distinctions about ACSs:
•
•
An ACS can be a primary ACS and a secondary ACS, provided that it is not configured to be a secondary ACS to an ACS for which it performs as a primary ACS.
Note
Note
Replication Process
This topic describes the process of database replication, including the interaction between a primary ACS and each of its secondary ACSs. The following steps occur in database replication:
1.
Tip
2.
a.
Note
b.
c.
d.
3.
a.
b.
c.
4.
a.
b.
c.
ACS can act as a primary ACS and a secondary ACS. Figure 8-1 shows a cascading replication scenario. Server 1 acts only as a primary ACS, replicating to servers 2 and 3, which act as secondary ACSs. After replication from server 1 to server 2 has completed, server 2 acts as a primary ACS while replicating to servers 4 and 5. Similarly, server 3 acts as a primary ACS while replicating to servers 6 and 7.
Note
If server 2 were configured to replicate to server 1 in addition to receiving replication from server 1, replication to server 2 would fail. ACS cannot support such a configuration, known as bidirectional replication. To safeguard against this, a secondary ACS aborts replication when its primary ACS appears on its Replication list.
Figure 8-1 Cascading Database Replication
Replication Frequency
The frequency with which your ACSs replicate can have important implications for overall AAA performance. With shorter replication frequencies, a secondary ACS is more up to date with the primary ACS. This frequency produces a more current secondary ACS if the primary ACS fails.
Frequent replications incur a cost. The more frequent the replication, the higher the load on a multi-ACS architecture and your network environment. If you schedule frequent replications, network traffic is much higher. Also, processing load on the replicating systems is increased. Replication consumes system resources and briefly interrupts authentication; thus the more often replication occurs, the greater the impact on the AAA performance of the ACS. And because service is momentarily interrupted on both servers, NAS failovers can occur.
Note
This issue is more apparent with databases that are large or frequently change. Database replication is a nonincremental, destructive backup. In other words, it completely replaces the database and configuration on the secondary ACS every time it runs. Therefore, a large database results in substantial amounts of data being transferred, and the processing overhead can also be large.
Important Implementation Considerations
Several important points to consider when you implement the ACS Database Replication feature are:
•
•
–
Note
–
–
•
•
Tip
•
•
•
•
•
Database Replication Versus Database Backup
Do not confuse database replication with system backup. Database replication does not replace System Backup. While both features protect against partial or complete server loss, each feature addresses the issue in a different way:
•
•
Caution
Database Replication Logging
ACS logs all replication events—regardless of whether they are successful—in two files. The:
•
•
To view the Windows Event Log, use the Windows administration utilities. You can view recent reports in the Reports and Activity section of ACS.
For more information about ACS reports, see Chapter 1, "Overview."
Replication Options
The ACS web interface provides three sets of options for configuring ACS Database Replication.
This section contains the following topics:
•
Replication Components Options
You can specify the ACS internal database components that an ACS sends as a primary ACS and the components that it receives as a secondary ACS.
For increased security, you might want to have one ACS always be the sender and the other ACSs always be the receivers. You can use this method to ensure that all your ACSs are configured identically.
Note
Table 8-1 describes the Replication Components table on the ACS Database Replication page and describes the component options that are replicated.
Table 8-1 Replication Component Descriptions
User and group database
Groups and users. Excludes the use of the Group database only option.
Group database only
Groups, but not for users. Excludes the use of the User and group database option.
Network Configuration Device tables1
AAA Servers tables, the AAA Clients tables, in the Network Configuration section and Key Wrap keys as part of host configuration or Network Device Groups (NDG). This option also controls whether NDGs are replicated.
Distribution table
Proxy Distribution Table in the Network Configuration section.
Interface configuration
Advanced Options settings, RADIUS settings, and TACACS+ settings from the Interface Configuration section.
Interface security settings
Administrators and security information for the ACS web interface, password policy, including the password history and the parts of the global system configuration that configures the history.
Password validation settings
Password validation settings.
EAP-FAST master keys and policies
Active and retired master keys and policies for EAP-FAST.
Network Access Profiles2
A collaboration of configuration settings. These include: Network Access Profiles, Posture Validation settings, AAA clients and hosts, external user database configuration, global authentication configuration, NDGs, user-defined RADIUS dictionaries, shared profile components, logging configuration3 , GAME Group Feed back configuration, expanded agentless support configuration, databases for MAC Authentication Bypass, EAP-TLS for PEAP configuration, EAP-TLS configuration, and Key Wrap allowed configuration.
1 If you intend to use cascading replication to replicate network configuration device tables, you must configure the primary ACS with all ACSs that will receive replicated database components, regardless of whether they receive replication directly or indirectly from the primary ACS. For example, if the primary ACS replicates to two secondary ACSs that, in turn, each replicate to two more ACSs, the primary ACS must have AAA server configurations for all six ACSs that will receive replicated database components.
2 Replication of Network Access Profiles contradicts the replication of Network Configuration Device tables; therefore, do not check both of these components at the same time. NAP settings will override all other settings. Dynamically mapped users are not replicated, only statically added users are replicated.
3 When you replicate logging configurations between ACS for Windows and ACS SE, only the logger configurations that the receiving ACS supports are replicated. For example, ODBC logging configurations will not be replicated on an ACS SE.
Note
If mirroring the entire database might send confidential information to the secondary ACS, such as the Proxy Distribution Table, you can configure the primary ACS to send only a specific category of database information.
Outbound Replication Options
In the Outbound Replication table on the ACS Database Replication page, you can schedule outbound replication and specify the secondary ACSs for this primary ACS.
Table 8-2 Outbound Replication Options
Manually
ACS does not perform automatic database replication.
Automatically Triggered Cascade1
ACS performs database replication to the configured list of secondary ACSs when database replication from a primary ACS completes. You use this option to build a propagation hierarchy of ACS, relieving a primary ACS from the burden of propagating the replicated components to every other ACS. For an illustration of cascade replication, see Figure 8-1.
Every X minutes
ACS performs, on a set frequency, database replication to the configured list of secondary ACSs. The unit of measurement is minutes, with a default update frequency of 60 minutes.
