Cisco ACS – Basic Setup

Start to Finish Setup of Cisco ACS (version 5.5 was used). Including n00b-status group and MAC Auth Bypass (MAB). Active Directory look-up will be added later. 😉

Initial Setup

  1. Load VM image or ISO to appliance
  2. Follow setup prompts – document the password!

Upgrading Cisco ACS

  1. Login to the CLI with acsadmin
  2. Create a repository
    repository temp
    url ftp://192.168.1.100/
    user admin password plain (FTP PASSWORD)
  3. Start the upgrade
    acs patch install 5-5-0-46-11.tar.gpg repository temp

TACACS Setup

  1. Log into ACS with acsadmin
  2. Set Login Banner under “My Workspace > Login Banner”
  3. Set Login Prompts under “System Administration > Configuration > Global System Options > TACACS+ Settings”
    1. Change Username / Password Prompts to “ACS Username” and “ACS Password”
  4. Create Locations under “Network Resources > Network Device Groups > Location”
  5. Create Device Types under “Network Resources > Network Device Groups > Device Type”
    1. Create a “Switch” device type.
  6. Create Device under “Network Resources > Network Device Groups > Network Devices and AAA Clients”
    1. Select proper location and device type
    2. Input TACACS info
  7. Create Identity Group under “Users and Identity Stores > Identity Group”
    1. Create one named “Local Device Admin”
    2. Create one named “Noob Status” for optional future use in restricting commands
  8. Create Users under “Users and Identity Stores > Internal Identity Stores > Users”
    1. Assign to identity group
  9. Create Shell Profile under “Policy Elements > Authorization and Permissions > Device Administration > Shell Profiles”
    1. For name, be descriptive (PRIV15_MAX15)
    2. Under common tasks tab
      1. Default privilege – static, value – 15
      2. Max privilege – static, value – 15
  10. Create Access Service under “Access Policies > Access Services”
    1. Create one for device admin called “DEVICE-ADMIN”
    2. Choose “User Selected Service Type” and “Device Administration” from the drop-down
    3. Only Check “Identity” and “Authorization”
    4. Click Next
    5. Uncheck Process Host Lookup
    6. Check only PAP/ASCII
    7. Choose Yes to modify Service Selection Policy – This takes you to the Service Selection rule page
    8. Click Create
    9. Check Protocol and match TACACS
    10. Choose “DEVICE-ADMIN” for the Service
  11. Modify Authorization Policy Under “Access Policies > Access Services > DEVICE-ADMIN > Authorization”
    1. Click “Customize”
    2. Remove “Compound Condition”
    3. Add “Protocol” and “Identity Group”
    4. Remove “Command Sets”
    5. Click OK
    6. Click Create
    7. Choose TACACS for “Protocol”
    8. Choose “Local Device Admin” for “Identity Group”
    9. Click “Default” and modify the default rule to “DenyAccess”

Switch Configuration

  1. TACACS Config
    1. 3750/3850 etc.
      ip tacacs source-interface [SOURCE INTERFACE]
      tacacs-server host [ACS SERVER IP]
      tacacs-server key [TACACS SHARED KEY]
      no tacacs-server directed-request
      aaa new-model
      !aaa group server tacacs+ ACS1
      ! server [ACS SERVER IP]aaa authentication login default group tacacs+ local
      aaa authentication enable default group tacacs+ enable
      aaa authorization exec default group tacacs+ if-authenticated
      aaa accounting update newinfo
      aaa accounting exec default start-stop broadcast group tacacs+
      aaa accounting commands 1 default start-stop broadcast group tacacs+
      aaa accounting commands 15 default start-stop broadcast group tacacs+
    2. ASA
      aaa-server TACACS protocol tacacs+
      accounting-mode simultaneous
      exit
      aaa-server TACACS (INSIDE) host [TACACS SERVER IP] timeout 2
      key [TACACS SHARED KEY]aaa authentication enable console TACACS LOCAL
      !aaa authentication http console TACACS LOCAL
      aaa authentication ssh console TACACS LOCAL
      aaa authorization exec authentication-server
      aaa accounting command privilege 15 TACACS
      aaa accounting enable console TACACS
      aaa accounting ssh console TACACS
      !http server enable
      ssh [MGMT IP] [MGMT MASK] INSIDE
  2. Test TACACS from CLI
    test aaa group ACS1 [USERNAME] [PASSWORD] legacy
  3. Test TACACS with SSH
    ssh [SSH SOURCE INTERFACE]

