Looking for:
Download cisco secure acs 3.3 for windows |
- Download cisco secure acs 3.3 for windows
Cisco Secure ACS for Windows - Retirement Notification - Cisco - Table Of Contents
Download cisco secure acs 3.3 for windows. Cisco Secure Access Control Server Solution Engine
To satisfy Windows requirements for authentication requests, Cisco Secure ACS must specify the Windows workstation that the user is attempting to log into. Because Cisco Secure ACS cannot determine this information from authentication requests sent by AAA clients, it uses a generic workstation name for all requests. In the local domain and in each trusted domain and child domain that Cisco Secure ACS will use to authenticate users, ensure both of the following:.
Step 2 Verify Server Service Status. The services list alphabetically. Note This step is required only if Cisco Secure ACS authenticates users who belong to trusted domains or child domains. For more information, see Microsoft. Step 4 Create User Account. Tip If you have upgraded or reinstalled Cisco Secure ACS and you completed this step for the previous installation, it is required only if you want to use a different user account to run Cisco Secure ACS services.
In the domain of the domain controller running Cisco Secure ACS, you must have a domain user account that can be used to run Cisco Secure ACS services as explained in later steps of this procedure. Do both of the following:. Create a domain user account. The user account does not require any particular group membership in the domain. If you enable audit policies, Event Viewer entries with this username will make it easier to diagnose permissions problems related to failed Cisco Secure ACS authentication attempts.
To the user account you create, grant "Read all properties" permission for all Active Directory folders containing users that Cisco Secure ACS must be able to authenticate. Granting permissions for Active Directory folders is done by accessing Active Directory using the Microsoft Management Console and configuring the security properties for the folders containing users who are to be authenticated by Cisco Secure ACS.
Tip You can access the security properties of an Active Directory folder containing users by right-clicking the folder, selecting Properties, and clicking the Security tab. Click Add to include the username. For more information, see Windows Server Active Directory. Step 5 Configure Local Security Policies. For the user account created in the preceding step, add the user to the following local security policies:. For more information, see Configuring Local Security Policies.
Step 6 Configure Services. Configure all Cisco Secure ACS services to run as the user you added to the security policies in the preceding step. If you configure such features using hostnames rather than IP addresses and DNS does not operate correctly, those features may fail, as would authentication requests sent to Active Directory.
Note Only perform this step if, after performing the preceding steps, Windows authentication and group mapping for users who belong to trusted domains or child domains are unreliable. When Cisco Secure ACS runs on a member server and you need to authenticate users with a Windows user database, the additional configuration required varies, depending upon your Windows networking configuration.
Most of the steps below are always applicable when Cisco Secure ACS runs on a member server; other steps are required only in certain conditions, as noted at the beginning of the step.
Step 1 Verify Domain Membership. One common configuration error that prevents Windows authentication is the erroneous assignment of the member server to a workgroup with the same name as the Windows domain that you want to use to authenticate users. While this may seem obvious, we recommend that you verify that the computer running Cisco Secure ACS is a member server of the correct domain.
Tip To determine domain membership of a computer, on the Windows desktop, right-click My Computer , select Properties , select the Network Identification tab, and read the information provided on that tab. If the computer running Cisco Secure ACS is not a member of the domain that your deployment plans require, correct this before continuing this procedure.
Step 3 Verify Server Service Status. Step 5 Create User Account. Step 6 Configure Local Security Policies. To the user account created in the preceding step, add the user to the following local security policies:.
Step 7 Configure Services. Note Only perform this step if, after performing the preceding steps, Windows authentication and group mapping are unreliable. This includes domain controllers of child domains.
For full configuration requirements, see the applicable procedure: Configuring for Member Server Authentication , or Configuring for Domain Controller Authentication.
The Local Security Settings window displays a list of policies with associated settings. The two policies that you must configure are:. Step 4 For the Act as part of the operating system policy and again for the Log on as a service policy, follow these steps:. Double-click the policy name. Click Add. In the box below the Add button, type the username for the user account.
Note The username must be in domain-qualified format. Click Check Names. If the Enter Network Password dialog box appears, complete the following fields:. The username provided must exist in the domain specified in c. Windows verifies the existence of the username provided in c. The Enter Network Password dialog box closes. The Local Policy Setting dialog box closes. The domain-qualified username specified in c.
Verify that the username specified in c. If it does not, repeat these steps. Tip To see the username you added, you may have to widen the Local Setting column. Note The Effective Setting column does not dynamically update.
This procedure includes later verification steps for ensuring that the Effective Setting column contains the required information.
