User Guide for Cisco Secure Access Control Server - Stewing Home

Windows User Database
12-20
User Guide for Cisco Secure Access Control Server 4.2
Chapter 12 User Databases
– Enable EAP-TLS machine authentication—This check box controls whether ACS performs
machine authentication by using a machine name and password with EAP-TLS. For more
information about machine authentication, see Machine Authentication, page 12-10.
– Enable machine access restrictions— This box determines whether ACS uses machine
authentication as a condition for user authorization. The following protocols are supported for
machine authentication: Microsoft PEAP EAP-TLS, EAP-FAST v1a, Cisco PEAP-TLS. If one
of these protocols is used for machine authentication, the settings for MAR do not effect the
user authentication. If a user tries to access the network with a computer that failed machine
authentication, or with another protocol that does not support machine authentication,
authorizations are implemented according to the machine access restriction configuration. For
more information about the MAR feature, see Machine Access Restrictions, page 12-12.
Note Users that are authenticated through dial-up will always be treated according to the MAR
configuration, since there is no machine authentication when using dial up. A user will be
mapped to a specific group, as defined in the External User Databases > Database Group
Mappings > Windows Database settings, when machine authentication occurs. If group
mapping is not configured, the user will be mapped to the default group.
Tip To enable machine access restrictions, you must specify a number greater than zero (0) in the
Aging time (hours) box.
– Aging time (hours)—This box specifies the number of hours that ACS caches IETF RADIUS
Calling-Station-Id attribute values from successful machine authentications, for use with the
MAR feature. The default value is 12 hours, which means that ACS does not cache
Calling-Station-Id values.
Note If you do not change the value of the Aging time (hours) box to something other than
zero (0), all EAP-TLS and Microsoft PEAP users whose computers perform machine
authentication are assigned to the group that is specified in the Group map for
successful user authentication without machine authentication list.
Tip To clear the cache of Calling-Station-Id values, type zero (0) in the Aging time (hours) box and click
Submit.
– Group map for successful user authentication without machine authentication—This list
specifies the group profile that ACS applies to a user who accesses the network from a computer
that has not passed machine authentication for longer than the number of hours specified in the
Aging time (hours) box. To deny such users any access to the network, select
(which is the default setting).
Note User profile settings always override group profile settings. If a user profile grants an
authorization that is denied by the group that is specified in the Group map for
successful user authentication without machine authentication list, ACS grants the
authorization.
OL-14386-02