Setup Command Authorization

  1. Create Shell Profile under “Policy Elements > Authorization and Permissions > Device Administration > Command Sets”
    1. Create a Permit All set
      1. Click “Create”
      2. Enter “PERMIT_ALL” for Name
      3. Check “Permit any command that is not in the table below”
      4. Click “Submit”
    2. Create a command set for “show” commands only
      1. Click “Create”
      2. Enter “SHOW_ONLY” for Name
      3. Enter “show” into “Command:” field
      4. Click the “Add^” button
      5. OPTIONALLY: deny “show running-config”
        1. Change “Grant” to “Deny”
        2. Enter “show” into “Command:” field and “running-config” in the “Arguments:” field
        3. Click the “Add^” button
        4. Move it to the top with the up arrow beside the list of commands
      6. Click “Submit”
    3. Create a command set for “show and shut/no shut” commands only
      1. Click “Create”
      2. Enter “SHOW_SHUT_ONLY” for Name
      3. Enter “show” into “Command:” field and click the “Add^” button
      4. Enter “configure” into “Command:” field and “terminal” in the “Arguments:” field
      5. Click the “Add^” button
      6. Enter “interface” into “Command:” field
      7. Click the “Add^” button
      8. Enter “shutdown” into “Command:” field
      9. Click the “Add^” button
      10. Enter “no” into “Command:” field and “shutdown” in the “Arguments:” field
      11. Click the “Add^” button
      12. Enter “end” into “Command:” field
      13. Click the “Add^” button
      14. Enter “exit” into “Command:” field
      15. Click the “Add^” button
      16. Click “Submit”
  2. Modify Command Sets Under “Access Policies > Access Services > DEVICE-ADMIN > Authorization”
    1. Click “Customize”
    2. Below “Customize Results”, add “Command Sets” to “Selected:”
    3. Click OK
    4. Click “Rule-1” (the rule for Privilege 15 Admins)
    5. Under “Command Sets:”, click “Deselect” to remove “DenyAllCommands”
    6. Click “Select”
    7. Check “PERMIT_ALL”
    8. Click “OK”
    9. Do steps “a.” thru “h.” for any other Privilege 15 Admin rules
  3. Modify Rule Authorizations Under “Access Policies > Access Services > DEVICE-ADMIN > Authorization”
    1. Check the box next to the Local Admin Rule (Rule-1)
    2. Click “Duplicate” and click “Duplicate Below”
    3. Name the rule “Noob Status Rule”
    4. Change the Identity group to “Noob Status”
    5. Under “Command Sets:”, click “Deselect” to remove “PERMIT_ALL”
    6. Click “Select”
    7. Check the Command Set you want to apply.
    8. Click “OK”
  4. Switch Setup
    1. 3750
      aaa authorization config-commands
      aaa authorization commands 1 default group tacacs+ if-authenticated
      aaa authorization commands 15 default group tacacs+ if-authenticated
    2. ASA
      aaa authorization command TACACS LOCAL
  5. Test it
    1. SSH into the switch with a Noob Status account
    2. Try commands that should and should not be allowed.

Wired MAB (MAC Authentication Bypass)

