Chapter 1 Overview of Cisco Secure ACS
AAA Server Functions and Concepts
1-18
User Guide for Cisco Secure ACS for Windows Server
78-14696-01, Version 3.1
group, you can configure a network access restriction set in the Shared Profile
Components section of the HTML interface, and then configure each group to use
the network access restriction set you created.
For information about the types of shared profile components supported by
Cisco Secure ACS, see
About Shared Profile Components, page 5-1
.
Support for Cisco Device-Management Applications
Cisco Secure ACS supports Cisco device-management applications, such as
Management Center for PIX Firewall, by providing command authorization for
network users who are using the management application to configure managed
network devices. Support for command authorization for management application
users is accomplished by using unique command authorization set types for each
management application configured to use Cisco Secure ACS for authorization.
Cisco Secure ACS uses to communicate with management
applications. For a management application to communicate with
Cisco Secure ACS, the management application must be configured in
Cisco Secure ACS as a AAA client that uses . Also, you must provide
the device-management application with a valid administrator name and
password. When a management application initially communicates with
Cisco Secure ACS, these requirements ensure the validity of the communication.
For information about configuring a AAA client, see
AAA Client Configuration,
page 4-11
. For information about administrator accounts, see
Administrator
Accounts, page 10-1
.
Additionally, the administrator used by the management application must have the
Create New Device Command Set Type privilege enabled. When a management
application initially communicates with Cisco Secure ACS, it dictates to
Cisco Secure ACS the creation of a device command set type, which appears in
the Shared Profile Components section of the HTML interface. It also dictates a
custom service to be authorized by . The custom service appears on the
(Cisco IOS) page in the Interface Configuration section of the HTML
interface. For information about enabling services, see
Protocol
Configuration Options for , page 3-7
. For information about device
command-authorization sets for management applications, see
Command
Authorization Sets, page 5-13
.
After the management application has dictated the custom service and
device command-authorization set type to Cisco Secure ACS, you can configure
command-authorization sets for each role supported by the management