FWSM user and administrator multi-contexts authentication under ACS radius

[arnaud.dessauvages]

Hi,

I’m preparing the setup of an ACS radius server for FWSM-related authentication operations.

FWSMs will be in release 2.2, inserted in Catalyst 6500 (MSFC – IOS), in routed mode, in multi-switch active / standby setup, with multiple contexts configured.

User and administrator access management will be performed thanks to a radius ACS server.

I intend to install ACS onto an armored windows 2000 server SP4 , using a local database.

PDM 4.0 is needed in order to manage multiple-contexts on FWSMs.

Are there any points I should be aware about such a configuration, especially regarding the user and administrator authentication access management setup ?

The fact is that administrators will have to be defined and restricted to their own context, without privileges onto other contexts. Do you have feedback about such a setup or relevant information to point to me ?

Many thanks in advance for your attention.

Best regards,

Arnaud

[PAUL SHELTON]

Each of the contexts will behave like individual firewalls for your purposes here. So, they each get a AAA config, and you could put them into their own groups for access control. Protect the Admin context especially well, it controls system resources for the others. Depending on how many FWSMs you have, you may want to look into the Pix MC, which is similar to PDM, but works for multiple FWSMs. It is a part of CiscoWorks VMS.

-Paul