Database Search Order; Configuring The Unknown User Policy - Cisco 2509 - Router - EN User Manual

Chapter 12 Administering External User Databases

Database Search Order

Configuring the Unknown User Policy

78-14696-01, Version 3.1
Selected Databases—Lists the external user databases that
•
Cisco Secure ACS uses to authenticate an unknown user (if the Check the
following external user databases option is selected). Cisco Secure ACS
attempts authentication using the selected databases one at a time in the order
specified. For more information about the significance of the order of selected
databases, see Database Search Order, page
For more information about configuring your Unknown User Policy, see
Configuring the Unknown User Policy, page
You can configure the order in which Cisco Secure ACS checks the selected
external databases when Cisco Secure ACS attempts to authenticate unknown
users. If the first database in the Selected Databases list fails the authentication
request for the unknown user, Cisco Secure ACS checks the next database listed,
and so on down the Selected Databases list, in the order listed, until the user
authenticates or until Cisco Secure ACS has tried all the databases listed.
Authentication with a Windows NT/2000 database is more complex. (For more
information about Windows NT/2000 authentication, see
Authentication Process with Windows NT/2000 User Databases, page
Cisco Secure ACS does not find the user in any of the listed databases,
authentication fails.
The order in which the databases appear in the Selected Databases list is
important. To determine how to order databases in the Selected Databases list,
follow these recommendations:
Place databases that will allow most authentications to succeed as near to the
•
top of the list as possible.
• Place databases associated with particularly time-sensitive AAA clients or
authentication protocols as near to the top of the list as possible.
For example, if wireless LAN users access your network with PEAP, arrange
the databases in the Selected Databases list so that unknown user processing
takes less than the timeout value specified on the Cisco Aironet Access Point.
In Cisco Secure ACS, an unknown user is defined as a user for whom no account
has been created within the Cisco Secure ACS database.
12-9.
User Guide for Cisco Secure ACS for Windows Server
Unknown User Processing
12-9.
The Cisco Secure ACS
11-9.) If
12-9