×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Where do I place my Cisco ACS server

Unanswered Question
Feb 6th, 2003
User Badges:

I am in the process of planning the implementation of Cisco ACS for purposes of authenticating remote users to two different Windows 2000 Active Directory domains. Both domains are on my inside network and are child domains in the same forest.


All remote users will be entering the network through a Cisco VPN 3015 concentrator. In addition, one of the internal domains will contain accounts for our network administrators responsible for supporting our Cisco equipment. We would also like to use ACS for AAA access for these administrators.


My question is where do I place this server in the network(domain)? Is it possible for the server to authenticate users to both domains?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
gfullage Sun, 02/09/2003 - 21:02
User Badges:
  • Cisco Employee,

You can place it anywhere on your inside network really. It's better to set up the server as a BDC, things just work better when authenticating to AD if the server ACS is sitting on is a DC, so place it anywhere you would normally place a BDC. Probably reasonably close to your 3015 would be a good idea, but it won't make much difference.

bob_kelley_jr@y... Mon, 02/10/2003 - 08:46
User Badges:

Thanks for the reply. The two domains on my internal network will logically segment external users from internal users. One caveat is that a few of the internal users will have remote access after hours. Given that its best to place the server on a DC, should I place it on the DC in the external domain or the internal? If I place it on a external DC, can it be used to authenticate user accounts on the internal domain when they come in remotely? What do I need to do if this is possible?


There are also internal users that will need to be authenticated prior to Telnet/SSH access to administer Cisco equipment while on-site. Should the server reside on a DC in the internal network or external?


thanks.

a-alao Fri, 03/21/2003 - 03:07
User Badges:

I don't know if you have made a decision about where to place your DC. I believe it is best pactice to keep any DC inside your network and at the very least on a DMZ if you have one. Keeping a DC on the outside will make the DC vulnerable.

Actions

This Discussion