ACS/RSA Integration

[Eric Washington]

Has anyone implemented this before? I'm new to this and trying to get pointed in the right direction on support/documentation on how to do this,

The end goal is the provisioning of RSA Tokens to remote access users with a single sign on screen which leverages the ACS as the central policy enforcer​.

Any help would be appreciated. Thanks in advance!

[dansmith827]

Hi Eric,

We had this issue too, rather than try to do it ourselves we paid for two days consultancy and got the integration done for us by Armadillo (UK). We were advised this was the best option as you only do it the once or very rarely, we concentrated more on the system BAU operation and ACS maintenance. This may appear as an easy option, but for us as a large enterprise network we feel it went very smoothly and is the best way to go.

hope that helps.

Dan.

[Eric Washington]

Thanks for your reply Dan!

We've run into a few issues with this because clocks were not sync'd and we still need to update the ACS. We're currently on 4.1 and will upgrade to 5.3. I assume after the upgrade everything will work smoothly.

Were there any issues that you guys encountered during the implementation?

[Jatin Katyal]

should not be any issues with it.

http://popravak.wordpress.com/2013/02/16/using-rsa-securid-external-database-with-cisco-acs-5-x/

User guide:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.4/user/guide/users_id_stores.html#wp1134728

Jatin Katyal


- Do rate helpful posts -

[dansmith827 · Accepted solution]

Eric,

We were in the same position, we went from ACS 4.1 up to 5.4, the upgrade path was 4.1 >5.2 >5.3>5.4. The main issue we had is that 4.1 is group and user based where 5.x is all policy based, a major shift in how ACS operates. Once you get that straight in your head you are set to go. There are some migration tools on the new ACS apliances or at the CISCO website that extracts the lists of groups and users fromm the old 4.1 server. The issue we had then was that all the policies around VPN and network access required building. I found the cisco guides a bit heavy, but, again we employed a consultant as we outsource some major projects. He started this off and I completed this, he wrote up a guide which was very good and better than the cisco docs. I can sanitise this and send you a copy if you wish. my email is firstname.lastname as per my user name and use @nottinghamcity.gov.uk. We did get time sync issues which lead to a review of NTP.

regards,

Dan.

[Eric Washington]

Thanks a lot Dan I appreciate it. I will be emailing you from my yahoo acct.

[Gurpreet Puri]

Hi Dan,

I have been facing the same issue. We are currently using 4.2 integrated with RSA. But, now company has decided to upgrde the acs 4.2 to 5.4

I have been trying to do but its a lot different from 4.2

As you have mentioned, could you please mail me the copy of the document you were reffering so I can also configured it.

It would be really really appreciated.

My email id: gurpreet.s.puri@gmail.com

Regards,
Gurpreet S Puri

****************************
Keep Smiling, Peace
****************************

(Please Rate Helpful Post)

[ninoabbate]

Hi Dan,

I've sent you an email requesting the doc you were referring.

It would be really appreciated.

Thank you

Antonino Abbate