Overview
Q. What is Cisco® Secure Access Control Server Express 5.0 (Cisco Secure ACS Express)?
A. Cisco Secure ACS Express is an entry-level RADIUS and TACACS+ authentication, authorization, and accounting (AAA) server for retail branch, enterprise branch office deployments and small-medium-sized businesses (SMBs) with fewer than 350 users and 50 devices.
Cisco Secure ACS Express controls user and machine access to various networks including wireless, wired, and virtual private networks. Cisco Secure ACS Express also controls administrative access to network devices using RADIUS and TACACS+.
Q. Is Cisco Secure ACS Express a software or a hardware product?
A. Cisco Secure ACS Express is available on a Cisco hardware appliance that is preloaded with Cisco Secure ACS Express 5.0. For more details on the hardware specifications, please refer to the data sheet at http://www.cisco.com/go/acsexp.
Q. How is Cisco Secure ACS Express positioned in comparison to Cisco Secure ACS for Windows (ACS Windows) and Cisco Secure ACS Solution Engine (ACS SE)?
A. ACS Windows and ACS SE are for customers who need a highly scalable access control solution that spans multiple sites. The feature set is catered to the enterprise deployments and includes but is not limited to support for Network Admission Control (NAC), device command authorization, command-line interface (CLI) views, integration with CiscoWorks management applications, and support for Cisco Security Monitoring, Analysis, and Response System (MARS).
For a detailed feature set, please refer to the ACS Windows and ACS SE data sheets at http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_data_sheets_list.html.
Cisco Secure ACS Express is well suited for deployments that need an access control solution for fewer than 350 users and 50 devices. This product is intended to serve small to medium-sized businesses, retail sites and enterprise branch offices where customers need an easy-to-use GUI yet require a comprehensive but simple feature set and a lower price point to address their specific deployment needs.
For a detailed feature set, please refer to the Cisco Secure ACS Express data sheet at http://www.cisco.com/go/acsexp.
In summary, ACS Windows and ACS SE cater to enterprise-class deployments that need a highly scalable AAA server. Cisco Secure ACS Express is positioned to cater to smaller deployments that need AAA services.
Q. What deployments is Cisco Secure ACS Express best suited for?
A. Cisco Secure ACS Express can be deployed at the following:
• Enterprise branch
• Retail sites
• Small and medium-sized businesses
Enterprise Branch
Large enterprises are likely to have a centralized AAA deployment that manages the various regions within a corporate network. User and machine identities within the enterprise may be stored in centralized user databases, such as Active Directory.
Such large enterprises might have several branch sites that need to mitigate adverse impacts of a WAN outage by having a local AAA server present at that site. For that purpose, a single or a pair of Cisco Secure ACS Express servers may be deployed that are configured to authenticate users and machines against the centralized user database. Alternatively, the branch site may deploy a user database, such as Active Directory, at a local site to work around any dependency on a central site for user management.
Retail Branch
Cisco Secure ACS Express can be deployed within retail organizations that require a local AAA server in each of their retail branches for various reasons including but not limited to WAN independence, localized access policies, and decentralized user repositories.
Small and Medium-Sized Businesses
Cisco Secure ACS Express can be deployed at businesses that have a few hundred users across one or multiple sites. In this instance, Cisco Secure ACS Express could be used to control access for wireless, wired, remote access, and device administration deployments, similar to what an enterprise-class AAA server would do in larger deployments but customized from a usability, feature, deployment size, and price point of view.
Q. Can I migrate to Cisco Secure ACS Express from ACS Windows or ACS SE?
A. No. Migration from ACS Windows or ACS SE is not supported.
Q. Can I upgrade to ACS Windows or ACS SE from Cisco Secure ACS Express?
A. No. This upgrade is currently not supported.
Q. Does Cisco Secure ACS Express require any licensing?
A. Cisco Secure ACS Express supports 50 network devices and 350 unique logins in a 24-hour period. No additional licensing is available or required.
For more details on this, please refer to the product guide at http://www.cisco.com/go/acsexp.
Features and Protocol Support
Q. What network access gateways does Cisco Secure ACS Express support?
A. Cisco Secure ACS Express supports a broad set of networking access products, including Cisco IOS® routers, VPN and firewall access products such as VPN concentrators and the ASA, voice-over-IP (VoIP) solutions, Cisco Wireless LAN controllers and access points, storage networks, and 802.1x-enabled Cisco Catalyst® switches.
For more details, refer to the product guide at http://www.cisco.com/go/acsexp.
