User Guide for Cisco Secure Access Control Server - Stewing Home

Advanced System Configuration Pages Reference
Field Description
Accept client on authenticated
provisioning
Require client certificate for
provisioning
When receiving client
certificate, select one of the
following lookup methods:
9-46
User Guide for Cisco Secure Access Control Server 4.2
Chapter 9 System Configuration: Authentication and Certificates
This option is only available when the allow authenticated in-band PAC provisioning
option is selected. The server always sends an Access-Reject at the end of the
provisioning phase, forcing the client to reauthenticate using the tunnel PAC. This option
enables ACS to send an Access-Accept to the client at the end of the provisioning phase.
Allows provisioning PACs based on certificates only. Other inner EAP methods for PAC
provisioning are not allowed. If the client does not present its certificate during the first
TLS handshake, the server initiates a TLS renegotiation. The renegotiation requests the
client to start a new TLS handshake; the cipher that was negotiated in the first handshake
protects it. During the second TLS handshake, the server requests the client 's certificate.
If the certificate is not sent, the handshake fails and the user is denied access.
If you choose more than one comparison type, ACS performs the comparisons in the
order listed. If the one comparison type fails, ACS attempts the next enabled comparison
type. Comparison stops after the first successful comparison. The two types of
comparison are:
Certificate SAN comparison—Verifies user identity by comparing the name in the
Subject Alternative Name field of the end-user certificate to the username in the
applicable user database, check this check box.
Certificate CN comparison—Verifies user identity by comparing the name in the
Common Name field of the end-user certificate to the username in the applicable
user database, check this check box.
Allow Machine Authentication ACS provisions an end-user client with a machine PAC and performs machine
authentication (for end-user clients who do not have the machine credentials). The
machine PAC can be provisioned to the client by request (in-band) or by administrator
(out-of-band). When ACS receives a valid machine PAC from the end-user client, the
machine identity details are extracted from the PAC and verified in the ACS database or
external databases. After these details are correctly verified, no further authentication is
performed.
Note After performing machine authentication and when the Required or Posture
Only check boxes are checked, ACS also requests the posture credentials.
Machine PAC TTL Enter a value for the amount of time that a machine PAC is acceptable for use. When ACS
receives an expired machine PAC, it automatically reprovisions the end-user client with
a new machine PAC (without waiting for a new machine PAC request from the end-user
client).
Allow Stateless session resume Uncheck this option:
If you do not want ACS to provision authorization PACs for EAP-FAST clients.
To always perform phase two of EAP-FAST.
Authorization PAC TTL This option determines the expiration time of the user authorization PAC. When ACS
receives an expired authorization PAC, Allow Stateless session resume fails and,
therefore, phase two EAP-FAST authentication is performed.
OL-14386-02