User Guide for Cisco Secure Access Control Server - Stewing Home

Configuring Policies for Profiles
14-24
User Guide for Cisco Secure Access Control Server 4.2
Chapter 14 Network Access Profiles
– EAP-Transport Layer Security (TLS) with or without RADIUS Key Wrap. See EAP
Authentication with RADIUS Key Wrap, page 14-25, for more information.
– EAP-Message Digest 5 (MD5)
The protocols that you select determine the flexibility of negotiation. The final result is to determine
which protocol to use to authenticate. For more information about protocols, see About Certification and
EAP Protocols, page 9-1.
Note LEAP (EAP-Cisco Wireless) is not supported when working with Network Access Profiles.
Agentless Request Processing
Agentless Request Processing, is an identity-based network security feature that is configured on a port
basis. A switch makes a RADIUS request to ACS with the MAC (Media Access Control) address of the
endhost connecting to the switch. Agentless authentication happens on the switch or device as a fallback
that results from a 802.1x failure or an EAPoUDP failure, and hence bypasses these mechanisms. This
feature is useful for allowing network access for hosts without 802.1x or EAPoUDP support. For
example, devices such as printers or terminals that do not have an 802.1x client can use this feature to
access to the network.
You can use this feature to map MAC addresses to user groups. You can use a configured LDAP server
or the internal ACS Database to authenticate MAC address user requests. ACS uses the LDAP server to
look up MAC addresses and to retrieve LDAP group attributes for MAC addresses. If the MAC addresses
exist in the LDAP Server, ACS maps the LDAP Group to the ACS Groups configured in the configured
ACS External LDAP Database. ACS accepts any of the MAC address standard formats. If the list of
defined addresses does not contain a MAC address, you can associate a fallback user group with the
access request. Groups can be included in the profile’s authorization policy and then be evaluated for
network admission based on authorization rules.
For information about configuring the LDAP external database for agentless requests see Configuration
Guide for Cisco Secure ACS Release 4.2.
The MAC address is sent in the Calling-Station-ID RADIUS attribute. ACS identifies an Agentless
Request in this manner:
Service-Type = 10 (Call Check)
If the Allow Agentless Request Processing option is not enabled, MAC address authentication is not
applied and the access request is rejected.
ACS supports the following three standard formats for representing MAC-48 addresses in
human-readable form:
Six groups of two hexadecimal digits, separated by hyphens (-) in transmission order, for example,
01-23-45-67-89-ab.
Six groups of two separated by colons (:), for example, 01:23:45:67:89:ab.
Three groups of four hexadecimal digits separated by dots (.), for example, 0123.4567.89ab.
An Error alert appears for invalid MAC addresses. MAC addresses are presented in one format regardless
of the format in which they were entered into ACS.
To process agentless requests, Allow Agentless Request Processing must be enabled in the Protocols
Settings for profile_name Page, page 14-43. You must also define settings in the Authentication for
profile_name Page, page 14-46. You choose which configured database to use to authenticate a MAC
address user request, and define the default mapping for MAC addresses that do not match.
OL-14386-02