1 © 2005 Cisco Systems, Inc. All rights reserved. 111 © 2004, Cisco Systems, Inc. All rights reserved.

2 © 2005 Cisco Systems, Inc. All rights reserved. Network Security 1 Module 5 – Cisco Secure Access Control Server

3 © 2005 Cisco Systems, Inc. All rights reserved. Learning Objectives 5.1 Cisco Secure Access Control Server for Windows 5.2 Configuring RADIUS and TACACS+ with CSACS

4 © 2005 Cisco Systems, Inc. All rights reserved. Module 5 – Cisco Secure Access Control Server 5.1 Cisco Secure Access Control Server for Windows

5 © 2005 Cisco Systems, Inc. All rights reserved. Cisco Secure ACS Products

6 © 2005 Cisco Systems, Inc. All rights reserved. What Is Cisco Secure ACS for Windows Server?

7 © 2005 Cisco Systems, Inc. All rights reserved. Cisco Secure ACS General Features

8 © 2005 Cisco Systems, Inc. All rights reserved. Authentication and User Databases

9 © 2005 Cisco Systems, Inc. All rights reserved. Cisco Secure ACS Windows Services

10 © 2005 Cisco Systems, Inc. All rights reserved. Cisco Secure ACS User Database

11 © 2005 Cisco Systems, Inc. All rights reserved. Keeping databases current

12 © 2005 Cisco Systems, Inc. All rights reserved. Cisco Secure ACS System Architecture

13 © 2005 Cisco Systems, Inc. All rights reserved. Cisco ACS Windows Services

14 © 2005 Cisco Systems, Inc. All rights reserved. Using the ACS Database Alone

15 © 2005 Cisco Systems, Inc. All rights reserved. Using the Windows Database

16 © 2005 Cisco Systems, Inc. All rights reserved. Using External User Databases

17 © 2005 Cisco Systems, Inc. All rights reserved. Using Token Cards

18 © 2005 Cisco Systems, Inc. All rights reserved. User-Changeable Passwords

19 © 2005 Cisco Systems, Inc. All rights reserved. Module 5 – Cisco Secure Access Control Server 5.2 Configuring RADIUS and TACACS+ with CSACS

20 © 2005 Cisco Systems, Inc. All rights reserved. Gathering Answers for the Installation Questions

21 © 2005 Cisco Systems, Inc. All rights reserved. Cisco Secure ACS for Windows Server: Installation Overview

22 © 2005 Cisco Systems, Inc. All rights reserved. Administering Cisco Secure ACS for Windows Server

23 © 2005 Cisco Systems, Inc. All rights reserved. Troubleshooting Use the Failed Attempts Report under Reports and Activity as a starting point. Provides a valuable source of troubleshooting information.

24 © 2005 Cisco Systems, Inc. All rights reserved. Globally Enable AAA Cisco Secure ACS for Windows Server NAS aaa new-model router(config)# router(config)# aaa new-model

25 © 2005 Cisco Systems, Inc. All rights reserved. tacacs-server Commands tacacs-server key keystring router(config)# router(config)# tacacs-server key tacacs-server host ipaddress router(config)# router(config)# tacacs-server host tacacs-server host ipaddress key keystring router(config)# router(config)# tacacs-server host key The two commands shown here can be used to share the key with all servers or This command can be used for a single server

26 © 2005 Cisco Systems, Inc. All rights reserved. AAA Configuration Example aaa authentication {login | enable default | arap | ppp | nasi} {default | list-name} method1 [method2 [method3 [method4]]] aaa accounting {system | network | exec | connection | commands level}{default | list-name} {start-stop | wait-start | stop-only | none} [method1 [method2]] aaa authorization {network | exec | commands level | reverse-access} {default | list-name} {if-authenticated | local | none | radius | tacacs+ | krb5-instance} router(config)#

27 © 2005 Cisco Systems, Inc. All rights reserved.

28 © 2005 Cisco Systems, Inc. All rights reserved. AAA TACACS+ Troubleshooting Displays detailed information associated with TACACS+ debug tacacs router# debug tacacs events router# Displays detailed information from the TACACS+ helper process

29 © 2005 Cisco Systems, Inc. All rights reserved. debug aaa authentication Command TACACS+ Example Output 14:01:17: AAA/AUTHEN ( ): Method=TACACS+ 14:01:17: TAC+: send AUTHEN/CONT packet 14:01:17: TAC+ ( ): received authen response status = PASS 14:01:17: AAA/AUTHEN ( ): status = PASS

