User Guide for Cisco Secure Access Control Server - Stewing Home

Chapter 14 Network Access Profiles
Protocol Configuration for NAPs
Authentication Protocols
OL-14386-02
These topics describe how to configure authentication protocols for NAPs:
Authentication Protocols, page 14-23
Agentless Request Processing, page 14-24
EAP Configuration for NAPs, page 14-25
EAP-FAST with Posture Validation, page 14-25
EAP Authentication with RADIUS Key Wrap, page 14-25
Configuring Protocols, page 14-26
Configuring Policies for Profiles
You can configure all relevant parameters for authentication protocols for your NAPs. These parameters
are applied during access request processing.
Populating Protocol Setting with ACS Global Settings
You can populate the protocol settings with the ACS global settings, and then customize them. This
method facilitates configuring the protocol settings each time you set up a new profile.
Global Authentication Setup serves as a central location for all of the EAP configuration settings in the
active or inactive profiles. You cannot enable EAP types in an ACS profile, which are disabled in the
Global Authentication Page. Every EAP type that is unchecked in the Global Authentication Page will
automatically be unchecked in all ACS (active and inactive) profiles. Options that are not available in
the Global Authentication Setup page, are unchecked in the Protocol Settings page after populating from
the Global Authentication Setup page.
To apply global settings: Click Populate from Global to apply authentication settings that were set in
the System Configuration > Global Authentication Setup window. For more information, see
Configuring Authentication Options, page 9-21.
We recommend that you check all authentication protocols in the Global Authentication Setup for NAC.
The following authentication protocols, listed from weakest to most secure, can be configured:
RADIUS Authentication protocols allow or disallow authentication by using:
– Password Authentication Protocol (PAP) protocol.
– CHAP password protocol.
– MS-CHAPv1 password protocol.
– MS-CHAPv2 password protocol.
– Agentless Request Processing. For more information, see Agentless Request Processing,
page 14-24.
– An option to allow or disallow a set of EAP types (outer and inner) to be used for EAP
authentication, including the relevant setting for each EAP-type. See EAP Configuration for
NAPs, page 14-25, for more information.
You can configure the following EAP protocols:
– PEAP
– EAP-FAST
User Guide for Cisco Secure Access Control Server 4.2
14-23