User Guide for Cisco Secure Access Control Server - Stewing Home

Chapter 14 Network Access Profiles
Table 14-23 Protocols and EAP Configuration Page
OL-14386-02
Network Access Profiles Pages Reference
Option Description
Allow Stateless session resume When enabled, ACS provisions authorization PACs for EAP-FAST clients and
always perform phase two of EAP-FAST (default = enabled).
When receiving client certificate, select
one of the following lookup methods
Authorization PAC TTL —Determines the
expiration time of the user authorization PAC. When ACS receives an expired
authorization PAC, it performs phase two EAP-FAST authentication.
Certificate SAN Lookup—Choose to lookup the certificate based on the Subject
Alternative Name field in the client certificate.
Certificate CN Lookup—Choose to look up the certificate base on the Common
Name field in the client certificate.
Do not use PACs When enabled, determines whether ACS runs EAP-FAST but does not issue or
accept any tunnel or machine PACs. All requests for PACs are ignored and ACS
responds with a Success-TLV without a PAC. All the relevant PAC options are
disabled if this option is not checked.
Requires Client Certificate—Select to support EAP-FAST tunnel
establishment with a client certificate.
Disable Client Certificate Lookup and Comparisons —Select to disable
the client certificate lookup and whether the clients are configured with
public key infrastructure (PKI) certificates. When this option is enabled,
EAP-FAST PKI Authorization Bypass is invoked. Authorization is generally
performed by retrieving the user’s group data and certificate from an external
database. ACS then compares at least one of the certificate, CN, or SAN to
the values received from the client supplied certificate. If the comparison
succeeds the group is mapped to an ACS user-group, otherwise the
authentication fails. When PKI Authorization Bypass is enabled this stage is
passed over and the session is mapped to a pre-configured user-group. See
PAC Free EAP-FAST, page 9-16 for more information.
Assign Group — Select a group to map these requests to an ACS user-group.
Allowed inner methods When enabled, determines which inner EAP methods run inside the EAP-FAST
tunnel. For anonymous in-band provisioning, EAP-GTC and
EAP-MS-CHAPv2 must be enabled for backward compatibility. In most cases,
all the inner methods should be checked.
Note ACS always starts the authentication process by using the first enabled
EAP method. For example, if you select EAP-GTC and
EAP-MS-CHAPv2, then the first enabled EAP method is EAP-GTC.
EAP-GTC—Uses a two-factor authentication; for example, OTP.
EAP-MSCHAPv2—Used for AD authentication.
EAP-TLS—Uses certificates for authentication.
User Guide for Cisco Secure Access Control Server 4.2
14-45