Introduction Cisco Secure ACS is a scalable, high-performance Remote Access Dial-In User Service (RADIUS) and Terminal Access Controller Access Control System (TACACS+) security server.It is the centralized control point for managing network users, network administrators, and network infrastructure resources. ACS provides a comprehensive identity-based network-access control solution. It extends network-access security by combining traditional authentication, authorization, and accounting (AAA) with policy control. ACS supports a broad variety of Cisco and other network-access devices (NADs), also known as AAA clients: Wired and wireless LAN switches and access points Edge and core routers Dialup and broadband terminators Content and storage devices Voice over IP (VoIP) Firewalls Virtual private networks (VPNs) Features Cisco Secure ACS 4.1 release provides the following features: Improved Compliance Support  This release contains new ACS administrator permissions to improve password management and audit reports for regulatory compliance. Authentication:  Forcing periodic change of administrator's password Applying password structure policy Forcing administrator's password change for inactive account Preventing the reuse of password (password history) Disabling administrator accounts for inactivity Disabling administrator accounts after failed logins Allowing ACS administrators to change own passwords Audit and Reporting:  Logging all administrative actions via Syslog, in addition to existing logging targets. Controlling administrators' access to log file configuration in order to prevent the disablement of specific audit logging. Adding new reports for administrators privileges Authorization:  Providing a read-only privilege for users and groups External database support for MAC Authentication Bypass  The ability to maintain MAC address lists in an external LDAP server; and map MAC addresses to user groups Improved diagnostics and error messages  Improved diagnostic information about certificate mismatches with HCAP and GAME servers have been added to this release. The raw dump of GAME and HCAP messages is in a readable format and the authentication failure codes are now more intuitive. PEAP/EAP-TLS Support  The authenticator side of PEAP/EAP-TLS as a protocol enhancement is included in this release. This permits ACS to authenticate clients with PEAP by using EAP-TLS as the phase two inner method, and enables certificate based authentication to occur within a secure tunnel, encrypting identity information. Logging and Reporting Extensions  New internal mechanisms for logging have been added to this release, to create consistent log levels and improved performance. Syslog is supported and the capability to log ACS messages to remote servers that support Syslog standard is available. Multiple concurrent logging destinations  Log data may be sent to multiple destinations simultaneously. Enhanced remote agent support for logging  User can expose reports externally that were previously provided only locally, for files from previous versions, for example, sending audit reports to remote agent on appliance. RADIUS AES Key Wrap Functionality  This feature supports a secure, certified mode of operation, notably in a Federal Information Processing Standard (FIPS)-compliant wireless solution. RADIUS Key Wrap support with EAP-TLS authentication in ACS, is another step towards satisfying the set of security requirements in Cisco's practical, deployable, and interoperable secure solutions. AES replaces MD5 encryption. Cisco NAC support  ACS 4.1 acts as a policy decision point in NAC deployments. By using configurable policies, it evaluates and validates the credentials that it receives from the Cisco Trust Agent (posture), determines the state of the host, and sends a per-user authorization to the network-access device: ACLs, a policy based access control list, or a private VLAN assignment. Extended replication components  Improved and enhanced replication components have been added to this release. Administrators now can replicate:  Posture validation settings Additional logging attributes Audit support for MAC Authentication Bypass  Audit processing has been enhanced to include MAC Authentication Bypass (MAB). MAB enables double checking an audit request against a MAC authentication policy and an Audit Policy, and combines the evaluation of these two policies. Audit Verification of MAC Exceptions  User can apply MAC exceptions to NAC audit requests. Dual verification of endpoints is then possible. Japanese Microsoft Windows Support  New support for the Japanese version of Microsoft Windows 2003 at the service pack level is available. Only ACS for Windows supports the Japanese version of Windows 2003. The ACS Solution Engine does not support the Japanese OS. ... View more

