User Guide for Cisco Secure Access Control Server - Stewing Home

Chapter 9 System Configuration: Authentication and Certificates
Generating PAC Files
OL-14386-02
EAP-FAST PAC Files Generation (ACS SE)
Note We recommend that you use a password that you devise rather than the default password.
– Default password—ACS uses the default password to protect the PAC files that it generates.
Note We recommend that you use a password you devise rather than the default password.
– This password—ACS uses the password specified, rather than the default password, to protect
the PAC files it generates. The password that you specify is required when the PACs that ACS
protects are loaded into an EAP-FAST end-user client.
PAC passwords are alphanumeric, between 4 and 128 characters long, and case sensitive. While
ACS does not enforce strong password rules, we recommend that you use a strong password,
that is, your PAC password should:
– Be very long.
– Contain uppercase and lowercase letters.
– Contain numbers in addition to letters.
– Contain no common words or names.
Each time you instruct ACS to generate PAC files, ACS produces a single cabinet file named
PACFiles.cab that you download to a location available to the browser that you use to access the HTML
interface. Use the file compression utility of your choice to extract the .pac files from the PACFiles.cab
file. For example, WinZip can extract files from cabinet files.
Before You Begin
With ACS you can generate PAC files only if EAP-FAST is enabled. For information about enabling
EAP-FAST, see Enabling EAP-FAST, page 9-19.
Determine which users for which you want to generate PAC files. If you want to specify the users in a
text file, create the text file and place it in a directory under the FTP root directory on an FTP server that
is accessible from the ACS SE. For information about using a username list, see PAC File Generation
Options, page 9-37.
For information about the options on the EAP-FAST PAC Generation page, see PAC File Generation
Options, page 9-37.
To generate PAC files:
Step 1 In the navigation bar, click System Configuration.
Step 2 Click EAP-FAST PAC Files Generation.
ACS displays the EAP-FAST PAC Files Generation page.
Step 3 Use one of the four options to specify for which users ACS should generate PAC files. For more
information about the significance of the options, see PAC File Generation Options, page 9-37.
Note If you choose to generate PAC files for all users in the ACS internal database in a specific group,
the CSAuth service restarts. No user authentication occurs while CSAuth is unavailable.
User Guide for Cisco Secure Access Control Server 4.2
9-39