Infoblox NIOS 7.3.x and Cisco ACS 5.x configuration guidance€¦ · · 2016-04-20Of course...
11
1 Infoblox NIOS 7.3.x with Cisco ACS 5.x for TACACS+. Comments: Adam Obszynski <[email protected]> For Cisco ACS 5.x (VM or HW Appliance based) you need to use IE or Safari. Firefox and Chrome tend to not render all policy editor fields on web GUI. Settings on ACS environment can vary between different environments. But ACS admin who uses the system on daily basis will know how to use mentioned here directions and logical dependencies. AUTHENTICATION To simply authenticate users, You need to define GRID Master IP as TACACS+ enabled device and define shared password that will match on both sides – NIOS GM and ACS. In ACS GUI go to Network Resources > Network Devices and AAA Clients and click Create Enter Name and Single IP Address fields. Be sure that TACACS+ is checked and Shared Secret is same as on GM. Don’t forget about GMC.
Transcript of Infoblox NIOS 7.3.x and Cisco ACS 5.x configuration guidance€¦ · · 2016-04-20Of course...
1
InfobloxNIOS7.3.xwithCiscoACS5.xforTACACS+.Comments:AdamObszynski<[email protected]>ForCiscoACS5.x(VMorHWAppliancebased)youneedtouseIEorSafari.FirefoxandChrometendtonotrenderallpolicyeditorfieldsonwebGUI.SettingsonACSenvironmentcanvarybetweendifferentenvironments.ButACSadminwhousesthesystemondailybasiswillknowhowtousementionedheredirectionsandlogicaldependencies.
AUTHENTICATIONTosimplyauthenticateusers,YouneedtodefineGRIDMasterIPasTACACS+enableddeviceanddefinesharedpasswordthatwillmatchonbothsides–NIOSGMandACS.InACSGUIgotoNetworkResources>NetworkDevicesandAAAClientsandclickCreateEnterNameandSingleIPAddressfields.BesurethatTACACS+ischeckedandSharedSecretissameasonGM.Don’tforgetaboutGMC.
2
GotoGridMasterAdministration->AuthenticationServerGroups->TACACS+Services,clickADD(+).
FillIPAddressandSharedSecretfields.Remembertouse“Add”buttoninthemiddle/rightofthescreen.Thenyoushouldgetwindowlikethis:
Save&Closethen.
3
Thenyouneedtofollowdocumentedpath(AdminGuide)anddefineTACACS+usageforusersauthentication.TodoitGotoAdministration->Administrators->AuthenticationPolicy,selectdefinedalreadyTACACS+servicepoint.RememberaboutAddbutton.
Finally,youneedTACACS+tobethefirstchoice.Selectanduserarrowontheleftside:
REDLIGHT!IfyouhavedefaultACSsettings(defaultinstallation)orifyouuseddefaultNIOSsettingsforTACACS+serverdefinition(AuthenticationType==CHAP)YouneedtoenableCHAPonACSsideORdoachangeonNIOSside.ACSsupportsbydefaultASCIIandPAPonly.IwouldrecommendtouseCHAPasaminimum...SoinACSyouneedtoenableCHAP:GotoAccessPolicies>AccessServices>DefaultNetworkAccess>AllowedProtocolsandputcheckboxnexttoAllowCHAP:
4
Submit.IfthisisdefaultACSinstallyouneedtoadduserfirstJ.InACSgotoUsersandIdentityStores>InternalIdentityStores>UsersclickCreateanddefineuser/password:
FortestproposesopendifferentwebbrowserorprivatewindowsessiontoyourGMandloginbyusingnewlycreateduser.OnscreenabovescreenmentionalamakotauserbutIuseduser4acsinsystemandalamakotaisforscreencaptureonly:-).Trytologinbyusingnewlycreateduser.PleasealsoobserveNIOS/GMsyslog.
ErrorlikethistypicallymeansthatthereisnoconnectivitytoyourACSfromGMoryoudon’thaveCHAPenabledinACSJ
5
CorrectauthenticationcanbecheckedinAuditLog.
FirstoneisrelatedtobadlyconfiguredACS.LastlineiscorrectoneafterCHAPwasenabled.(verybasiccasewithdefaultACSinstallmentionedearlier).YELLOWLIGHT!OfcourseInfobloxGRIDuserspermissionsandgroupmappingneedstobedefined.TheAuthenticationonlycasewasdonejustfortestswithverylazydefinitionwhenlastresortauthentication(incaseofnothingmatchedfirst)givesadmin-groupwhichisBADthingforLABuseONLY.ItwassetinthebottomofAuthenticationPolicypageinAdministration/AdministratorsmenuofGM.