To disable MoH for one user or a group of users, perform these steps: 1. Define a Media Resource Group (MRG) without any MoH resources, and put that group     into a Media Resource Group List    (MRGL) for the users that you want to deny MoH access. 2. Put the MoH resource into a MRG, and put that group into a MRGL for the users     that you want to permit MoH access. For further reference use the following document: Cisco Unified MeetingPlace, Release 7.0 -- Configuring Cisco Unified Communications Manager: Music On Hold http://docwiki.cisco.com/wiki/Cisco_Unified_MeetingPlace,_Release_7.0_--_Configuring_Cisco_Unified_Communications_Manager:_Music_On_Hold ... View more

Introduction NOTE: This product is no longer being sold and might not be supported. A member of the Cisco Catalyst 2950 Series switches, the Cisco Catalyst 2950T-48-SI Switch is a standalone, fixed-configuration, managed 10/100 switch with two fixed 10/100/1000BASE-T uplinks that provides user connectivity for small to midsize networks. With these integrated ports, it is a cost-effective solution for delivering gigabit speeds over copper media. Dual ports provide redundancy and increased availability, as well as provide a cost-effective means for cascading switches and managing them as a cluster. Features and functions of this switch include: 48 10/100 ports and 2 fixed 10/100/1000BASE-T uplink ports 1-rack-unit (RU) switch Cisco IOS Software functions for basic data, voice, and video services at the edge of the network Standard Image software installed Ideal for migration to Gigabit Ethernet over copper media in the access layer ... View more

Introduction The Cisco Long-Reach Ethernet (LRE) networking solution is the industry's first end-to-end product line for delivering 5-15 Mbps speed over existing Category 1/2/3 wiring. With Ethernet-like performance that extends to 3,500-5,000 feet, LRE enables next-generation simultaneous voice, video and data services including high-speed Internet access, video streaming and IP telephony. ... View more

Description 1. Asynchronous Balanced Mode (ABM) 2. Accunet Bandwidth Manager (ABM) Complete Definition For systems that work in the ABM (Asynchronous Balanced Mode), there is no master/slave relationship. Each station may initialize, supervise, recover from errors, and send frames at any time. The DTE (Data Terminal Equipment) and DCE (Data Circuit Terminating Equipment) are treated as equals. The initiator for Asynchronous Balanced Mode sends an SABM ABM Wikipedia Definition ... View more

Introduction The Cisco ASA 5500 Series Content Security and Control Security Services Module ( CSC - SSM ) delivers threat protection and content control by providing comprehensive antivirus, anti- spyware , file blocking, anti- spam , anti- phishing , URL blocking and filtering, and content filtering . Comprehensive malware protection: The CSC - SSM can prevent virtually all known malicious code from entering and propagating across the network. Advanced content filtering: The module integrates How to configure URL filtering in the PIX Firewall, content filtering and anti-phishing technology to protect content across the network. Integrated message security The CSC - SSM integrates anti-spam technology that removes the vast majority of unsolicited e-mail before it gets to the mail server which results in improvement of network bandwidth and storage resources. Customization and tuning capabilities: Provides the ability to customize control over spam and content functions. The CSC - SSM has an intuitive interface integrated with the ASA-5500 Adaptive Security Device Manager (ASDM) which provides the following benefits: Enables simple, user-friendly initial configuration Easy deployment into the network Monitoring and user control over ongoing operations Automatic updates capabilities: All CSC Overview - components including scanning engines and pattern files are automatically updated. Models CSC-SSM-10 CSC-SSM-20 ... View more