After you have configured both the Act as part of the operating system policy and the Log on as a service policy, the user account appears in the Local Setting column for the policy you configured. To do so, follow these steps:.
Close the Local Security Settings window. The window closes. This is the only way to refresh the information in the Effective Setting column. Open the Local Security Settings window again. The Local Security Settings window displays an updated list of policies with their associated settings. For the Act as part of the operating system policy and again for the Log on as a service policy, verify that the username you added to the policy appears in the Effective Setting column.
Note If the username you configured the policies to include does not appear in the Effective Setting column for both policies, there may be security policy settings on the domain controller that conflict with the local setting. Resolve the conflict by configuring security policies on the domain controller to allow the local settings to be the effective settings for these two policies.
For more information about configuring security policies on the domain controller, see Microsoft documentation for your operating system. Step 6 Close the Local Security Settings window. The user account specified has the permissions necessary to run Cisco Secure ACS services successfully.
The Services window displays a list of service groups and a list of all registered services for the current group. The list of service groups is labeled Tree. The registered services for the current group appear in the list to the right of the Tree list. Step 3 In the Tree list, click Services local. Select the Log On tab. Select the This account option. In the box next to the This account option, type the username for the account.
In the Password box and in the Confirm Password box, type the password for the user account. Click System Configuration , click Service Control , and then, at the bottom of the browser window, click Restart. This usually takes a minute or two. In the Name column, double-click CSAdmin. Click Stop and wait for the Service Control dialog box to close. Click Start and wait for the Service Control dialog box to close. Close the Services window. Depending upon what version of Cisco Secure ACS for Windows Server is used and the operating system that it runs on, the migration process varies.
See the following procedure for more details. Before upgrading or transferring data, back up your original Cisco Secure ACS and save the backup file in a location on a drive that is not local to the computer running Cisco Secure ACS.
If you do not have a license for version 3. Cisco Secure ACS version 3. The most recent version of the Release Notes are on Cisco. The directory must be accessible from the FTP root directory. This is the IP address you recorded in a. The clean. Step 1 Using the local administrator account, log in to the computer that you want to uninstall Cisco Secure ACS from. Step 5 Click Yes.
Step 6 If a dialog box with the following message appears:. The uninstallation continues. Cisco Secure ACS services stop.
A dialog box appears. Step 7 When a dialog box with the following message appears:. Step 8 Click OK. Cisco documentation and additional literature are available on Cisco.
Cisco also provides several ways to obtain technical assistance and other technical resources. These sections explain how to obtain technical information from Cisco Systems. You can submit comments by using the response card if present behind the front cover of your document or by writing to the following address:.
For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, Cisco Technical Support provides hour-a-day, award-winning technical assistance. If you do not hold a valid Cisco service contract, contact your reseller. The Cisco Technical Support Website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The website is available 24 hours a day, days a year at this URL:.
If you have a valid service contract but do not have a user ID or password, you can register at this URL:. S3 and S4 service requests are those in which your network is minimally impaired or for which you require product information.
If your issue is not resolved using the recommended resources, your service request will be assigned to a Cisco TAC engineer. S1 or S2 service requests are those in which your production network is down or severely degraded. Cisco TAC engineers are assigned immediately to S1 and S2 service requests to help keep your business operations running smoothly. To ensure that all service requests are reported in a standard format, Cisco has established severity definitions.
Severity 1 S1 —Your network is "down," or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation. Severity 2 S2 —Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products.
You and Cisco will commit full-time resources during normal business hours to resolve the situation. Severity 3 S3 —Operational performance of your network is impaired, but most business operations remain functional.
You and Cisco will commit resources during normal business hours to restore service to satisfactory levels. Severity 4 S4 —You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations. Information about Cisco products, technologies, and network solutions is available from various online and printed sources.
Both new and experienced users will benefit from these publications. Each quarter, Packet delivers coverage of the latest industry trends, technology breakthroughs, and Cisco products and solutions, as well as network deployment and troubleshooting tips, configuration examples, customer case studies, certification and training information, and links to scores of in-depth online resources.
You can access Packet magazine at this URL:. Users who submit a password change receive the text message that you type in the corresponding box. This feature depends upon having the CiscoSecure Database Replication feature configured properly; however, replication scheduling does not apply to propagation of changed password information.
Cisco Secure ACS sends changed password information immediately, regardless of replication scheduling. The automatically triggered cascade setting for the CiscoSecure Database Replication feature does not cause Cisco Secure ACSes that receive changed password information to send it to their replication partners. The log file management options for the User Password Changes Log are listed below:. If enabled, this feature enables you to specify either the maximum number of files to retain or the maximum age of files to retain.
