Where do I place my Cisco ACS server

mayhem2022 · ‎02-06-2003

I am in the process of planning the implementation of Cisco ACS for purposes of authenticating remote users to two different Windows 2000 Active Directory domains. Both domains are on my inside network and are child domains in the same forest.

All remote users will be entering the network through a Cisco VPN 3015 concentrator. In addition, one of the internal domains will contain accounts for our network administrators responsible for supporting our Cisco equipment. We would also like to use ACS for AAA access for these administrators.

My question is where do I place this server in the network(domain)? Is it possible for the server to authenticate users to both domains?

gfullage · ‎02-09-2003

You can place it anywhere on your inside network really. It's better to set up the server as a BDC, things just work better when authenticating to AD if the server ACS is sitting on is a DC, so place it anywhere you would normally place a BDC. Probably reasonably close to your 3015 would be a good idea, but it won't make much difference.

mayhem2022 · ‎02-10-2003

Thanks for the reply. The two domains on my internal network will logically segment external users from internal users. One caveat is that a few of the internal users will have remote access after hours. Given that its best to place the server on a DC, should I place it on the DC in the external domain or the internal? If I place it on a external DC, can it be used to authenticate user accounts on the internal domain when they come in remotely? What do I need to do if this is possible?

There are also internal users that will need to be authenticated prior to Telnet/SSH access to administer Cisco equipment while on-site. Should the server reside on a DC in the internal network or external?

thanks.

a-alao · ‎03-21-2003

I don't know if you have made a decision about where to place your DC. I believe it is best pactice to keep any DC inside your network and at the very least on a DMZ if you have one. Keeping a DC on the outside will make the DC vulnerable.