1-21
User Guide for Cisco Secure ACS for Windows Server
78-14696-01, Version 3.1
Chapter 1 Overview of Cisco Secure ACS
AAA Server Functions and Concepts
Administration
To configure, maintain, and protect its AAA functionality, Cisco Secure ACS
provides a flexible administration scheme. You can perform nearly all
administration of Cisco Secure ACS through its HTML interface.
You can access the HTML interface from computers other than the
Cisco Secure ACS server. This enables remote administration of
Cisco Secure ACS. For more information about the HTML interface, including
steps for accessing the HTML interface, see
Cisco Secure ACS HTML Interface,
page 1-23
.
HTTP Port Allocation for Remote Administrative Sessions
The HTTP port allocation feature allows you to configure the range of TCP ports
used by Cisco Secure ACS for remote administrative HTTP sessions (that is,
administrative sessions conducted by a browser running on a computer other than
the Cisco Secure ACS server). Narrowing this range with the HTTP port
allocation feature reduces the risk of unauthorized access to your network by a
port open for administrative sessions.
We do not recommend that you administer Cisco Secure ACS through a firewall.
Doing so requires that you configure the firewall to permit HTTP traffic over the
range of HTTP administrative session ports that Cisco Secure ACS uses. While
narrowing this range reduces the risk of unauthorized access, a greater risk of
attack remains if you allow administration of Cisco Secure ACS from outside a
firewall. A firewall configured to permit HTTP traffic over the Cisco Secure ACS
administrative port range must also permit HTTP traffic through port 2002,
because this is the port a remote web browser must access to initiate an
administrative session.
Note
A broad HTTP port range could create a security risk. To prevent accidental
discovery of an active administrative port by unauthorized users, keep the HTTP
port range as narrow as possible. Cisco Secure ACS tracks the IP address
associated with each remote administrative session. An unauthorized user would
have to impersonate, or “spoof”, the IP address of the legitimate remote host to
make use of the active administrative session HTTP port.