At specific times
ACS performs, at the time that is specified in the day and hour graph, database replication to the configured list of secondary ACSs. The minimum interval is one hour, and the replication occurs on the hour selected.
You can specify the secondary ACSs for this primary ACS. The options that control the secondary ACSs to which a primary ACS replicates appear in the Partners section of the Outbound Replication table.
AAA Server
Represents the secondary ACSs that this primary ACS does not send replicated components to.
Replication
Represents the secondary ACSs that this primary ACS does send replicated components to.
Specifies the number of minutes that this primary ACS continues replicating to a secondary ACS. When the timeout value is exceeded, ACS terminates replication to the secondary ACS is was attempting to replicate to and then it restarts the CSAuth service. The replication timeout feature helps prevent loss of AAA services due to stalled replication communication, which can occur when the network connection between the primary and secondary ACS is abnormally slow or when a fault occurs within either ACS. The default value is five minutes.
1 If you intend to use cascading replication to replicate network configuration device tables, you must configure the primary ACS with all ACSs that will receive replicated database components, regardless of whether they receive replication directly or indirectly from the primary ACS. For example, if the primary ACS replicates to two secondary ACSs which, in turn, each replicate to two more ACSs, the primary ACS must have AAA server configurations for all six ACSs that will receive replicated database components.
The items in the AAA Server and Replication lists reflect the AAA servers configured in the AAA Servers table in Network Configuration. To make a particular ACS available as a secondary ACS, you must first add that ACS to the AAA Servers table of the primary ACS.
Tip
ACS does not support bidirectional database replication. A secondary ACS receiving replicated components verifies that the primary ACS is not on its Replication list. If not, the secondary ACS accepts the replicated components. If so, it rejects the components.
When replicating three nodes or more, the master should have all the AAA servers configured on network devices and the partners should also be configured. For example, if there is a cascade A-->B-->C, then in A, C should be configured in the AAA server column and B should be configured in the replication column. In B, A should be configured in the AAA server column and C in the replication column. In C, B should be configured in the AAA server column. Otherwise the cascade replication fails.
Inbound Replication Options
You can specify the primary ACSs from which a secondary ACS accepts replication. This option appears in the Inbound Replication table on the ACS Database Replication page.
The Accept replication from list controls which ACSs the current ACS does accept replicated components from. The list contains:
•
•
Note
For more information about the AAA Servers table in Network Configuration, see Configuring AAA Servers, page 3-14.
Implementing Primary and Secondary Replication Setups on ACSs
If you implement a replication scheme that uses cascading replication, the ACS configured to replicate only when it has received replicated components from another ACS acts as a primary ACS and as a secondary ACS. First, it acts as a secondary ACS while it receives replicated components, and then it acts as a primary ACS while it replicates components to other ACSs. For an illustration of cascade replication, see Figure 8-1.
To implement primary and secondary replication setups on ACSs:
Step 1
a.
For more information about adding entries to the AAA Servers table, see Configuring AAA Servers, page 3-14.
b.
Step 2
a.
Note
For more information about adding entries to the AAA Servers table, see Configuring AAA Servers, page 3-14.
b.
c.
Configuring a Secondary ACS
Note
The ACS Database Replication feature requires that you configure specific ACSs to act as secondary ACSs. The components that a secondary ACS is to receive must be explicitly specified, as must be its primary ACS.
Replication is always initiated by the primary ACS. For more information about sending replication components, see Replicating Immediately or Scheduling Replication.
Caution
Before You Begin
Ensure correct configuration of the AAA Servers table in the secondary ACS. This secondary ACS must have an entry in its AAA Servers table for each of its primary ACSs. Also, the AAA Servers table entry for each primary ACS must have the same shared secret that the primary ACS has for its own entry in its AAA Servers table. For more information about the AAA Servers table, see Configuring AAA Servers, page 3-14.
To configure an ACS to be a secondary ACS:
Step 1
Step 2
Step 3
The Database Replication Setup page appears.
Step 4
For more information about replication components, see Replication Components Options.
Step 5
Note
Step 6
The primary ACSs available in the Accept replication from list are determined by the AAA Servers table in the Network Configuration section. For more information about the AAA Servers table, see Configuring AAA Servers, page 3-14.
Note
Step 7
The Any Known ACS Server option is limited to the ACSs listed in the AAA Servers table in Network Configuration.
Note
Step 8
ACS saves the replication configuration, and at the frequency or times that you specified, ACS begins accepting the replicated components from the other ACSs you specified.
Replicating Immediately
You can manually start database replication.
Note
Before You Begin
Ensure correct configuration of the primary and secondary ACSs. For detailed steps, see Implementing Primary and Secondary Replication Setups on ACSs.
For each secondary ACS that this ACS is to send replicated components to, make sure that you have completed the steps in Configuring a Secondary ACS.
To initiate database replication immediately:
Step 1
Step 2
Step 3
Note
The Database Replication Setup page appears.
Step 4
Step 5
Tip
Note
Step 6
Step 7
ACS saves the replication configuration. ACS immediately begins sending replicated database components to the secondary ACSs you specified.
Note
Scheduling Replication
You can schedule when a primary ACS sends its replicated database components to a secondary ACS. For more information about replication scheduling options, see Outbound Replication Options.
Note
Before You Begin
Ensure correct configuration of the primary and secondary ACSs. For detailed steps, see Implementing Primary and Secondary Replication Setups on ACSs.
For each secondary ACS of this primary ACS, ensure that you have completed the steps in Configuring a Secondary ACS.
To schedule when a primary ACS replicates to its secondary ACSs:
Step 1
Step 2
Step 3
Note
The Database Replication Setup page appears.
Step 4
For more information about replicated database components, see Replication Components Options.
Step 5
Note
Step 6
a.
b.
Tip
Step 7
Note
Step 8
Note
a.
Note
b.
The selected secondary ACS moves to the Replication list.
c.
Step 9
Step 10
ACS saves the replication configuration that you created.