Introduction Cisco ASA 5500 Series Adaptive Security Appliances integrate firewall, Unified Communications (voice/video) security, SSL and IPSec VPN, intrusion prevention (IPS), and content security services in a flexible, modular product. They are a key component of the Cisco Self-Defending Network. They provide intelligent threat defense and secure communications services that stop attacks before they impact the network. . Product Comparison ASA Model Cisco ASA 5505 Cisco ASA 5510 Cisco ASA 5520 Cisco ASA 5540 Cisco ASA 5550 Users/nodes 10, 50, or unlimited Unlimited Unlimited Unlimited Unlimited Firewall and types throughput Up to 150 Mbps Up to 300 Mbps Up to 450 Mbps Up to 650 Mbps Up to 1.2 Gbps Concurrent threat mitigation throughput (firewall + IPS services) Not available Up to 150 Mbps with Intrusion Detection/SSM-AIP-10 Up to 300 Mbps with Intrusion Detection/SSM-AIP-20 Up to 225 Mbps withIntrusion Detection/SSM-AIP-10 Up to 375 Mbps withIntrusion Detection/SSM-AIP-20 Up to 450 Mbps withIntrusion Detection/SSM-AIP-20 Not available 3DES/AES VPN throughput Up to 100 Mbps Up to 170 Mbps Up to 225 Mbps Up to 325 Mbps Up to 425 Mbps IPSec VPN peers 10; 25* 250 750 5000 5000 SSL VPN peers* (included/maximum) 2/25 2/250 2/750 2/2500 2/5000 Concurrent sessions 10,000; 25,000* 50,000; 130,000* 280,000 400,000 650,000 New sessions/second 3000 6000 9000 20,000 28,000 Integrated network ports 8-port Fast Ethernet switch (including 2 PoE ports) 3 Fast Ethernet + 1 management port; 5 Fast Ethernet ports* 4 Gigabit Ethernet , 1 Fast Ethernet 4 Gigabit Ethernet, 1 Fast Ethernet 8 Gigabit Ethernet, 4 SFP Fiber, 1 Fast Ethernet Virtual interfaces ( VLANs ) 3 (no trunking support) / 20 (with trunking support)* 50 /100* 150 200 250 Security contexts (included/maximum) 0/0 0/0 (Base); 2/5 (Security Plus) 2/20 2/50 2/50 High availability Not supported; stateless Active/Standby and redundant ISP support* Not supported; Active/Active and Active/Standby* Active/Active and Active/Standby Active/Active and Active/Standby Active/Active and Active/Standby Expansion slot 1, SSC 1, SSM 1, SSM 1, SSM 0 User-accessible flash slot 0 1 1 1 1 USB 2.0 ports 3 (1 on front, 2 on rear) 2 2 2 2 Serial ports 1 RJ-45 console 2 RJ-45, console and auxiliary 2 RJ-45, console and auxiliary 2 RJ-45, console and auxiliary 2 RJ-45, console and auxiliary Security lock slot (for physical security) 1 0 0 0 0 Memory ( RAM ) 256 MB 256 MB 512 MB 1024 MB 4096 MB Minimum system flash memory 64 MB 64 MB 64 MB 64 MB 64 MB System bus Multibus architecture Multibus architecture Multibus architecture Multibus architecture Multibus architecture *Available with an upgrade license Note: If you want to see your preshared key for IPSEC without copy the file off the ASA via TFTP, FTP, etc...You can simply execute the command: 'more system:running-config | beg tunnel-group' from exec mode. ... View more

Introduction Supported Cisco PIX 500 series platforms: PIX 515/515E At least 64 MB of RAM for Restricted ( R ) licenses. At least 128 MB of RAM for Unrestricted ( UR ) and Failover ( FO ) licenses. PIX 525 PIX 535 All supported platforms must have at least 16 MB of flash memory . The minimum software version required before performing an upgrade to PIX Version 7.1 is PIX Version 7.0.If the PIX is running a software version prior to PIX Version 6.2, it must first be upgraded to PIX Version 6.2 or PIX Version 6.3 before upgrading to PIX Version 7.0. Maximum Recommended Configuration File Size: 2 MB for PIX 525 and PIX 535 1 MB for PIX 515/515E New Features: Application Inspection and Control Enhanced ESMTP Inspection DCERPC Inspection Enhanced NetBIOS Inspection Enhanced H.323 Inspection Enhanced DNS Inspection Enhanced FTP Inspection Enhanced HTTP Inspection Enhanced Skinny ( SCCP ) Inspection Enhanced SIP Inspection Instant Messaging ( IM ) Inspection MPF -Based Regular Expression Classification Map RADIUS and DIAMETER Accounting Inspection GKRCS Support for H.323 Skinny Video Support SIP IP (Internet Protocol) Address Privacy Remote Access and Site-to-Site VPN Network Admission Control L2TP Over IPSec OCSP Support Active RIP Support Multiple L2TP Over IPSec Clients Behind NAT Nokia Mobile Authentication Support Zonelabs Integrity Server Hybrid XAUTH IPSec Fragmentation and Reassembly Statistics Network Integration PPPoE Client Dynamic DNS Support Multicast Routing Enhancements Private and Automatic MAC Address Assignments and Generation for Multiple Context Mode Expanded DNS Domain Name Usage Resiliency and Scalability Sub-second Failover Standby ISP Support Other Enhancements RTP/RTCP Inspection Generic Input Rate Limiting URL Filtering Enhancements for Secure Computing ( N2H2 ) Resource Management for Security Contexts Authentication for Through Traffic and Management Access Supports All Servers Previously Supported for VPN Clients Auto Update Dead Connection Detection ( DCD ) Configurable Prompt Save All Context Configurations from the System Intra-Interface Communication for Clear Traffic Modular Policy Framework Support for Management Traffic Management and Serviceability Traceroute Packet Tracer WCCP IPv6 Security Enforcement of IPv6 Addresses Inspection IPS, CSC Overview and URL Filtering for WebVPN / SSL VPN ... View more

