Filter
Top Products
2-4
Configuration Guide for Cisco Secure ACS 4.2
OL-14390-02
Chapter 2 Deploy the Access Control Servers
Determining the Deployment Architecture
Figure 2-2 ACS in a Campus LAN
Figure 2-2 shows a possible distribution of ACS in a wired campus LAN. In this campus LAN, buildings
are grouped into three segments. Each segment consists of 1 to 3 buildings and all the buildings in the
segment are on a common LAN. All interbuilding and intersegment network connections use
one-gigabyte fiber-optic technology. Primary network access is through switch ports over wired
Ethernet.
You use ACS to provide RADIUS authentication for the network access servers, and you configure it to
use an external database. One ACS is deployed for each segment of 5 to 10 buildings. A Cisco
LocalDirector content switch is placed before each ACS for load balancing and failover.
Geographically Dispersed Wired LAN
In a larger network that is geographically dispersed, speed, redundancy, and reliability are important in
determining whether to use a centralized ACS service or a number of geographically dispersed ACS
units. As with many applications, AAA clients rely on timely and accurate responses to their queries.
Network speed is an important factor in deciding how to deploy ACS; because delays in authentication
that the network causes can result in timeouts at the client side or the switch.
A useful approach in large extended networks, such as for a globally dispersed corporation, is to have at
least one ACS deployed in each major geographical region. Depending on the quality of the WAN links,
these servers may act as backup partners to servers in other regions to protect against failure of the ACS
in any particular region.
Figure 2-3 shows ACS deployed in a geographically dispersed wired LAN. In the illustration, Switch 1
is configured with ACS 1 as its primary AAA server but with ACS 2 of Region 2 as its secondary. Switch
2 is configured with ACS 2 as its primary but with ACS 3 as its secondary. Likewise, Switch 3 uses ACS
3 as its primary but ACS 1 as its secondary. Using a local ACS as the primary AAA server minimizes
AAA WAN traffic. When necessary, using the primary ACS from another region as the secondary further
minimizes the number of ACS units.
Remote office
Segment 3
Internet
A
A
A
Segment 1
Segment 2
158308