ciscoacs4.1资源-CSDN下载

共53个文件

dll：26个

exe：13个

htm：11个

4星 · 超过85%的资源需积分: 9 8 浏览量 2009-09-19 13:54:42 上传评论 6 收藏 9.15MB ZIP 举报

**Cisco Secure ACS 4.1 知识点详解** Cisco Secure Access Control Server (ACS) 是Cisco公司推出的一款网络访问控制解决方案，主要用于实现网络设备的认证（Authentication）、授权（Authorization）和计费（Accounting），简称AAA服务。在企业网络环境中，ACS作为策略服务器，能够有效地管理和控制用户对网络资源的访问，确保网络安全并符合合规性要求。 **1. 认证（Authentication）** 在ACS 4.1中，认证过程涉及验证用户身份。它可以支持多种认证协议，如RADIUS（远程用户拨入认证服务）、TACACS+（终端访问控制器访问控制系统+）以及本地数据库认证。这些协议使得ACS能够与不同的身份验证源（如Active Directory、LDAP服务器或本地用户账户）进行交互，确保用户在尝试访问网络时提供有效的凭证。 **2. 授权（Authorization）** 授权决定了验证后的用户可以访问哪些网络资源。ACS 4.1可以根据用户的权限设置，动态地分配访问权限。例如，管理员可以配置策略，使某些用户只能访问特定的网络服务，而其他用户可能有更广泛的访问权限。这种精细的权限管理有助于防止未经授权的访问，保护敏感数据和网络设备。 **3. 计费（Accounting）** 计费功能记录用户的网络活动，以便进行审计和费用追踪。ACS 4.1可以收集关于用户会话的信息，如登录时间、在线时长、使用的资源等，这对于网络维护和成本分析至关重要。 **4. CSAdmin和CSDB** "CSAdmin"可能是ACS的管理界面，用于配置和管理ACS服务器，包括创建和管理用户账户、定义策略、设置认证和授权规则等。"CSDB"可能代表ACS的数据库，存储认证、授权和计费的相关信息。数据库的正确配置和维护是保证ACS正常运行的关键。 **5. Authenticators** "Authenticators"在ACS中通常指用于处理不同类型的认证请求的模块。它们可能包含了与特定设备或协议交互的逻辑，例如处理来自Cisco路由器的EAP（可扩展认证协议）请求。 **6. Support和bin目录** "Support"目录可能包含诊断工具、日志文件和故障排除资料，帮助管理员监控和调试ACS系统。"bin"目录则可能包含了ACS的可执行文件和其他二进制程序，是系统运行的核心部分。 **7. 部署和配置** 部署ACS 4.1时，需要考虑网络拓扑、安全策略以及与其他网络设备的集成。配置步骤包括安装服务器、配置认证源、设定策略、测试连接性和性能调整。这需要对网络架构和ACS功能有深入理解。 Cisco Secure ACS 4.1是一个强大的网络访问控制工具，对于大型企业或组织来说，是确保网络安全性、合规性和高效管理的重要组成部分。通过深入了解和熟练掌握ACS的各个组件和功能，管理员可以更好地控制网络访问，保护关键资源，并提高整体网络运营效率。