Disabling ACS Database Replication
You can disable scheduled ACS database replications without losing the schedule itself. This allows you to cease scheduled replications temporarily and later resume them without having to re-enter the schedule information.
To disable ACS database replication:
Step 1
Step 2
Step 3
The Database Replication Setup page appears.
Step 4
Step 5
Step 6
ACS does not permit any replication to or from this ACS server.
Configuring Automatic Change Password Replication
To configure automatic change password replication and other local password management options:
Step 1
Step 2
Step 3
Step 4
Step 5
Database Replication Event Errors
The Database Replication report contains messages indicating errors that occur during replication. For more information about the Database Replication report, see ACS Audit Logs, page 10-5.
Tip
RDBMS Synchronization
This section provides information about the RDBMS Synchronization feature, including procedures for implementing this feature, within ACS and the external data source involved.
This section contains the following topics:
•
•
•
•
•
•
•
•
•
•
About RDBMS Synchronization
ACS for Windows
The RDBMS Synchronization feature enables you to update the ACS internal database with information from an ODBC-compliant data source. The ODBC-compliant data source can be the RDBMS database of a third-party application. It can also be an intermediate file or database that a third-party system updates. Regardless of where the file or database resides, ACS reads the file or database via the ODBC connection.
ACS SE
The RDBMS Synchronization feature provides the ability to update the ACS internal database with information from a text file on an FTP server. A third-party application can generate the test file. ACS gets the file from the FTP server, reads the file, and performs the configuration actions specified in the file.
You can also regard RDBMS Synchronization as an API—much of what you can configure for a user, group, or device through the ACS web interface, you can alternatively maintain through this feature. RDBMS Synchronization supports addition, modification, and deletion for all data items it can access.
You can configure synchronization to occur on a regular schedule. You can also perform synchronizations manually, updating the ACS internal database on demand.
Synchronization performed by a single ACS can update the internal databases of other ACSs, so that you only need configure RDBMS Synchronization on one ACS. ACSs listen on TCP port 2000 for synchronization data. RDBMS Synchronization communication between ACSs is encrypted using 128-bit encrypted, proprietary algorithm.
You specify the actions in a relational database table (ACS for Windows only) or text file, named accountActions. For more information about the accountActions table, see About the accountActions Table (ACS for Windows). For more information about the accountActions file, see About the accountActions File (ACS SE). For specific information about all actions that RDBMS Synchronization can perform, see Appendix F, "RDBMS Synchronization Import Definitions."
These topics provide an overview of the kinds of configuration that RDBMS Synchronization can automate:
•
Users
Among the user-related configuration actions that RDBMS Synchronization can perform are:
•
•
•
•
•
•
•
•
•
•
•
•
Note
User Groups
Among the group-related configuration actions that RDBMS Synchronization can perform are:
•
•
•
•
•
•
•
Note
Network Configuration
Among the network device-related configuration actions that RDBMS Synchronization can perform are:
•
•
•
•
•
•
•
Note
Custom RADIUS Vendors and VSAs
RDBMS Synchronization enables you to configure custom RADIUS vendors and VSAs. In addition to supporting a set of predefined RADIUS vendors and vendor-specific attributes (VSAs), ACS supports RADIUS vendors and VSAs that you define. Vendors you add must be IETF-compliant; therefore, all VSAs that you add must be sub-attributes of IETF RADIUS attribute number 26.
You can define up to ten custom RADIUS vendors. ACS allows only one instance of any given vendor, as defined by the unique vendor IETF ID number and by the vendor name.
Note
For specific information about all actions that RDBMS Synchronization can perform, see Appendix F, "RDBMS Synchronization Import Definitions."
RDBMS Synchronization Components
The RDBMS Synchronization feature comprises:
•
•
•
These topics describe RDBMS synchronization components:
•
•
About CSDBSync
ACS for Windows
The CSDBSync service uses an ODBC system data source name (DSN) to access the accountActions table. See Figure 8-2. This service looks specifically for a table named accountActions. Synchronization events fail if CSDBSync cannot access the accountActions table.
Figure 8-2 RDBMS Synchronization
CSDBSync reads each record from the accountActions table and updates the ACS internal database as specified by the action code in the record. For example, a record could instruct CSDBSync to add a user or change a user password. In a distributed environment, a single ACS, known as the senior synchronization partner, accesses the accountActions table and sends synchronization commands to its synchronization partners. In Figure 8-2, Access Control Server 1 is the senior synchronization partner and the other two ACSs are its synchronization partners.
CSDBSync reads and writes (deletes records) in the accountActions table. After CSDBSync processes each record, it deletes the record from the table. To perform this action, the database user account that you configure the system DSN to use must have read and write privileges.
ACS SE
The CSDBSync service reads the accountActions file. While accountActions.csv is the default name for the accountActions file, you can name the file however you like. Synchronization events fail if CSDBSync cannot access the accountActions file.
CSDBSync reads each record from the accountActions file and updates the ACS internal database as specified by the action code in the record. For example, a record could instruct CSDBSync to add a user or change a user password. In a distributed environment, a single ACS, known as the senior synchronization partner, accesses the accountActions table and sends synchronization commands to its synchronization partners.
Note
For more information about CSDBSync or other Windows services used by ACS, see Chapter 1, "Overview."
About the accountActions Table (ACS for Windows)
The accountActions table contains a set of rows that define actions CSDBSync is to perform in the ACS internal database. Each row in the accountActions table holds user, user group, or AAA client information. Each row also contains an action field and several other fields. These fields provide CSDBSync with the information it needs to update the ACS internal database. For full details of the accountActions table format and available actions, see Appendix F, "RDBMS Synchronization Import Definitions."
The database containing the accountActions table must support a multi-user ODBC driver. This is required to prevent problems if ACS and the third-party system attempt to access the accountActions table simultaneously.
ACS includes files to help you create your accountActions table for several common formats. You can find these files on the ACS in the following location, assuming a default installation of ACS:
C:\Program Files\CiscoSecure ACS vx.x\CSDBSync\Databases
The Databases directory contains the following subdirectories:
•
The
CiscoSecure Transactions.mdbdatabase contains a preconfigured accountActions table. When you install ACS, the installation routine creates a system DSN named CiscoSecure DBSync. This system DSN is configured to communicate with CiscoSecure Transactions.mdb.
