Cisco Secure ACS for Windows Architecture
Cisco Secure ACS is modular and flexible to fit the needs of both simple and large networks. Cisco Secure ACS for Windows operates as a set of Windows 2000 services and controls the AAA, for users accessing networks.
When you install Cisco Secure ACS on your server, the installation adds several Windows services. These services provide the core of the Cisco Secure ACS functionality and are as follows:
• CSAdmin Provides the HTML interface for administration of Cisco Secure ACS
• CSAuth Provides authentication and authorization services
• CSDBSync Provides synchronization of the Cisco Secure user database with an external RDBMS application
• CSLog Provides logging services, both for accounting and system activity
• CSMon Provides monitoring, recording, and notification of Cisco Secure ACS performance, and includes automatic response to some scenarios
• CSTacacs and CSRadius Provides communication between RADIUS or TACACS+ AAA clients and the CSAuth service Figure 9-5 shows the cores services in the Cisco ACS for Windows.
CSAdmin
CSAdmin provides the web server for the Cisco Secure ACS HTML interface. After installing Cisco Secure ACS, you must configure it from its HTML interface; therefore, CSAdmin must be running when you configure Cisco Secure ACS.
Cisco Secure ACS has a built-in web server for ACS administration. The web server uses port 2002 rather than the standard port 80 usually associated with HTTP traffic. CSAdmin is multithreaded, which enables several Cisco Secure ACS administrators to access it at the same time. Therefore, CSAdmin is well-suited for distributed, multiprocessor environments.
Figure 9-5. Core Services of Cisco ACS for Windows
[View full size image]
Figure 9-5. Core Services of Cisco ACS for Windows
[View full size image]
CSAuth
CSAuth is the authentication and authorization service. It permits or denies access to users by processing authentication and authorization requests. CSAuth determines whether access should be granted and defines the privileges for a particular user. It is the Cisco Secure ACS database manager.
To authenticate users, Cisco Secure ACS can use the internal user database or one of many external databases. When a request for authentication arrives, Cisco Secure ACS checks the database that is configured for that user. If the user is unknown, Cisco Secure ACS checks the database configured for unknown users.
When a user has authenticated, Cisco Secure ACS obtains a set of authorizations from the user profile and the group to which the user is assigned. This information is stored with the username in the Cisco Secure user database. Some of the authorizations included are the services to which the user is entitled, such as IP over PPP, IP pools from which to draw an IP address, access lists, and password-aging information. The authorizations, with the approval of authentication, are then passed to the CSTacacs or CSRadius modules to be forwarded to the requesting device.
CSDBSync
CSDBSync is the service used to synchronize the Cisco Secure ACS database with third-party RDBMSs. CSDBSync synchronizes AAA client, AAA server, network device groups, and proxy table information with data from a table in an external relational database.
CSLog
CSLog is the service used to capture and place logging information. CSLog gathers data from the RADIUS or TACACS+ packet and CSAuth and then manipulates the data to be placed into the CSV files. CSV files can be imported into spreadsheets that support this format.
CSMon
CSMon is a service that helps minimize downtime in a remote-access network environment. It provides monitoring, recording, and notification of Cisco Secure ACS performance and includes automatic responses to some scenarios. CSMon works for both RADIUS and TACACS+ and automatically detects which protocols are in use. You can use the Cisco Secure ACS HTML interface to configure the CSMon service. The Cisco Secure ACS Active Service Management feature provides the options for configuring CSMon behavior.
CSTacacs and CSRadius
The CSTacacs and CSRadius services communicate between the CSAuth module and the access device that is requesting authentication and authorization services. CSTacacs is used to communicate with TACACS+ devices and CSRadius to communicate with RADIUS devices. Both services can run at the same time. When only one security protocol is used, only the applicable service needs to be running; however, the other service does not interfere with normal operation and does not need to be disabled. However, for improved security, it is recommended that all unnecessary ports are disabled.
Continue reading here: Do I Know This Already Quiz Uml
Was this article helpful?