Support For Cisco Device-Management Applications - Cisco 2509 - Router - EN User Manual

Chapter 1 Overview of Cisco Secure ACS
AAA Server Functions and Concepts
group, you can configure a network access restriction set in the Shared Profile
Components section of the HTML interface, and then configure each group to use
the network access restriction set you created.
For information about the types of shared profile components supported by
Cisco Secure ACS, see About Shared Profile Components, page 5-1.

Support for Cisco Device-Management Applications

Cisco Secure ACS supports Cisco device-management applications, such as
Management Center for PIX Firewall, by providing command authorization for
network users who are using the management application to configure managed
network devices. Support for command authorization for management application
users is accomplished by using unique command authorization set types for each
management application configured to use Cisco Secure ACS for authorization.
Cisco Secure ACS uses TACACS+ to communicate with management
applications. For a management application to communicate with
Cisco Secure ACS, the management application must be configured in
Cisco Secure ACS as a AAA client that uses TACACS+. Also, you must provide
the device-management application with a valid administrator name and
password. When a management application initially communicates with
Cisco Secure ACS, these requirements ensure the validity of the communication.
For information about configuring a AAA client, see AAA Client Configuration,
page 4-11. For information about administrator accounts, see Administrator
Accounts, page 10-1.
Additionally, the administrator used by the management application must have the
Create New Device Command Set Type privilege enabled. When a management
application initially communicates with Cisco Secure ACS, it dictates to
Cisco Secure ACS the creation of a device command set type, which appears in
the Shared Profile Components section of the HTML interface. It also dictates a
custom service to be authorized by TACACS+. The custom service appears on the
TACACS+ (Cisco IOS) page in the Interface Configuration section of the HTML
interface. For information about enabling TACACS+ services, see Protocol
Configuration Options for TACACS+, page 3-7. For information about device
command-authorization sets for management applications, see Command
Authorization Sets, page 5-13.
After the management application has dictated the custom TACACS+ service and
device command-authorization set type to Cisco Secure ACS, you can configure
command-authorization sets for each role supported by the management
User Guide for Cisco Secure ACS for Windows Server
1-18
78-14696-01, Version 3.1