Note
•
The accountactions file is the accountActions table in a comma-separated value file. The schema.ini file provides the Microsoft ODBC text file driver with the information it needs to access the accountactions file.
•
The accountActions.sql file contains the Oracle 7 SQL procedure needed to generate an accountActions table. The testData.sql file contains Oracle 7 SQL procedures for updating the accountActions table with sample transactions that CSDBSync can process.
•
The accountActions.sql file contains the Oracle 8 SQL procedure needed to generate an accountActions table. The testData.sql file contains Oracle 8 SQL procedures for updating the accountActions table with sample transactions that CSDBSync can process.
•
The accountActions.sql file contains the Microsoft SQL Server 6.5 SQL procedure needed to generate an accountActions table. The testData.sql file contains Microsoft SQL Server 6.5 SQL procedures for updating the accountActions table with sample transactions that CSDBSync can process.
About the accountActions File (ACS SE)
The accountActions file contains a set of rows that define actions CSDBSync is to perform in the ACS internal database. Each row in the accountActions file holds user, user group, or AAA client information. Except for the first row (which is used for field headers and thus is ignored during synchronization), each row also contains an action field and several other fields. These fields provide CSDBSync with the information it needs to update the ACS internal database.
For full details of the accountActions file format and available actions, see Appendix F, "RDBMS Synchronization Import Definitions."
ACS Database Recovery Using the accountActions Table
The RDBMS Synchronization feature, in effect, produces a transaction queue:
•
•
The RDBMS Synchronization feature does not maintain a transaction log, or audit, trail. If a log is required, the external system that adds records to the accountActions table must create it. Unless the external system can recreate the entire transaction history in the accountActions table, we recommend that you construct a transaction log file for recovery purposes.
To do this:
•
•
If the database is large, it is not practical to replay all transaction logs to synchronize the ACS internal database with the third-party system. Instead, you should create regular backups of the ACS internal database and replay the transaction logs from the time of most recent backup to resynchronize the ACS internal database with the third-party system. For information on creating backup files, see Appendix F, "RDBMS Synchronization Import Definitions."
Replaying transaction logs that slightly predate the checkpoint does not damage the ACS internal database, although some transactions might be invalid and reported as errors. As long as the entire transaction log is replayed, the ACS internal database is consistent with the database of the external RDBMS application.
Reports and Event (Error) Handling
The CSDBSync service provides event and error logging. For more information about the RDBMS Synchronization log, see ACS Audit Logs, page 10-5. For more information about the CSDBSync service log, see Service Logs, page 10-12.
During manual synchronizations, ACS provides visual alerts to notify you of problems that occurred during synchronization.
Preparing to Use RDBMS Synchronization
Synchronizing the ACS internal database by using data from the accountActions table requires that you complete several steps that are external to ACS before you configure the RDBMS Synchronization feature within ACS. If you are planning to use a CSV file as your accountActions table, also see Configuring a System Data Source Name for RDBMS Synchronization (ACS for Windows).
Note
To prepare to use RDBMS Synchronization:
Step 1
•
•
•
For details on the format and content of the accountActions table, see Appendix F, "RDBMS Synchronization Import Definitions."
Step 2
Step 3
Step 4
Step 5
Note
Step 6
a.
b.
c.
Synchronization between the senior synchronization partner and the other synchronization partners is enabled.
Step 7
Step 8
Step 9
(ACS SE) If needed, activate the mechanism that is to copy the accountActions file to the applicable directory on the FTP server.
Step 10
Also, monitor the CSDBSync service log. For more information about the CSDBSync service log, see Service Logs, page 10-12.
Configuring a System Data Source Name for RDBMS Synchronization (ACS for Windows)
On the ACS, a system DSN must exist for ACS to access the accountActions table. If you plan to use the CiscoSecure Transactions.mdb Microsoft Access database that is provided with ACS, you can use the CiscoSecure DBSync system DSN, rather than create one.
Tip
For more information about the CiscoSecure Transactions.mdb file, see Preparing to Use RDBMS Synchronization.
To create a system DSN for use with RDBMS synchronization:
Step 1
Tip
Step 2
Step 3
Step 4
A dialog box displays fields requiring information that is specific to the selected ODBC driver.
Step 5
Step 6
Step 7
The name that you assigned to the DSN appears in the System Data Sources list.
Step 8
On your ACS, you create the system that ACS uses to access your accountActions table.
RDBMS Synchronization Options
The RDBMS Synchronization Setup page, which is available from System Configuration, provides control of the RDBMS Synchronization feature. It contains three tables whose options are described in this section.
This section contains the following topics:
•
•
•
RDBMS Setup Options (ACS for Windows)
The RDBMS Setup table defines how ACS accesses the accountActions table. It contains:
•
•
Note
•
FTP Setup Options (ACS SE)
The FTP Setup For Account Actions Download table defines how ACS accesses the accountActions table. It contains:
•
•
•
•
•
Synchronization Scheduling Options
The Synchronization Scheduling table defines when synchronization occurs. It contains:
•
•
•
Synchronization Partners Options
The Synchronization Partners table defines which ACSs are synchronized with data from the accountActions table. It provides:
•
•
Note
For more information about the AAA Servers table in Network Configuration, see Configuring AAA Servers, page 3-14.
Performing RDBMS Synchronization Immediately
You can manually start an RDBMS synchronization event.
To perform manual RDBMS synchronization:
Step 1
Step 2
The RDBMS Synchronization Setup page appears.
Note
Step 3
a.
For more information about configuring a system DSN for use with RDBMS Synchronization, see Configuring a System Data Source Name for RDBMS Synchronization (ACS for Windows).
b.
c.
Note
ACS has the information with which to access the accountActions table.
Note
Step 4
a.
b.
c.
d.
e.
Note
ACS has the information necessary to get the accountActions file from the FTP server.
Note
Step 5
The selected ACS appears in the Synchronize list.