Introduction Network Admission Control (NAC) is a Cisco led, multipartner program designed to limit damage caused by viruses and worms. NAC controls network access by interrogating devices connecting to the network to see if they comply with network security policies. Cisco Trust Agent is a core component of the NAC solution. This client software must be installed on hosts whose host policy state is to be validated before permitting network access. Cisco Trust Agent allows NAC to determine if the Cisco Security Agent or antivirus software is installed and current, and can determine current OS and patch levels. The Cisco Trust Agent is available free of charge and can be obtained directly from Cisco as a standalone application or bundled with Cisco Security Agent. It can also be obtained from NACpartners (from Trend Micro’s OfficeScan for example). Key Features and Benefits: Small nonintrusive agent acts as a middleware component securely communicates host policy information to the AAA/policy server. Cisco Trust Agent can communicate the Cisco Security, OS , and patch versions, as well as antivirus presence and version. Interacts directly with NAC-enabled applications running on the host without user intervention. Cisco Trust Agent will communicate with NAC-enabled applications through communication channels integrated by the NAC partners in their applications. Cisco Trust Agent is integrated with Cisco Security Agent and can be distributed by NAC partners with their applications for simplified management and distribution. Cisco Trust Agent is also available for free download at Cisco.com as a standalone application. Product Literature Data Sheets White Papers ... View more

Introduction Secure communication between users, offices and partners VPN types: IPSec VPN Two phase protocol Phase I Two peers establish communication over a Secured and authenticated channel Phase I exchange is accomplished by One of the two following modes Main mode Aggressive mode Phase II Negotiates Security Associations Phase II exchange is accomplished by Quick mode SSL VPN Clientless Uses standard browsers as the client Ideal for web based applications Thin Client Java applet on user's PC Ideal for specific TCP port applications such as email and telnet Full Tunnel (SVC) SSL VPN Client (SVC) on user's PC Independent of applications IP layer ... View more

To disable MoH for one user or a group of users, perform these steps: 1. Define a Media Resource Group (MRG) without any MoH resources, and put that group     into a Media Resource Group List (MRGL)     for the users that you want to deny MoH access. 2. Put the MoH resource into a MRG, and put that group into a MRGL for the users     that you want to permit MoH access. For further reference use the following document: Cisco Unified MeetingPlace, Release 7.0 -- Configuring Cisco Unified Communications Manager: Music On Hold http://docwiki.cisco.com/wiki/Cisco_Unified_MeetingPlace,_Release_7.0_--_Configuring_Cisco_Unified_Communications_Manager:_Music_On_Hold ... View more

