Filter
Top Products
9-4
Configuration Guide for Cisco Secure ACS 4.2
OL-14390-02
Chapter 9 NAC Configuration Scenario
Step 2: Perform Network Configuration Tasks
Step 5 In the Shared Secret box, type a shared secret key for the AAA client.
The shared secret is a string that you determine; for example, mynet123. The shared secret must be
identical on the AAA client and ACS. Keys are case sensitive. If the shared secrets do not match, ACS
discards all packets from the network device.
Step 6 If you are using NDGs, from the Network Device Group list, choose the name of the NDG to which this
AAA client should belong, or, click Not Assigned to set this AAA client to be independent of NDGs.
Step 7 Type the shared secret keys for RADIUS Key Wrap in EAP-TLS authentications.
Each key must be unique, and must also be distinct from the RADIUS shared key. You can configure
these shared keys for each AAA client, as well as for each NDG. The NDG key configuration overrides
the AAA client configuration. If the key entry is null, ACS uses the AAA client key. You must enable
the Key Wrap feature in the NAP Authentication Settings page to implement these shared keys in
EAP-TLS authentication:
a. Key Encryption Key (KEK)—Used for encryption of the Pairwise Master Key (PMK). The
maximum length is 20 characters.
b. Message Authenticator Code Key (MACK)—Used for the keyed hashed message authentication
code (HMAC) calculation over the RADIUS message. The maximum length is 16 characters.
c. Key Input Format—Click the format of the key, ASCII or hexadecimal strings (the default
is
ASCII).
Step 8 From the Authenticate Using list, choose RADIUS (IOS/PIX).
Step 9 Specify additional AAA client settings as required.
Step 10 Click Submit + Apply.
Configure the AAA Server
Your AAA server is automatically populated during the installation of ACS, using the hostname assigned
to Windows 2003 system. You must specify some additional configuration information to enable the
server to communicate with AAA clients.
To configure the AAA server:
Step 1 In the navigation bar, click Network Configuration.
The Network Configuration page opens.