Step 6
The selected ACS appears in the Synchronize list.
Step 7
ACS immediately begins a synchronization event. To check the status of the synchronization, view the RDBMS Synchronization report in Reports and Activity.
Scheduling RDBMS Synchronization
You can schedule when ACS performs RDBMS synchronization.
To schedule when ACS performs RDBMS synchronization:
Step 1
Step 2
The RDBMS Synchronization Setup page appears.
Note
Step 3
a.
For more information about configuring a system DSN for use with RDBMS Synchronization, see Configuring a System Data Source Name for RDBMS Synchronization (ACS for Windows).
b.
c.
Note
Step 4
a.
b.
c.
d.
e.
Note
ACS has the information necessary to get the accountActions file from the FTP server.
Step 5
Step 6
a.
b.
Tip
Step 7
Note
a.
Note
b.
The selected ACS moves to the Synchronize list.
Note
Step 8
ACS saves the RDBMS synchronization schedule that you created.
Disabling Scheduled RDBMS Synchronizations
You can disable scheduled RDBMS synchronization events without losing the schedule itself. You can use this ability to end scheduled synchronizations and resume them later without having to recreate the schedule.
To disable scheduled RDBMS synchronizations:
Step 1
Step 2
The RDBMS Synchronization Setup page appears.
Step 3
Step 4
ACS does not perform scheduled RDBMS synchronizations.
RDBMS Synchronization Failure Codes
Fatal as well as nonfatal RDBMS synchronization errors can occur during a single transaction. When a nonfatal error message is written to the RDBMS synchronization audit log, and processing continues as if it is a successful transaction, the record is deleted from the action table. When a fatal error message is written to the RDBMS synchronization audit log, synchronization stops.
Although the expected behavior for ACS is to send the error code 2 to the database, ACS RDBMS synchronization does not send the error code 2, nor does it delete the database records if a failure occurs.
You can add new devices and NDGs when performing RDBMS synchronization from the database to ACS. The new devices are appended to the end.
If the device already exists in ACS, ACS reports an error in the log Failed to create new NAS/AAA record- Host database failure, Host already exists. Although the expected behavior for ACS is to delete the database records if a failure occurs, ACS remove the entries from the database and does not send an error code to the database.
Table 8-3 lists RDBMS Synchronization fatal errors:
IP Pools Server
This section provides information about the IP Pools feature, including procedures for creating and maintaining IP pools.
This section contains the following topics:
•
•
•
About IP Pools Server
If you are using VPNs you may have to overlap IP address assignments; that is, it may be advantageous for a PPTP tunnel client within a given tunnel to use the same IP address that another PPTP tunnel client in a different tunnel is using. You can use the IP Pools Server feature to assign the same IP address to multiple users, provided that the users are being tunnelled to different home gateways for routing beyond the boundaries of your own network. You can, therefore, conserve your IP address space without having to resort to using illegal addresses. When you enable this feature, ACS dynamically issues IP addresses from the IP pools that you have defined by number or name. You can configure up to 999 IP pools, for approximately 255,000 users.
If you are using IP pooling and proxy, all accounting packets are proxied so that the ACS that is assigning the IP addresses can confirm whether an IP address is already in use.
Note
To use IP pools, the AAA client must have network authorization (in IOS, aaa authorization network) and accounting (in IOS, aaa accounting) enabled.
Note
For information on assigning a group or user to an IP pool, see Setting IP Address Assignment Method for a User Group, page 5-20 or Assigning a User to a Client IP Address, page 6-7.
Allowing Overlapping IP Pools or Forcing Unique Pool Address Ranges
ACS provides automated detection of overlapping pools.
Note
You can determine whether overlapping IP pools are allowed by checking which button appears below the AAA Server IP Pools table:
•
•
To allow overlapping IP pools or to force unique pool address ranges:
Step 1
Step 2
Note
The AAA Server IP Pools table lists any IP pools you have configured, their address ranges, and the percentage of pooled addresses in use.
Step 3
a.
ACS allows overlapping IP pool address ranges.
b.
ACS already allows overlapping IP pool address ranges.
Step 4
a.
ACS already does not permit overlapping IP pool address ranges.
b.
ACS does not permit overlapping IP pool address ranges.
Refreshing the AAA Server IP Pools Table
You can refresh the AAA Server IP Pools table to get the latest usage statistics for your IP pools.
To refresh the AAA Server IP Pools table:
Step 1
Step 2
The AAA Server IP Pools table lists any IP pools that you have configured, their address ranges, and the percentage of pooled addresses in use.
Step 3
ACS updates the percentages of pooled addresses in use.
Adding a New IP Pool
You can define up to 999 IP address pools.
To add an IP pool:
Step 1
Step 2
The AAA Server IP Pools table lists any IP pools that you have already configured, their address ranges, and the percentage of pooled addresses in use.
Step 3
The New Pool table appears.
Step 4
Step 5
Note
Step 6
Step 7
The new IP pool appears in the AAA Server IP Pools table.
Editing an IP Pool Definition
To edit an IP pool definition:
Step 1
Step 2
The AAA Server IP Pools table lists any IP pools that you have configured, their address ranges, and the percentage of pooled addresses in use.
Step 3
The name pool table appears, where name is the name of the IP pool that you selected. The In Use field displays how many IP addresses in this pool are allocated to a user. The Available field displays how many IP addresses are unallocated to users.
Step 4
Step 5
Note
Step 6
Step 7
The edited IP pool appears in the AAA Server IP Pools table.
Resetting an IP Pool
The Reset function recovers IP addresses within an IP pool when there are dangling connections. A dangling connection occurs when a user disconnects and ACS does not receive an accounting stop packet from the applicable AAA client. If the Failed Attempts log in Reports and Activity shows a large number of
Failed to Allocate IP Address For Usermessages, consider using the Reset function to reclaim all allocated addresses in this IP pool.
Note
To reset an IP pool and reclaim all its IP addresses:
Step 1
Step 2
The AAA Server IP Pools table lists any IP pools that you have configured, their address ranges, and the percentage of pooled addresses in use.