The SSL VPN (also known as WebVPN) provides support, for remote user access to protected networks from anywhere on the Internet. Remote access is provided through a Secure Socket Layer- (SSL-) enabled SSL VPN gateway. The SSL VPN gateway allows remote users to establish a secure Virtual Private Network (VPN) tunnel using a web browser. This feature provides a comprehensive solution that allows easy access to a broad range of web resources and web-enabled applications using native HTTP over SSL (HTTPS) browser support. SSL VPN delivers three modes of SSL VPN access: Clientless The remote user accesses the internal or corporate network using the web browser on the client machine. The PC of the remote user must run the Windows 2000, Windows XP, or Linux operating systems. The following applications are supported in clientless mode: Web browsing (using HTTP and secure HTTP [HTTPS]) Provides a URL box and a list of web server links in the portal page that allows the remote user to browse the web. File sharing (using common Internet file system [CIFS]) provides a list of file server links in the portal page that allows the remote user to do the following operations: Browse a network (listing of domains) Browse a domain (listing of servers) Browse a server (listing of shares) List the files in a share Create a new file Create a directory Rename a directory Update a file Download a file Remove a file Rename a file Web-based e-mail Such as Microsoft Outlook Web Access (OWA) 2003 (using HTTP and HTTPS) with Web Distributed Authoring and Versioning (WebDAV) extensions; provides a link that allows the remote user to connect to the exchange server and read web-based e-mail. Thin-client Also called TCP port forwarding, assumes that the client application uses TCP to connect to a well-known server and port. In thin-client mode, the remote user downloads a Java applet by clicking the link provided on the portal page, or the Java applet is downloaded automatically. The Java applet acts as a TCP proxy on the client machine for the services that you configure on the gateway. The applications that are supported in thin-client mode are mainly e-mail-based (SMTP, POP3, and Internet Map Access Protocol version 4 [IMAP4] applications. The Java applet initiates an HTTP request from the remote user client to the SSL VPN gateway. The name and port number of the internal e-mail server is included in the HTTP request (POST or CONNECT). The SSL VPN gateway creates a TCP connection to that internal e-mail server and port. The Java applet starts a new SSL connection for every client connection. Full-tunnel client In a typical clientless remote access scenario, remote users establish an SSL tunnel to move data to and from the internal networks at the application layer (for example, web and e-mail). In full tunnel mode, remote users use an SSL tunnel to move data at the network (IP) layer. Therefore, full tunnel mode supports most IP-based applications. Full tunnel mode supports many popular corporate applications (for example, Microsoft Outlook, Microsoft Exchange, Lotus Notes E-mail, and Telnet). The tunnel connection is determined by the group policy configuration. The Cisco AnyConnect VPN Client is downloaded and installed on the remote user PC, and the tunnel connection is established when the remote user logs into the SSL VPN gateway. By default, the Cisco AnyConnect VPN Client is removed from the client PC after the connection is closed. Q&A Q:- Does the clientless solution require anything other than an SSL capable browser? A:- Clientless VPN i.e WebVPN client needs only an SSL-enabled web browser to access http or https-enabled web servers on the corporate LAN. For reference please check following link’s introduction. http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00806ea271.shtml Thin-Client SSL VPN client needs to download a small Java-based applet and allows secure access for Transmission Control Protocol (TCP) applications that use static port numbers. Here a link for Thin-client:- http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008072462a.shtml So, if your question is related to Clientless solution then no JAVA is required. ... View more

IEEE 802.1X is a port-based security standard (set by the IEEE 802.1 Working Group) for network access control. IEEE 802.1X for IEEE 802.11 takes advantage of standard protocols such as EAP and RADIUS to provide centralized user identification, authentication, dynamic key management,and accounting. This protocol is compatible with wireless roaming technologies, working between supplicants and authenticators. Authentication and authorization are achieved with back-end communications to an authentication server, such as Cisco Secure Access Control Server (ACS). ... View more

Differential Pulse Code Modulation (DPCM) Complete Definition DPCM is and advanced form of PCM. Differential (or Delta) pulse-code modulation (DPCM) encodes the PCM values as differences between the current and  the previous value. For audio this type of encoding reduces the number of bits  required per sample by about 25% compared to PCM. Predict the next sample based on the last  few decoded samples. Wikipedia  Definition of Delta Modulation Wikipedia Definition of DPCM Also See: PCM ADPCM codec u-law ... View more

Description mu-law (optional typing of u-law) Complete Definition mu-law is a more phonetic typing of the term u-law (pronounced mew-law) , which is a companding algorithm. Also See: u-law a-law G.711 codec PCM RTP ... View more