资源推荐

资源详情

资源评论

收起资源包目录

Cisco ACS 4.1.4.13.12-SW最新版本下载.zip （53个子文件）

Support

RadiusSPC.dll 164KB

ConsoleDLL.dll 64KB

DnldACLs.dll 168KB

odbcLogger.dll 128KB

csvLog.dll 112KB

SyslogClient.dll 92KB

Install.dll 1.12MB

backupRestoreSupport.dll 92KB

AironetEAP.dll 44KB

GenericEAP.dll 140KB

bin

NAS.dll 72KB

CSSupport.exe 236KB

CSDBSync.exe 316KB

CSTacacs.exe 368KB

CSLog.exe 164KB

EndPoint.dll 247KB

CSRadius.exe 664KB

acsEapTls.dll 832KB

CSAuth.exe 2.77MB

CSMon.exe 664KB

UdvDll.dll 96KB

AironetACS.dll 124KB

CSUtil.exe 2.81MB

CSSupportCL.exe 172KB

acsEapMschap.dll 136KB

SchemeLayer.dll 324KB

Vendors.dll 76KB

acsEapGtc.dll 128KB

CSAdmin.exe 7.59MB

Radtest.exe 656KB

Tactest.exe 92KB

acsTeap.dll 832KB

PDE.dll 1.64MB

CryptoLib.dll.sha1 128B

CryptoLib.dll 664KB

acsPeap.dll 832KB

NTlib.dll 204KB

CSUpdate.exe 614KB

Authenticators

DServDll.dll 952KB

NTAuthenDLL.dll 140KB

CSDB

upgrade.dat 104KB

CSAdmin

WWW

services

AuthenPolicy.htms 12KB

SH_NAP_AUTH.htm 7KB

networkConfig

SH_renameNDG.htm 4KB

SH_HOST_EDIT.htm 11KB

SH_HOST_ADD.htm 11KB

SH_newNDG.htm 4KB

dbSync

SH_PAGE.htm 9KB

main_b.htm 2KB

authenConfig

SH_EAPFAST.htm 13KB

eap-fastConfig.htm 8KB

authendll

SH_NIS_PAGE.htm 3KB

SH_NT_PAGE.htm 9KB

<html> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=ISO-8859-1"> <META NAME="Short-Help-File" CONTENT="authenConfig/SH_EAPFAST.htm"> <TITLE>EAP FAST</TITLE> </HEAD> <BODY BGCOLOR="#FFFFFF" BACKGROUND="/images/page_background.gif"> <A NAME="Top"><IMG SRC="/images/bb_help.gif" HSPACE=10> </A> <BLOCKQUOTE> EAP-FAST Configuration Page Use this page to configure EAP-FAST authentication settings. <LI><A HREF="#EAPFAST">EAP-FAST Settings</A> <LI><A HREF="#CLIENT">Client initial message</A> <LI><A HREF="#AUTHID">Authority ID Info</A> <LI><A HREF="#ALLOWAN">Allow anonymous in-band PAC provisioning</A> <LI><A HREF="#ALLOWAU">Allow authenticated in-band PAC provisioning</A> <LI><A HREF="#STRIPPEDIID">Allow stripped user identity on PAC provisioning</A> <LI><A HREF="#ALLOWMA">Allow machine authentication</A> <LI><A HREF="#ALLOWST">Allow stateless session resume</A> <LI><A HREF="#ALLOWIN">Allowed inner methods</A> <LI><A HREF="#CERTC">Certificate Comparison</A> <LI><A HREF="#EAPTLS">EAP-TLS session timeout (minutes)</A> <LI><A HREF="#EAPMAS">EAP-FAST master server</A> <LI><A HREF="#ACTUAL">Actual EAP-FAST server status</A> </BLOCKQUOTE> <BLOCKQUOTE> <A NAME="EAPFAST">EAP-FAST Settings</A> </BLOCKQUOTE> <UL> <LI>Allow EAP-FASTTo enable EAP-FAST authentication, select this check box.</LI> <LI>Active Master Key TTLEnter a value for the amount of time that a master key is used to generate new Protected Access Credentials (PACs). When the time to live (TTL) defined for the Master Key expires, the master key is considered retired and a new master key is generated.</LI> <LI>Retired master key TTLEnter a value for the amount of time that PACs generated using a retired master key are acceptable for EAP-FAST authentication. When an end-user client gains network access using a PAC based on a retired master key, ACS sends a new PAC to the end-user client.</LI> <LI>Tunnel PAC TTL Enter a value for the amount of time that a PAC is used before it expires and must be replaced. If the master key used to generate the Tunnel PAC has not expired, new PAC creation and assignment is automatic. If the master key used to generate the Tunnel PAC expired, automatic or manual provisioning must be used to provide the end-user client with a new PAC. The following table summarizes ACS behavior regarding the lifespans of PACs, master keys, retired master keys: <TABLE BORDER="1" ALIGN="center" TITLE="PAC vs Master Key States"> <TR BGCOLOR="Gray"> <TD>Master Key vs. PAC</TD> <TD>PAC active</TD> <TD>PAC expired</TD> </TR> <TR> <TD BGCOLOR="Gray">Master key active</TD> <TD>PAC not replaced</TD> <TD>New PAC sent</TD> </TR> <TR> <TD BGCOLOR="Gray">Master key retired</TD> <TD>New PAC sent</TD> <TD>New PAC sent</TD> </TR> <TR> <TD BGCOLOR="Gray">Master key expired</TD> <TD>PAC provisioning required</TD> <TD>PAC provisioning required</TD> </TR> </table> </LI> </UL> <blockquote> <A HREF="#Top">[Back to Top]</A> <A NAME="CLIENT">Client initial message</A> </blockquote> <ul> <li>Client initial message To specify a message for users who use a Cisco EAP-FAST client, type the message in the Client initial message box.