PLEASEDONOTUSEthisinPRODUCTION.UseAuthorizationwhichcomesnext!:-)andminimumornonerightsifnotsinglegroupismatched.
AUTHORIZATIONRemotegroupcalledgroup-acsiscreatedonNIOStoauthorizeuserintogroupwithlimitedrights.
6
NowtimeforACSside.GotoPolicyElements>AuthorizationandPermissions>DeviceAdministration>ShellProfiles,thenCreateInGeneral/Nameenterprofilenameie.“infoblox”.
TheninCustomerAttributestabdefineattributethatwilldefinegroupmapping.InmyexamplethereisstaticdefinitionthatmapsgroupnamecreatedonNIOS/GM(group-acs).WhenACSisusingexternalMSActiveDirectoryyoucanuseDynamicsettingsforAttributeValuetouseGroupfromADstructure.ThemostimportantcaseisAttributenameinneedstobealllowercase:infoblox-admin-groupSamplescreenwithstaticgroupdefinition:
7
Pleaseremembertoaddvaluebyclicking“Add/\”button,thenSave.Finalview:
Fromthatpointsettingmaybedifferentforeachcustomer.DataprovidedbelowisfromsimplifiedLABenvironment.FornextfewstepswithACSFirefoxbrowserwillnoworkcorrectly!!!GotoAccessPolicies>AccessServices>ServiceSelectionRulesSelectSinglecheckboxandselectDefaultDeviceAdminfromdropdownmenu.
8
ChangingtoSingleresultselectioncanbreakyourACSpolicesifthisisproductionsystem.PleaseaskACSadminforhelpwithpolices.AsresultwewanttosendspecificgrouptoNIOSauthorization.NothingmoreJ.ThiscanbeverysimplyscenariofromLABlikeonourscreensoritcanbeadvancedmultilevelgroupmatchingetc.Yourmileagemayvary.
Save.GotoAccessPolicies>AccessServices>DefaultDeviceAdmin>AuthorizationClick“CUSTOMIZE”(bottomright)buttonandcheck/addDeviceIPAddressandShellProfileareavailableforselection.ClosewindowsbyusingOKbutton.
9
ThenclickCreate/Save.WARNING:InunsupportedbrowserCreatebuttonwillbegreyedout!FormeWindows-IEandMAC-Safariworkedfine.Firefox&Chromedidn’t.UnderGeneral,namethenewruleie.InfobloxGMandensurethatitisenabled.UnderConditions,selectthecheckboxnexttoDeviceIPAddress,andtypetheIPaddressoftheInfobloxGMappliance(inmycase192.168.0.73)UnderResults,clicktheSelectbutton,locatednexttotheShellProfilefield,andselectoneyoucreatedearlier(inmycaseinfoblox),andclickOK.ClickOKtoclosethewindow.
ClickSaveChanges,locatedatthebottomofthepage.
InmeantimecheckthatyouhavecorrectInfobloxGMgroupmappingswithusingsamegroupnameinNIOSasitisdefinedinACS(orfinallyADetc.).
10
OnACSyoucancheckifACSauth.worksinMonitoringandReportsmenu.ThenonDashboardofViewerwindowlookfor“Authentications-TACACS–Today”Report.TogetdetailsaboutwhatAuthorizationdatawassenttoInfobloxGMyouneedtoexpandtreeviewReports->Catalog->AAAProtocolandselectTACACS_Authorizationreport.Intherightupperpartofusersessionyouwillseeresultwithmapping:
FinallytimetotestitonNIOSGM.
11
WellDONE!Errors.ThiserrorinAuditLogmeansthereisnocorrectgroupnameorattributenamepassedfromACStoNIOS:
Whattodo?CheckNIOSGroupname.CheckInfobloxAVattributenameonACS–needstobeinfoblox-admin-groupalllowercase.CheckonACSMonitoring(AAAProtocols/AAAAuthorization)->Details.WhatattributenameandattributevalewassenttoNIOS.DuringpreparationofthisdocumentIfindmyself3errorsYoushouldbeawareof:#1infoblox-admin-groupAVnameonACSwaschangedbyspellcheckertoInfoblox-admin-group–firstletterCAPITAL…#2Groupnamewasshortedbyonecharacter.group-acinsteadofgroup-acs.SoinACSwhenenteringgroupnameinVALUEfieldpleaseDON’TdoENTER/newlineoryouwillhaveaproblems:-)#3IfyouuseTESTbuttoninNIOSyoucanfindthenerrorsinSysloggeneratedbytestprocedure:
ThisisnormalbehaviorfortestbuttonJ
