Access Security Guide K/KA/KB.15.15

Example 4 Configuring a Cisco secure ACS for MS Windows
It is necessary to create a dictionary file that defines the VSAs so that the RADIUS server application
can determine which VSAs to add to its user interface. The VSAs will appear below the standard
attributes that can be configured in the application.
The dictionary file must be placed in the proper directory on the RADIUS server. Follow these steps.
1. Create a dictionary file (for example, hp.ini) containing the HP VSA definitions,
as shown in the example below.
;[User Defined Vendor] ;
; The Name and IETF vendor code and any VSAs MUST be unique. ;
; One or more VSAs named (max 255) ;
; Each named VSA requires a definition section ;
; Types are STRING, INTEGER, IPADDR ;
; The profile specifies usage, IN for accounting, OUT for
authorization,
; MULTI if more than a single instance is allowed per RADIUS message.
; Combinations are allowed, e.g. "IN", "MULTI OUT", "MULT IN OUT" ;
; Enumerations are optional for INTEGER attribute types
[User Defined Vendor]
Name=HP
IETF Code=11
VSA 2=Hp-Command-String
VSA 3=Hp-Command-Exception
Hp-Command-String]
Type=STRING Profile=IN OUT
Hp-Command-Exception]
Type=INTEGER
Profile=IN OUT
Enums=Hp-Command-Exception-Types
Hp-Command-Exception-Types]
0=PermitList
1=DenyList
2. Copy the hp.ini dictionary file to c:\program files\cisco acs 3.2\utils (or the
\utils directory wherever acs is installed).
3. From the command prompt execute the following command:
c:\Program files\CiscoSecure ACS v3.2\utils> csutil
-addudv 0 hp.ini
The zero (0) is the slot number. You will see some processing messages:
Adding or removing vendors requires ACS services to be re-started. Please make sure
regedit is not running as it can prevent registry backup/restore operations.
Are you sure you want to proceed? (Y or N) y
Parsing [.\hp.ini] for addition at UDV slot
Stopping any running services
Creating backup of current config
Adding Vendor [HP} added as [RADIUS (HP)]
Done
Checking new configuration...
New configuration OK
Re-starting stopped services
4. Start the registry editor (regedit) and browse to
HKEY_LOCAL_MACHINE\software\cisco\CiscoAAA v3.2\NAS Vendors tree.
Cisco adds the entry into this tree for each custom vendor. The id is 100 + the
slot number used in the previous command (100 + 0, as it was added in slot
0). Look in the key to verify the vendor name and id.
5. Go to
HKEY_LOCAL_MACHINE\software\cisco\CiscoAAAv3.2\CSRadius\ExtensionPoints\002\AssociatedWithVendors
Configuring 155