Q. What protocols does Cisco Secure ACS Express support?
A. Cisco Secure ACS Express supports the protocols listed in Table 1.
Table 1. Protocols Supported by Cisco Secure ACS Express
Q. What ports does Cisco Secure ACS Express use?
A. Cisco Secure ACS Express responds to the following incoming ports/services when it is operational:
• RADIUS: User Datagram Protocol (UDP)/1645, UDP/1812, UDP/1646, UDP/1813 (in)
• Replication: UDP/1645 (in-out)
• TACACS+: TCP/49 (in)
• HTTPS/443 (in)
• Secure Shell (SSH) Protocol/22 (in)
• Internet Control Message Protocol (ICMP) (in-out)
• Simple Network Management Protocol (SNMP)/161 (in-out)
• Secure FTP (SFTP)/22 (out)
• Simple Network Time Protocol (SNTP)/123 (out)
• Lightweight Directory Access Protocol (LDAP)/389 (out)
• Active Directory: LDAP/389, Kerberos/88, Kerberos password change/464, Global Catalog/3268 (out)
• RSA OTP Software Development Kit (SDK): 5500 (out)
• FTP/21 (out)
• Syslog UDP/514 (out)
• Simple Mail Transfer Protocol (SMTP)/465 (out)
Q. How does Cisco Secure ACS Express handle authentication?
A. Cisco Secure ACS Express uses authentication to verify an individual's identity during a login attempt. Cisco Secure ACS Express uses the following authentication methods:
• Credential source
• Machine authentication
Credential Source
Cisco Secure ACS Express supports the use of a local database, an external token server, LDAP, and Active Directory as credential sources based on network access profiles. Cisco Secure ACS Express also supports the use of token server using proxy RADIUS.
Machine Authentication
Machine authentication enables a client machine to authenticate itself using the identity and credentials of the computer to Cisco Secure ACS Express. Cisco Secure ACS Express supports only Windows Machine Authentication against Active Directory.
Cisco Secure ACS Express supports machine authentication configuration for the protocols listed in Table 2.
You configure the outer and inner EAP methods using the GUI.
Table 2. Supported Machine Authentication Protocols
As part of the certificate setup, you have to install the server certificate for Cisco Secure ACS Express and enable autoenrollment on Active Directory for the client machine to obtain a machine certificate. Server certificates can be requested using either the Windows Certification Authority or OPENSSL1 utilities.
Q. What authorization policies does Cisco Secure ACS Express make available?
A. Cisco Secure ACS Express supports the authorization policies listed in Table 3.
Table 3. Cisco Secure ACS Express Authorization Policies
Q. What password policies does Cisco Secure ACS Express provide for internal users?
A. Cisco Secure ACS Express supports the password policies for internal users listed in Table 4.
Table 4. Cisco Secure ACS Express Password Policies for Internal Users
Q. Can I use Cisco Secure ACS Express for high availability?
A. Yes, Cisco Secure ACS Express supports high availability between a Cisco Secure ACS Express pair.
This allows customers to achieve redundancy if one Cisco Secure ACS Express server is unavailable from a network device point of view.
Q. If I need to deploy Cisco Secure ACS Express across more than two sites, how would I distribute my configuration?
A. Cisco Secure ACS Express provides a mechanism to export configurations that can be modified and imported back to the same Cisco Secure ACS Express or another Cisco Secure ACS Express in the network. Customers can use the CLI to export a configuration file, make changes as desired per site, and import the configuration into the destination Cisco Secure ACS Express server.
Q. We have an existing back-end database where our user repository resides. Would I be able to integrate with it?
A. Yes, Cisco Secure ACS Express supports Microsoft Active Directory, LDAP, and OTP servers.
For more details, please refer to the users guide at http://www.cisco.com/go/acsexp.
Q. Does Cisco Secure ACS Express support Active Directory natively or is integration required?
A. Cisco Secure ACS Express allows users to authenticate against Active Directory seamlessly. There is no need to install or configure any agent on either the Cisco Secure ACS Express appliance or any other server to interact with Active Directory.
Administration
Q. What administrative features are available within Cisco Secure ACS Express?
A. Table 5 lists the administrative features in Cisco Secure ACS Express.
Table 5. Cisco Secure ACS Express Administrative Features
Q. What password policies are available for ACS view administrators?
A. Cisco Secure ACS Express provides a password policy applicable to ACS administrators. The policy is made up of rules that define the password complexity and password lockout.
Table 6 highlights that policy.
Table 6. Cisco Secure ACS Express Password Policy for ACS Administrators
Q. Can ACS Express be upgraded remotely?
A. Cisco Secure ACS Express can be upgraded and patched remotely. This helps enable administrators to remotely manage Cisco Secure ACS Express deployments.
Q. What reports are available within the product?
A. Cisco Secure ACS Express provides the following reports:
• Usage Summary Report
• Authentication Report
• Device Commands Report
• Accounting Logs
For more details on each of these reports, please refer to the user guide at http://www.cisco.com/go/acsexp.
Ordering Information
Q. How do I order Cisco Secure Access Control Server Express 5.0?
A. You can order Cisco Secure ACS Express 5.0 through your regular purchasing channels by ordering part number CSACS-5.0-EXP-K9.
1This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. For more details please visit the following website: http://www.openssl.org/