Step 3
The name pool table appears, where name is the name of the IP pool you selected. The In Use field displays how many IP addresses in this pool are assigned to a user. The Available field displays how many IP addresses are not assigned to users.
Step 4
ACS displays a dialog box indicating the possibility of assigning user addresses that are already in use.
Step 5
The IP pool is reset. All its IP addresses are reclaimed. In the In Use column of the AAA Server IP Pools table, zero percent of the IP pool addresses are assigned to users.
Deleting an IP Pool
Note
To delete an IP pool:
Step 1
Step 2
The AAA Server IP Pools table lists any IP pools that you have configured, their address ranges, and the percentage of pooled addresses in use.
Step 3
The name pool table appears, where name is the name of the IP pool you selected. The In Use column displays how many IP addresses in this pool are assigned to a user. The Available column displays how many IP addresses are not assigned to users.
Step 4
ACS displays a dialog box to confirm that you want to delete the IP pool.
Step 5
The IP pool is deleted. The AAA Server IP Pools table does not list the deleted IP pool.
IP Pools Address Recovery
You use the IP Pools Address Recovery feature to recover assigned IP addresses that have not been used for a specified period of time. You must configure an accounting network on the AAA client for ACS to reclaim the IP addresses correctly.
Enabling IP Pool Address Recovery
To enable IP pool address recovery:
Step 1
Step 2
Note
The IP Address Recovery page appears.
Step 3
Step 4
ACS implements the IP pools address recovery settings that you made.
NAC Attribute Management (ACS Solution Engine Only)
You can use the CNAC Attributes Management page to add, delete, or export NAC attributes, which are used with posture validation requests. For more information about posture validation attributes, see About Posture Credentials and Attributes, page 13-5.
This section contains the following topics:
•
•
•
Posture Validation Attribute Definition File
A posture validation attribute definition file is a text file that contains one or more posture validation attribute definitions. Each definition consists of a definition header and several values, as shown in Example 8-1. For an example of the contents of a posture validation attribute definition file, see Default Posture Validation Attribute Definition File.
With the exception of the attribute definition header, each attribute definition value must be formatted as:
name=valuewhere name is the value name and value is a string or integer, as specified in the following list.
Tip
Example 8-1 shows an example of a posture validation attribute definition, including a comment after the attribute definition:
Example 8-1 Example Attribute Definition
[attr#0] vendor-id=9 vendor-name=Cisco application-id=1 application-name=PA attribute-id=00001 attribute-name=Application-Posture-Token attribute-profile=out attribute-type=unsigned integer ; attribute 1 is reserved for the APTA posture validation attribute is uniquely defined by the combination of its
vendor-id,application-id, andattribute-id. The following list provides details of these values and of each line required in an attribute definition:•
[attr#0], the second attribute definition in a file must have the header[attr#1], and so on. A break in the numbering causes ACS to ignore attribute definitions at the break and beyond. For example, if in a file with 10 attribute definitions the fifth attribute is defined as[attr#5]instead of[attr#4], ACS ignores the attribute defined as[attr#5]and the remaining five the attributes following it.
Tip
-idvalues in the attribute definition file. For example, the 28th definition in a file must have the header[attr#27], but this definition does not limit or otherwise define valid values forvendor-id,application-id, andattribute-id. In addition, it does not limit or define the number of posture validation attributes supported by ACS.•
vendor-id9corresponds to Cisco Systems, Inc.Each
vendor-idhas one or more associated applications, identified by theapplication-idvalue.•
vendor-idof 9 could have the vendor name Cisco.
Note
vendor-id. For example, you cannot add an attribute with avendor-idof 9 if the vendor name is not Cisco.•
application-idthat uniquely identifies the vendor application associated with the posture validation attribute. For example, if thevendor-idis 9 and theapplication-idis 1, the posture validation attribute is associated with the Cisco application with an ID of 1, which is the Cisco Trust Agent, also known as a posture agent (PA).•
vendor-idis 9 and theapplication-idis 1, the application-name would be PA, an abbreviation of posture agent, which is another term for the Cisco Trust Agent.
Note
vendor-idandapplication-idpair. For example, you cannot add an attribute with avendor-idof 9 andapplication-idof 1 if the application-name is not PA.•
attribute-iduniquely identifies the posture validation attribute for the specifiedvendor-idandapplication-id.
Note
•
vendor-idis 9, theapplication-idis 1, and theattribute-idis 1, the attribute-name is Application-Posture-Token.•
–
–
–
•
Valid data types for attribute-type are:
–
–
–
–
–
–
–
–
For more information about attribute data types, see Posture Validation Attribute Data Types, page 13-6.
Adding Attributes
You can use the Add Attribute option to add or modify the posture validation attributes that ACS supports. Adding attributes requires that you have prepared an attribute definition file, which is a text file that provides the required information for each attribute to be added. For an explanation of the contents of a posture validation attribute definition file, see Posture Validation Attribute Definition File. For an example of an attribute definition file, see Default Posture Validation Attribute Definition File.
Before You Begin
You can use the steps in Exporting (Dumping) Attributes, to create a backup of posture validation attribute definitions. You can also use the exported attribute definition file to check the
vendor-id,application-id, andattribute-idof current posture validation attributes.
Note
To add attributes:
Step 1
Step 2
Step 3
Step 4
The CNAC Attribute Management page appears. Under Add Attributes, the FTP Server, Login, Password, and Remote Directory options contain the values from the most recent session on this page.
Step 5
Step 6
a.
Tip
b.
c.
d.
e.
Step 7
ACS downloads the attribute definition file and updates its attribute definitions according to the information that you provided in the file. The System Configuration page appears.
Tip
Step 8
•
•
Deleting Attributes
You can delete one posture validation attribute at a time from ACS. Posture validation attributes are uniquely identified by the combination of the
vendor-id,application-id, andattribute-id. You can determine this information for any attribute by reading the attribute definition file created by the Dump Attributes option.Before You Begin
You can use the steps in Exporting (Dumping) Attributes to create a backup of posture validation attribute definitions. You can also use the exported attribute definition file to check the
vendor-id,application-id, andattribute-idof the posture validation attribute that you want to delete.
