MARS with ACS

rohitsharmacisco · ‎10-04-2007

I have integrated MARS 4.3.1 with ACS but I need to know how I can assign privilege levels for the users on the ACS for different privilege on MARS.

pmccubbin · ‎10-04-2007

Hi Rohit,

The privilege levels are only assigned on the MARS box itself. There is nothing on the ACS which will assign users different privileges on MARS.

You can create four types of Users in MARS:

Admin--Superuser

Security Analyst--all privileges except Admin

Notifications Only--this account receives emails or reports generated by MARS

Operator-Read Only access

This is from the 4.3 User Guide:

"When the MARS Appliance operates with the AAA authentication method, every login except the administrator accounts are authenticated by the external AAA server.

All authentication method changes, successful logins, and failed logins are captured as event messages."

Hope this helps.

Paul

rohitsharmacisco · ‎10-04-2007

Hi Paul

Thanks for the quick reply. My client already has ACS with users with privileges assigned for the various network devices. Since MARS had authentication feature through ACS-Radius, I was planning to create users on ACS and assign them different privilege and depending on the privilege which will be assigned through ACS, they will be assigned Analyst or Operator role.

Is this possible or am I interpreting the ACS integration in a wrong way.

If I cannot assign privilege levels for users why would I want authentication of MARS with ACS. Any ideas.

pmccubbin · ‎10-04-2007

Hi Rohit,

I believe you are interpreting the ACS integration in the wrong way. Though it's a good idea and a valid Product Enhancement Request.

The only reason you would have authentication of MARS users by an ACS would be to record failed logins. Many companies are required by their auditors to record these sort of events.

I readily admit this isn't much but it's going to take time for a more granular approach to be developed between MARS and ACS.

Hope this helps.

Paul