Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Link/import devices' information into ACS

We have an application which monitors all our network devices (e.g. switches). We want to link/import the information of those devices (e.g. host name, IP addresses) into the ACS. Is that possible?

4 REPLIES
New Member

Re: Link/import devices' information into ACS

You certainly can, although there are some considerations

1) ACS is currently designed to hold up to 5k devices

2) From a policy standpoint importing a flat list of devices makes building scalable policy difficult.

For example lets say you have Network Access Restrictions defined at the group level. Users of group "West Coast Admins" are allowed to connect to West Coast switches. If you enter bulk import each device manually as you add new "West Coast Switches" you need to modify the policy as well. Alternativly if you create a network device group called West Coast devices, and base policy on that group then when you add a new device to the west coast group the policy will automatically work.

So you may need to think about how you organise devices as well as just importing raw IP.

3) You will also need to import the shared key used to communicate between the device and the AAA server, as well as the device type information.

The bottom line is ACS is not designed to be a device inventory system, the configuration of devices is centered around what it needs to communicate with devices and also the knowledge it needs to make policy decisions. The use of IP address ranges and NDGs are key elements of the configuration to enable scalable policy.

Ok, as for doing the import there exists two methods

1) Csutil

2) Csdbsync, via a csv file or RDBMS

Csutil is the easiest way, create a text file along the lines below, the setting of the NDG ( Network Device group ) is optional.

ADD_NAS:myNas:IP:1.1.1.1:KEY:secret:VENDOR:"TACACS+ (Cisco IOS)":NDG:"East Coast"

The import file can comprise of multiple lines

use csutil -i to import the file

New Member

Re: Link/import devices' information into ACS

Mr. Andrew,

Thank you very much for your information. However, is there any way that we can link directly the tables of our thrid-party -network monitoring- application into our ACS, without importing them (csutil/csdbsync)? I have been reading many documentation without finding that option.

New Member

Re: Link/import devices' information into ACS

Sorry, Im afraid not. Its something that has been talked about about, but it opens a whole can of worms in regard to maintianing referential integrity between the ACS configuration and the foreign data store.

New Member

Re: Link/import devices' information into ACS

Dear Mr. Andrew,

Again, thank you very much for clarifying our view.

312
Views
0
Helpful
4
Replies
CreatePlease to create content