</li> </ul> <blockquote> Note: A user will see the initial message only if the end-user client supports its display. <A HREF="#Top">[Back to Top]</A> <A NAME="AUTHID">Authority ID Info</A> Authority ID Info-This is the textual identity of this ACS server, which can be used by end-user to determine which ACS server to be authenticated against. This field is manadatory. <A HREF="#Top">[Back to Top]</A> </blockquote> <UL> <A NAME="ALLOWAN">Allow anonymous in-band PAC provisioning</A> </UL> <blockquote> ACS provisions an end-user client with a PAC using EAP-FAST phase zero. If this check box is selected, ACS establishes a secured connection with the end-user client for the purpose of providing the client with a new PAC. This option allows an anonymous TLS handshake between the end-user client and ACS. EAP-MSCHAP will be used as the only inner method in phase zero. <A HREF="#Top">[Back to Top]</A> </blockquote> </LI> <blockquote> <A NAME="ALLOWAU">Allow authenticated in-band PAC provisioning</A> ACS provisions an end-user client with a PAC using EAP-FAST phase zero with SSL server-side authentication. This option requires that a server certificate and a trusted root CA are installed on ACS. One of the allowed inner methods will then be used to authenticate the user. </blockquote> <blockquote> In addition, the client may send its certificate to the server, causing the mutual TLS authentication. In this case, ACS skips the inner methods and provisions the PAC. </blockquote> <UL> <li> Accept client on authenticated provisioningThis option is only available when the allow authenticated in-band PAC provisioning option is selected. The server always sends an Access-Reject at the end of the provisioning phase,forcing the client to re-authenticate using the tunnel PAC. This option enables ACS to send an Access-Accept to the client at the end of the provisioning phase. </li> <li>Require client certificate for provisioningThis option allows provisioning PACs basing on certificates only. Other inner EAP methods for PAC provisioning are not allowed. If the client does not present its certificate during the first TLS handshake, the server initiates a TLS re-negotiation. The re-negotiation requests the client to start a new TLS handshake protected by the cipher negotiated in the first handshake. During the second TLS handshake the server requests the client's certificate.If the certificate is not sent, the handshake fails and the user is denied access.</li> </UL> <blockquote> <A HREF="#Top">[Back to Top]</A> </blockquote> <UL> <A NAME="STRIPPEDIID">Allow stripped user identity on PAC provisioning</A> ACS provisions an end-user client with a PAC using EAP-FAST phase zero. If this check box is selected, ACS provisions the client with a new PAC using stripped user identity and this is to retain ACS 3.x behavior. </UL> <blockquote> <A HREF="#Top">[Back to Top]</A> </blockquote> <UL> <A NAME="ALLOWMA">Allow Machine Authentication</A> ACS provisions an end-user client with a machine PAC and performs machine authentication (for end-user clients who do not have the machine credentials). The machine PAC can be provisioned to the client by request (in-band) or by administrator (out-of-band). When ACS receives a valid machine PAC from the end-user client, the machine identity details are extracted from the PAC and verified in the ACS database or external databases. After these details are correctly verified, no further authentication is performed.</li> </UL> <blockquote> Note: After performing machine authentication and when the Required or Posture Only checkboxes are selected, ACS also requests the posture credentials. </blockquote> <ul> <li> Machine PAC TTLEnter a value for the amount of time that a machine PAC is acceptable for use. When

评论收藏

内容反馈