Caution
For more information about posture validation attributes and how they are identified, see About Posture Credentials and Attributes, page 13-5. For more information about extended attributes, see Extended Attributes, page 13-6.
Note
To delete posture validation attributes:
Step 1
Step 2
The CNAC Attribute Management page appears.
Step 3
Step 4
a.
b.
c.
The attribute that you want to delete is uniquely identified.
Step 5
ACS deletes the definition for the attribute that you specified.
Step 6
•
•
To delete an extended posture validation entity attribute in the Cisco:Host application:
Step 1
Step 2
The CNAC Attribute Management page appears.
Step 3
Step 4
a.
b.
The attribute that you want to delete is uniquely identified.
Step 5
ACS deletes its definition for the attribute that you specified.
Step 6
•
•
To delete a property of an extended posture validation entity attribute in the Cisco:Host application:
Step 1
Step 2
The CNAC Attribute Management page appears.
Step 3
Step 4
a.
b.
The extended attribute property that you want to delete is uniquely identified.
Step 5
ACS deletes the property definition for the attribute that you specified.
Step 6
•
•
Exporting (Dumping) Attributes
You can use the Dump Attributes option to download an attribute definition file that contains definitions for all the current attribute definitions that ACS has. This file contains attributes, such as their data type, and their vendor, application, and attribute IDs. The file also is useful for creating a backup of attribute definitions before you add, modify, or delete attributes.
To export a file of definitions for all NAC attributes:
Step 1
Step 2
The CNAC Attribute Management page appears.
Step 3
Step 4
A file generation status message appears.
Step 5
Step 6
A dialog box prompts you for a location to save a file named
AvpDump.txt. AVP is the abbreviation for attribute-value pair.Step 7
Tip
acs01primary and the date is June 13, 2004, saving the file as avp-acs01primary-06132004.txt readily identifies the origin of the file.Step 8
ACS continues to display the status message.
Tip
Default Posture Validation Attribute Definition File
Example 8-2 provides the default definitions for the posture validation attributes that ACS provides. If you need to reset the default attributes to their original definitions, use Example 8-2 to create a posture validation attribute definition file. For more information about the format of an attribute definition file, see Posture Validation Attribute Definition File.
Example 8-2 Default Posture Validation Attribute Definitions
[attr#0] vendor-id=9 vendor-name=Cisco application-id=1 application-name=PA attribute-id=00001 attribute-name=Application-Posture-Token attribute-profile=out attribute-type=unsigned integer [attr#1] vendor-id=9 vendor-name=Cisco application-id=1 application-name=PA attribute-id=00002 attribute-name=System-Posture-Token attribute-profile=out attribute-type=unsigned integer [attr#2] vendor-id=9 vendor-name=Cisco application-id=1 application-name=PA attribute-id=00003 attribute-name=PA-Name attribute-profile=in out attribute-type=string [attr#3] vendor-id=9 vendor-name=Cisco application-id=1 application-name=PA attribute-id=00004 attribute-name=PA-Version attribute-profile=in out attribute-type=version [attr#4] vendor-id=9 vendor-name=Cisco application-id=1 application-name=PA attribute-id=00005 attribute-name=OS-Type attribute-profile=in out attribute-type=string [attr#5] vendor-id=9 vendor-name=Cisco application-id=1 application-name=PA attribute-id=00006 attribute-name=OS-Version attribute-profile=in out attribute-type=version [attr#6] vendor-id=9 vendor-name=Cisco application-id=1 application-name=PA attribute-id=00007 attribute-name=PA-User-Notification attribute-profile=out attribute-type=string [attr#7] vendor-id=9 vendor-name=Cisco application-id=2 application-name=Host attribute-id=00001 attribute-name=Application-Posture-Token attribute-profile=out attribute-type=unsigned integer [attr#8] vendor-id=9 vendor-name=Cisco application-id=2 application-name=Host attribute-id=00002 attribute-name=System-Posture-Token attribute-profile=out attribute-type=unsigned integer [attr#9] vendor-id=9 vendor-name=Cisco application-id=2 application-name=Host attribute-id=00006 attribute-name=ServicePacks attribute-profile=in attribute-type=string [attr#10] vendor-id=9 vendor-name=Cisco application-id=2 application-name=Host attribute-id=00007 attribute-name=HotFixes attribute-profile=in attribute-type=string [attr#11] vendor-id=9 vendor-name=Cisco application-id=2 application-name=Host attribute-id=00008 attribute-name=HostFQDN attribute-profile=in attribute-type=string [attr#12] vendor-id=9 vendor-name=Cisco application-id=5 application-name=HIP attribute-id=00001 attribute-name=Application-Posture-Token attribute-profile=out attribute-type=unsigned integer [attr#13] vendor-id=9 vendor-name=Cisco application-id=5 application-name=HIP attribute-id=00002 attribute-name=System-Posture-Token attribute-profile=out attribute-type=unsigned integer [attr#14] vendor-id=9 vendor-name=Cisco application-id=5 application-name=HIP attribute-id=00005 attribute-name=CSAVersion attribute-profile=in attribute-type=version [attr#15] vendor-id=9 vendor-name=Cisco application-id=5 application-name=HIP attribute-id=00009 attribute-name=CSAOperationalState attribute-profile=in attribute-type=unsigned integer [attr#16] vendor-id=9 vendor-name=Cisco application-id=5 application-name=HIP attribute-id=00011 attribute-name=TimeSinceLastSuccessfulPoll attribute-profile=in attribute-type=unsigned integer [attr#17] vendor-id=9 vendor-name=Cisco application-id=5 application-name=HIP attribute-id=32768 attribute-name=CSAMCName attribute-profile=in attribute-type=string [attr#18] vendor-id=9 vendor-name=Cisco application-id=5 application-name=HIP attribute-id=32769 attribute-name=CSAStates attribute-profile=in attribute-type=string [attr#19] vendor-id=393 vendor-name=Symantec application-id=3 application-name=AV attribute-id=00001 attribute-name=Application-Posture-Token attribute-profile=out attribute-type=unsigned integer [attr#20] vendor-id=393 vendor-name=Symantec application-id=3 application-name=AV attribute-id=00002 attribute-name=System-Posture-Token attribute-profile=out attribute-type=unsigned integer [attr#21] vendor-id=393 vendor-name=Symantec application-id=3 application-name=AV attribute-id=00003 attribute-name=Software-Name attribute-profile=in out attribute-type=string [attr#22] vendor-id=393 vendor-name=Symantec application-id=3 application-name=AV attribute-id=00004 attribute-name=Software-ID attribute-profile=in out attribute-type=unsigned integer [attr#23] vendor-id=393 vendor-name=Symantec application-id=3 application-name=AV attribute-id=00005 attribute-name=Software-Version attribute-profile=in out attribute-type=version [attr#24] vendor-id=393 vendor-name=Symantec application-id=3 application-name=AV attribute-id=00006 attribute-name=Scan-Engine-Version attribute-profile=in out attribute-type=version [attr#25] vendor-id=393 vendor-name=Symantec application-id=3 application-name=AV attribute-id=00007 attribute-name=Dat-Version attribute-profile=in out attribute-type=version [attr#26] vendor-id=393 vendor-name=Symantec application-id=3 application-name=AV attribute-id=00008 attribute-name=Dat-Date attribute-profile=in out attribute-type=date [attr#27] vendor-id=393 vendor-name=Symantec application-id=3 application-name=AV attribute-id=00009 attribute-name=Protection-Enabled attribute-profile=in out attribute-type=unsigned integer [attr#28] vendor-id=393 vendor-name=Symantec application-id=3 application-name=AV attribute-id=00010 attribute-name=Action attribute-profile=out attribute-type=string [attr#29] vendor-id=3401 vendor-name=NAI application-id=3 application-name=AV attribute-id=00001 attribute-name=Application-Posture-Token attribute-profile=out attribute-type=unsigned integer [attr#30] vendor-id=3401 vendor-name=NAI application-id=3 application-name=AV attribute-id=00002 attribute-name=System-Posture-Token attribute-profile=out attribute-type=unsigned integer [attr#31] vendor-id=3401 vendor-name=NAI application-id=3 application-name=AV attribute-id=00003 attribute-name=Software-Name attribute-profile=in out attribute-type=string [attr#32] vendor-id=3401 vendor-name=NAI application-id=3 application-name=AV attribute-id=00004 attribute-name=Software-ID attribute-profile=in out attribute-type=unsigned integer [attr#33] vendor-id=3401 vendor-name=NAI application-id=3 application-name=AV attribute-id=00005 attribute-name=Software-Version attribute-profile=in out attribute-type=version [attr#34] vendor-id=3401 vendor-name=NAI application-id=3 application-name=AV attribute-id=00006 attribute-name=Scan-Engine-Version attribute-profile=in out attribute-type=version [attr#35] vendor-id=3401 vendor-name=NAI application-id=3 application-name=AV attribute-id=00007 attribute-name=Dat-Version attribute-profile=in out attribute-type=version [attr#36] vendor-id=3401 vendor-name=NAI application-id=3 application-name=AV attribute-id=00008 attribute-name=Dat-Date attribute-profile=in out attribute-type=date [attr#37] vendor-id=3401 vendor-name=NAI application-id=3 application-name=AV attribute-id=00009 attribute-name=Protection-Enabled attribute-profile=in out attribute-type=unsigned integer [attr#38] vendor-id=3401 vendor-name=NAI application-id=3 application-name=AV attribute-id=00010 attribute-name=Action attribute-profile=out attribute-type=string [attr#39] vendor-id=6101 vendor-name=Trend application-id=3 application-name=AV attribute-id=00001 attribute-name=Application-Posture-Token attribute-profile=out attribute-type=unsigned integer [attr#40] vendor-id=6101 vendor-name=Trend application-id=3 application-name=AV attribute-id=00002 attribute-name=System-Posture-Token attribute-profile=out attribute-type=unsigned integer [attr#41] vendor-id=6101 vendor-name=Trend application-id=3 application-name=AV attribute-id=00003 attribute-name=Software-Name attribute-profile=in out attribute-type=string [attr#42] vendor-id=6101 vendor-name=Trend application-id=3 application-name=AV attribute-id=00004 attribute-name=Software-ID attribute-profile=in out attribute-type=unsigned integer [attr#43] vendor-id=6101 vendor-name=Trend application-id=3 application-name=AV attribute-id=00005 attribute-name=Software-Version attribute-profile=in out attribute-type=version [attr#44] vendor-id=6101 vendor-name=Trend application-id=3 application-name=AV attribute-id=00006 attribute-name=Scan-Engine-Version attribute-profile=in out attribute-type=version [attr#45] vendor-id=6101 vendor-name=Trend application-id=3 application-name=AV attribute-id=00007 attribute-name=Dat-Version attribute-profile=in out attribute-type=version [attr#46] vendor-id=6101 vendor-name=Trend application-id=3 application-name=AV attribute-id=00008 attribute-name=Dat-Date attribute-profile=in out attribute-type=date [attr#47] vendor-id=6101 vendor-name=Trend application-id=3 application-name=AV attribute-id=00009 attribute-name=Protection-Enabled attribute-profile=in out attribute-type=unsigned integer [attr#48] vendor-id=6101 vendor-name=Trend application-id=3 application-name=AV attribute-id=00010 attribute-name=Action attribute-profile=out attribute-type=string [attr#49] vendor-id=10000 vendor-name=out application-id=1 application-name=CNAC attribute-id=00001 attribute-name=Application-Posture-Token attribute-profile=out attribute-type=string [attr#50] vendor-id=10000 vendor-name=out application-id=1 application-name=CNAC attribute-id=00002 attribute-name=System-Posture-Token attribute-profile=out attribute-type=string [attr#51] vendor-id=10000 vendor-name=out application-id=1 application-name=CNAC attribute-id=00003 attribute-name=Reason attribute-profile=out attribute-type=string