Step 2 Click Local Password Management. Step 3 Under Password Validation Options, follow these steps:. In Password length between X and Y characters, type the minimum valid number of characters for a password in the X box.
While the X box accepts two characters, passwords can only be between 1 and 32 characters in length. In Password length between X and Y characters, type the maximum valid number of characters for a password in the Y box.
If you want to disallow passwords that contain the username, select the Password may not contain the username check box. If you want to require that a user password must be different than the previous user password, select the Password is different from the previous value check box.
If you want to require that passwords must contain both letters and numbers, select the Password must be alphanumeric check box.
Step 4 Under Remote Change Password, follow these steps:. In the box below the Disable TELNET Change Password against this ACS and return the following message to the users telnet session check box, type a message that users should see when attempting to change a password in a Telnet session and when the Telnet password change feature has been disabled Step b.
If you want Cisco Secure ACS to send changed password information immediately after a user has changed a password, select the Upon remote user password change, immediately propagate the change to selected replication partners check box.
Tip The Cisco Secure ACSes that receive the changed password information list below the Upon remote user password change, immediately propagate the change to selected replication partners check box. Select the Manage Directory check box. Step 8 Click Submit. Cisco Secure ACS restarts its services and implements the settings you specified. This section provides information about the Cisco Secure ACS Backup feature, including procedures for implementing this feature.
You can also establish automated backups that occur at regular intervals or at selected days of the week and times. Maintaining backup files can minimize downtime if system information becomes corrupt or is misconfigured. We recommend copying the files to the hard drive on another system in case the hardware fails on the primary system.
You can configure the number of backup files to keep and the number of days after which backup files are deleted. The more complex your configuration and the more often you back up the system, the more diligent we recommend you be about clearing out old databases from the Cisco Secure ACS hard drive.
The user database backup includes all user information, such as username, password, and other authentication information, including server certificates and the certificate trust list. When a system backup takes place, whether it was manually generated or scheduled, the event is logged in the Administration Audit report and the ACS Backup and Restore report. The unit of measurement is minutes, with a default backup frequency of 60 minutes.
The minimum interval is one hour, and the backup takes place on the hour selected. Using the following options, you can specify how Cisco Secure ACS determines which log files to delete:. Step 3 In the Directory box under Backup Location, type the drive and path to the directory on a local hard drive where you want the backup file to be written.
Step 4 Click Backup Now. You can schedule Cisco Secure ACS backups to occur at regular intervals or on selected days of the week and times.
Note Because Cisco Secure ACS is momentarily shut down during backup, if the backup interval is too frequent, users might be unable to authenticate. Step 4 To schedule backups at specific times, follow these steps:. Tip Clicking times of day on the graph selects those times; clicking again clears them. At any time you can click Clear All to clear all hours, or you can click Set All to select all hours.
To limit how old backup files retained by Cisco Secure ACS can be, select the Delete files older than X days option and type the number of days for which Cisco Secure ACS should retain a backup file before deleting it. Step 7 Click Submit. This allows you to end scheduled backups and resume them later without having to re-create the schedule. Step 4 Click Submit. Cisco Secure ACS does not continue any scheduled backups.
You can still perform manual backups as needed. This feature helps minimize downtime if Cisco Secure ACS system information becomes corrupted or is misconfigured.
Cisco Secure ACS writes backup files only on the local hard drive. You can restore from any backup file you select. For example, you can restore from the latest backup file, or if you suspect that the latest backup was incorrect, you can select an earlier backup file to restore from. The backup directory is selected when you schedule backups or perform a manual backup.
The default directory for backup files is the following:. If you are not sure of the location of the latest backup file, check your scheduled backup configuration on the ACS Backup page. You can select the components to restore: the user and group databases, the system configuration, or both. The Directory box displays the drive and path to the backup directory most recently configured in the Directory box on the ACS Backup page. Step 3 To change the backup directory, type the new drive and path to the backup directory in the Directory box, and then click OK.
Cisco Secure ACS displays the backup files, if any, in the backup directory you specified. Step 5 To restore user and group database information, select the User and Group Database check box. Step 7 Click Restore Now. Step 8 To continue with the restoration, click OK. Cisco Secure ACS restores the system components specified using the backup file you selected. The restoration should require several minutes to complete, depending on which components you selected to restore and the size of your database.
No comments:
Post a Comment