Remote Administrative Sessions Through Firewalls; Remote Administrative Sessions Through A Nat Gateway - Cisco Servers User Manual

Chapter 1 Overview of Cisco Secure ACS

Remote Administrative Sessions through Firewalls

Remote Administrative Sessions through a NAT Gateway

78-13751-01, Version 3.0
For these reasons, we do not recommend performing administrative sessions
using a web browser that is configured to use a proxy server. Administrative
sessions using a proxy-enabled web browser is not tested. If your web browser is
configured to use a proxy server, disable HTTP proxying when attempting remote
Cisco Secure ACS administrative sessions.
In the case of firewalls that do no perform network address translation (NAT),
remote administrative sessions conducted across the firewall can require
additional configuration of Cisco Secure ACS and the firewall. This is because
Cisco Secure ACS assigns a random HTTP port at the beginning of a remote
administrative session.
To allow remote administrative sessions from browsers outside a firewall that
protects a Cisco Secure ACS server, the firewall must allow HTTP traffic across
the range of ports that Cisco Secure ACS is configured to use. You can control the
HTTP port range using the HTTP port allocation feature. For more information
about the HTTP port allocation feature, see the
Remote Administrative Sessions" section on page
While administering Cisco Secure ACS through a firewall that is not performing
NAT is possible, we do not recommend that you administer Cisco Secure ACS
through a firewall. For more information, see the
Remote Administrative Sessions" section on page
We do not recommend conducting remote administrative sessions across a
network device performing NAT. If the administrator runs a browser on a
workstation behind a NAT gateway, Cisco Secure ACS receives the HTTP
requests from the NAT device's public IP address, which conflicts with the
workstation's private IP address, included in the content of the HTTP requests.
Cisco Secure ACS does not permit this.
If the Cisco Secure ACS server is behind a NAT gateway, you could configure the
gateway to forward all connections to port 2002 to the Cisco Secure ACS server,
using the same port. Additionally, all the ports allowed using the HTTP port
allocation feature would have to be similarly mapped. We have not tested such a
configuration and do not recommend implementing it.
Cisco Secure ACS 3.0 for Windows 2000/NT Servers User Guide
Cisco Secure ACS HTML Interface
"HTTP Port Allocation for
1-19.
"HTTP Port Allocation for
1-19.
1-25