User Guide for Cisco Secure Access Control Server - Stewing Home

About Certification and EAP Protocols
9-18
User Guide for Cisco Secure Access Control Server 4.2
Chapter 9 System Configuration: Authentication and Certificates
Manual replication—All EAP-FAST components that can be replicated are replicated if you click
Replicate Now on the Database Replication Setup page of the primary ACS. Some of the replicated
components are configurable in the web interface. Table 9-2 shows whether an EAP-FAST
component is replicated or configurable.
Note EAP-FAST replication is not included in scheduled replication events.
Changes to EAP-FAST settings—If, on a primary ACS, you change any EAP-FAST configurable
components that are replicated, ACS begins EAP-FAST replication. Whether an EAP-FAST
component is replicated or configurable is detailed in Table 9-2.
The Database Replication log on the primary ACS records replication of master keys. Entries related to
master key replication contain the text MKEYReplicate.
Table 9-2 EAP-FAST Components and Replication
EAP-FAST Component Replicated? Configurable?
EAP-FAST Enable No Yes, on the Global Authentication Setup page.
Master key TTL Yes Yes, on the Global Authentication Setup page.
Retired master key TTL Yes Yes, on the Global Authentication Setup page.
PAC TTL Yes Yes, on the Global Authentication Setup page.
Authority ID Yes No, generated by ACS.
Authority ID info Yes Yes, on the Global Authentication Setup page.
Client initial message Yes Yes, on the Global Authentication Setup page.
Master keys Yes No, generated by ACS when TTL settings dictate.
EAP-FAST master server No Yes, on the Global Authentication Setup page.
Actual EAP-FAST server status No No, determined by ACS.
The EAP-FAST master server setting has a significant effect on EAP-FAST authentication and
replication:
Enabled—When you check the EAP-FAST master server check box, the Actual EAP-FAST server
status is Master and ACS ignores the EAP-FAST settings, Authority ID, and master keys it receives
from a primary ACS during replication, preferring instead to use master keys that it generates, its
unique Authority ID, and the EAP-FAST settings that are configured in its web interface.
Enabling the EAP-FAST master server setting requires providing a PAC from the primary ACS that
is different than the PAC from the secondary ACS for the end-user client. Because the primary and
secondary ACSs send different Authority IDs at the beginning of the EAP-FAST transaction, the
end-user client must have a PAC for each Authority ID. A PAC that the primary ACS generates is
not accepted by the secondary ACS in a replication scheme where the EAP-FAST master server
setting is enabled on the secondary ACS.
Tip In a replicated ACS environment, use the EAP-FAST master server feature in conjunction with
disallowing automatic PAC provisioning to control EAP-FAST access to different segments of
your network. Without automatic PAC provisioning, users must request PACs for each network
segment.
OL-14386-02