Cisco 5505 - ASA Firewall Edition Bundle, Руководство по настройке CLI

Страница: 916 / 2164

1-12
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring the ASA to Integrate with Cisco TrustSec
Configuring the ASA for Cisco TrustSec Integration
Prerequisites
•
The referenced server group must be configured to use the RADIUS protocol. If you add a
non-RADIUS server group to the ASA, the feature configuration will fail.
•
If the ISE is also used for user authentication, obtain the shared secret that was entered on the ISE
when you registered the ASA with the ISE. Contact your ISE administrator if you do not have this
information.
To configure the AAA server group for the ISE on the ASA, perform the following steps:
Command Purpose
Step 1
hostname(config)# aaa-server server-tag protocol
radius
Example:
hostname(config)# aaa-server ISEserver protocol
radius
Creates the AAA server group and configures the
AAA server parameters for the ASA to communicate
with the ISE server.
Where server-tag specifies the server group name.
See Creating a Security Group on the ISE, page 1-8
for information.
Step 1
hostname(config-aaa-server-group)# exit
Exits from the AAA server group configuration
mode.
Step 1
hostname(config)#
aaa-server
server-tag
( interface-name ) host server-ip
Example:
hostname(config)# aaa-server ISEserver (inside) host
192.0.2.1
Configures a AAA server as part of a AAA server
group and sets host-specific connection data.
Where ( interface-name ) specifies the network
interface where the ISE server resides. The
parentheses are required in this parameter.
Where server-tag is the name of the AAA server
group that you specified in step 1 in the server-tag
argument.
Where server-ip specifies the IP address of the ISE
server.
Step 1
hostname(config-aaa-server-host)# key key
Example:
hostname(config-aaa-server-host)# key
myexclusivemumblekey
Specifies the server secret value used to authenticate
the ASA with the ISE server.
Where key is an alphanumeric keyword up to 127
characters long.
If the ISE is also used for user authentication, enter
the shared secret that was entered on the ISE when
you registered the ASA with the ISE.
See Registering the ASA with the ISE, page 1-8 for
information.
Step 1
hostname(config-aaa-server-host)# exit
Exits from the AAA server host configuration mode.
Step 2
hostname(config)# cts server-group
AAA-server-group-name
Example:
hostname(config)# cts server-group ISEserver
Identifies the AAA server group that is used by Cisco
TrustSec for environment data retrieval.
Where AAA-server-group-name is the name of the
AAA server group that you specified in step 1 in the
server-tag argument.
Only one instance of the server group can be
configured on the ASA for Cisco TrustSec.