  1. Gather all MAC addresses that will need to be added
    1. Categorize by type (workstation, VoIP, Printer, VTC, Thin Client, Taclane, etc.)
    2. Create Identity Group under “Users and Identity Stores > Identity Group”
      1. Create one named “Network Access Group”
      2. Create one for each device type and for “Parent:” choose “Network Access Group”
    3. Create Hosts under “Users and Identity Stores > Internal Identity Stores > Hosts”
      1. Click “Create”
      2. Enter the MAC (Format doesn’t matter, it will convert it)
      3. Enter an accurate description (Building/Rm/Location, Unit, Model, etc)
      4. Select the appropriate Identity Group
      5. Click “Submit”
    4. Create DACLs under “Policy Elements > Authorization and Permissions > Named Permission Objects > Downloadable ACLs”
      1. Create one for each device type
        1. Click “Create”
        2. Enter a descriptive name, Example: “PRINTER_DACL” or “VTC_DACL”
        3. Paste a copied ACL from a switch (to prevent errors) in the “DACL Content” field
          1. OR: To permit all, just enter “permit ip any any”
        4. Click “Submit”
    5. Create Authz Profiles under “Policy Elements > Authorization and Permissions > Network Access > Authorization Profiles”
      1. Create one for each device type
        1. Click “Create”
        2. Enter a descriptive name, Example: “PRINTER_AUTH” or “VTC_AUTH”
        3. Go to the “Common Tasks” tab
        4. Under ACLS, for “Downloadable ACL Name:” select “Static”
        5. For “Value” select the appropriate ACL for the device type.
        6. Click “Submit”
    6. Create the Access Service under “Access Policies > Access Services”
      1. Click “Create”
      2. Enter “NETWORK-ACCESS-WIRED” for Name
      3. Choose “User Selected Service Type” and “Network Access” from the drop-down
      4. Only Check “Identity” and “Authorization”
      5. Click Next
      6. Keep “Process Host Lookup” checked
      7. OPTIONAL: for dot1x, check “EAP-TLS” and “PEAP”.
        1. Additionally check “EAP-MSCHAPv2” under “PEAP”
        2. Check preferred EAP protocol and select “EAP-TLS”
      1. Choose Yes to modify Service Selection Policy – This takes you to the Service Selection rule page
      2. Click “Customize”
      3. Move “NDG:Device Type” to the “Selected:” box
      4. Click “OK”
      5. Click “Create”
      6. Name the Rule “NETWORK-ACCESS-WIRED-RULE”
      7. For “Protocol:” select “Radius”
      8. For “NDG:Device Type” select “Switch”
      9. For “Service:” select “NETWORK-ACCESS-WIRED”
    7. Create identity rules under “Access Policies > Access Services > NETWORK-ACCESS-WIRED > Identity”
      1. For “Identity Source:” choose “Internal Hosts”
      2. OPTIONAL: for dot1x, select “Rule based result selection”
        1. Click “Create”
        2. Name the rule “WIRED-MAB-ID-RULE”
        3. Select “Compound Condition:”
        4. For “Dictionary:” select “RADIUS-IETF”
        5. For “Attribute:” select “Service-Type”
        6. For “Value:” select “Call Check”
        7. Click “Add”
        8. For “Identity Source:” select “Internal Hosts”
        9. Click “OK”
        10. Click “Save Changes”
    8. Create authorization rules under “Access Policies > Access Services > NETWORK-ACCESS-WIRED > Authorization”
      1. Create a rule for each device type
        1. Click “Create”
        2. Name the rule “”
        3. For “Dictionary:” select “RADIUS-IETF”
        4. For “Attribute:” select “Service-Type”
        5. For “Value:” select “Call Check”
        6. Click “Add”
        7. OPTIONAL: if Wireless MAB is to be implemented:
          1. Change “Attribute:” to “NAS-Port-Type”
          2. For “Value:” select “Ethernet”
          3. Click “Add” and select “Add to selected with And”
        8. For “Authorization Profiles:” select the appropriate profile.
        9. Click “OK”
        10. Click the “Default” rule
        11. Click “Select” and choose “DenyAccess”
        12. Click “OK”
        13. Click “Save Changes”

Switch Configuration

  1. AAA and Radius Switch Config
    !--- AAA
    aaa authentication dot1x default group radius
    aaa authorization network default group radius
    aaa accounting dot1x default start-stop group radius
    aaa accounting update periodic 5
    !
    !--- RADIUS SERVER
    radius-server host [ACS SERVER IP]
    radius-server key [SHARED RADIUS KEY]
    radius-server dead-criteria time 30 tries 3
    !--- SEND RADIUS VSA
    radius-server vsa send accounting
    radius-server vsa send authentication
    !--- OTHER RADIUS
    radius-server attribute 6 on-for-login-auth
    radius-server attribute 8 include-in-access-req
    radius-server attribute 25 access-request include
    ip radius source-interface [SOURCE INTERFACE]
    !--- CHANGE OF AUTHORIZATION
    aaa server radius dynamic-author
    client [ACS SERVER IP] server-key [SHARED RADIUS KEY]
    !
    !--- ACL
    ip access-list extende
    
    ip device tracking
    !
    !--- INTERFACE COMMANDS
    interface range [INTERFACE RANGE]
    switchport mode host
    switchport mode access
    switchport access vlan [ACCESS VLAN]
    spanning-tree portfast
    spanning-tree bpduguard enable
    !
    authentication priority mab dot1x
    authentication order mab dot1x
    authentication event fail action next-method
    authentication host-mode multi-auth
    authentication violation restrict
    dot1x pae authenticator
    mab
    dot1x timeout tx-period 10
    authentication port-control auto
    !
    ip access-group ACL-DEFAULT in
    d ACL-DEFAULT
    permit udp any eq bootpc any eq bootps
    permit udp any any eq domain
    deny ip any any log
    ip access-list extended ACL-ALLOW
    permit ip any any
    !
    !--- ENABLE DOT1X
    dot1x system-auth-control

Verifying and Monitoring MAB

  1. Check port on the switch
    1. On old switches: show authentication session [INTERFACE]
    2. On newer switches: show authentication session [INTERFACE] detail
  2. Check DACL on switch
    1. show ip access-list
  3. Check the logs in ACS
    1. Go to “Monitoring and Reports”
    2. Go to “Reports > Catalog > AAA Protocol”
    3. Click “Radius Authentication”
    4. “Username” will be the MAC of the device
    5. Click the Magnifying Glass under “Detail” next to the MAC

Leave a Reply

Your email address will not be published. Required fields are marked *