User Guide for Cisco Secure Access Control Server - Stewing Home

Chapter 9 System Configuration: Authentication and Certificates
Master Key and PAC TTLs
Replication and EAP-FAST
OL-14386-02
About Certification and EAP Protocols
handshake with a CRL or an external database lookup. If PKI Authorization Bypass would be able to
implemented without PAC Free EAP- FAST, the user would be issued a PAC and access to the network
would not be revoked until the PAC expired.
The TTL values for master keys and PACs determine their states, as described in About Master Keys,
page 9-11 and About PACs, page 9-12. Master key and PAC states determine whether someone
requesting network access with EAP-FAST requires PAC provisioning or PAC refreshing.
Table 9-1 summarizes ACS behavior with respect to PAC and master key states.
Table 9-1 Master Key versus PAC States
Master key state PAC active PAC expired
Master key active Phase one succeeds.
Phase one succeeds.
PAC is not refreshed at end of phase two. PAC is refreshed at end of phase two.
Master key retired Phase one succeeds.
Phase one succeeds.
PAC is refreshed at end of phase two.
PAC is refreshed at end of phase two.
Master key expired PAC provisioning is required.
PAC provisioning is required.
If automatic provisioning is enabled, phase zero If automatic provisioning is enabled, phase zero
occurs and a new PAC is sent. The end-user client occurs and a new PAC is sent. The end-user client
initiates a new EAP-FAST authentication request initiates a new EAP-FAST authentication request
using the new PAC.
using the new PAC.
If automatic provisioning is disabled, phase zero If automatic provisioning is disabled, phase zero
does not occur and phase one fails. You must use does not occur and phase one fails. You must use
manual provisioning to give the user a new PAC. manual provisioning to give the user a new PAC.
The Database Replication feature supports the replication of EAP-FAST settings, Authority ID, and
master keys. Replication of EAP-FAST data occurs only if on the:
Database Replication Setup page of the primary ACS, under Send, you have checked the EAP-FAST
master keys and policies check box.
Global Authentication Setup page of the primary ACS, you have enabled EAP-FAST and checked
the EAP-FAST master server check box.
Database Replication Setup page of the secondary ACS, under Receive, you have checked the
EAP-FAST master keys and policies check box.
Global Authentication Setup page of the secondary ACS, you have enabled EAP-FAST and
unchecked the EAP-FAST master server check box.
EAP-FAST-related replication occurs for three events:
Generation of master keys—A primary ACS sends newly generated active and backup master keys
to secondary ACSs. This event occurs immediately after master key generation, provided that you
configure the replication properly and it is not affected by replication scheduling on the Database
Replication Setup page.
User Guide for Cisco Secure Access Control Server 4.2
9-17