30 © 2005 Cisco Systems, Inc. All rights reserved. debug tacacs Command Example Output – Failure 13:53:35: TAC+: Opening TCP/IP connection to /49 13:53:35: TAC+: Sending TCP/IP packet number to /49 (AUTHEN/START) 13:53:35: TAC+: Receiving TCP/IP packet number from /49 13:53:35: TAC+ ( ): received authen response status = GETUSER 13:53:37: TAC+: send AUTHEN/CONT packet 13:53:37: TAC+: Sending TCP/IP packet number to /49 (AUTHEN/CONT) 13:53:37: TAC+: Receiving TCP/IP packet number from /49 13:53:37: TAC+ ( ): received authen response status = GETPASS 13:53:38: TAC+: send AUTHEN/CONT packet 13:53:38: TAC+: Sending TCP/IP packet number to /49 (AUTHEN/CONT) 13:53:38: TAC+: Receiving TCP/IP packet number from /49 13:53:38: TAC+ ( ): received authen response status = 13:53:40: TAC+: Closing TCP/IP connection to /49 FAIL

31 © 2005 Cisco Systems, Inc. All rights reserved. debug tacacs Command Example Output – Pass 14:00:09: TAC+: Opening TCP/IP connection to /49 14:00:09: TAC+: Sending TCP/IP packet number to /49 (AUTHEN/START) 14:00:09: TAC+: Receiving TCP/IP packet number from /49 14:00:09: TAC+ ( ): received authen response status = GETUSER 14:00:10: TAC+: send AUTHEN/CONT packet 14:00:10: TAC+: Sending TCP/IP packet number to /49 (AUTHEN/CONT) 14:00:10: TAC+: Receiving TCP/IP packet number from /49 14:00:10: TAC+ ( ): received authen response status = GETPASS 14:00:14: TAC+: send AUTHEN/CONT packet 14:00:14: TAC+: Sending TCP/IP packet number to /49 (AUTHEN/CONT) 14:00:14: TAC+: Receiving TCP/IP packet number from /49 14:00:14: TAC+ ( ): received authen response status = 14:00:14: TAC+: Closing TCP/IP connection to /49 PASS

32 © 2005 Cisco Systems, Inc. All rights reserved. debug tacacs events Command Output router# debug tacacs events %LINK-3-UPDOWN: Interface Async2, changed state to up 00:03:16: TAC+: Opening TCP/IP to /49 timeout=15 00:03:16: TAC+: Opened TCP/IP handle 0x48A87C to /49 00:03:16: TAC+: periodic timer started 00:03:16: TAC+: req=3BD868 id= ver=193 handle=0x48A87C (ESTAB) expire=14 AUTHEN/START/SENDAUTH/CHAP queued 00:03:17: TAC+: ESTAB 3BD868 wrote 46 of 46 bytes 00:03:22: TAC+: CLOSEWAIT read=12 wanted=12 alloc=12 got=12 00:03:22: TAC+: CLOSEWAIT read=61 wanted=61 alloc=61 got=49 00:03:22: TAC+: received 61 byte reply for 3BD868 00:03:22: TAC+: req=3BD868 id= ver=193 handle=0x48A87C (CLOSEWAIT) expire=9 AUTHEN/START/SENDAUTH/CHAP processed 00:03:22: TAC+: periodic timer stopped (queue empty) 00:03:22: TAC+: Closing TCP/IP 0x48A87C connection to /49 00:03:22: TAC+: Opening TCP/IP to /49 timeout=15 00:03:22: TAC+: Opened TCP/IP handle 0x489F08 to /49 00:03:22: TAC+: periodic timer started 00:03:22: TAC+: req=3BD868 id= ver=192 handle=0x489F08 (ESTAB) expire=14 AUTHEN/START/SENDPASS/CHAP queued 00:03:23: TAC+: ESTAB 3BD868 wrote 41 of 41 bytes 00:03:23: TAC+: CLOSEWAIT read=12 wanted=12 alloc=12 got=12 00:03:23: TAC+: CLOSEWAIT read=21 wanted=21 alloc=21 got=9 00:03:23: TAC+: received 21 byte reply for 3BD868 00:03:23: TAC+: req=3BD868 id= ver=192 handle=0x489F08 (CLOSEWAIT) expire=13 AUTHEN/START/SENDPASS/CHAP processed 00:03:23: TAC+: periodic timer stopped (queue empty)

33 © 2005 Cisco Systems, Inc. All rights reserved. RADIUS Server Command radius-server key keystring router(config)# router(config)# radius-server key radius-server host {host-name | ipaddress} router(config)# router(config)# radius-server host radius-server host ipaddress key keystring router(config)# router(config)# radius-server host key The two commands shown here can be used to share the key with all servers Or This command can be used for a single server

34 © 2005, Cisco Systems, Inc. All rights reserved.