Remote Administrative Sessions Through Firewalls; Remote Administrative Sessions Through A Nat Gateway - Cisco 2509 - Router - EN User Manual

Cisco Secure ACS HTML Interface

Remote Administrative Sessions through Firewalls

Remote Administrative Sessions through a NAT Gateway

User Guide for Cisco Secure ACS for Windows Server
1-28
In the case of firewalls that do not perform network address translation (NAT),
remote administrative sessions conducted across the firewall can require
additional configuration of Cisco Secure ACS and the firewall. This is because
Cisco Secure ACS assigns a random HTTP port at the beginning of a remote
administrative session.
To allow remote administrative sessions from browsers outside a firewall that
protects Cisco Secure ACS, the firewall must permit HTTP traffic across the
range of ports that Cisco Secure ACS is configured to use. You can control the
HTTP port range using the HTTP port allocation feature. For more information
about the HTTP port allocation feature, see
Administrative Sessions, page
While administering Cisco Secure ACS through a firewall that is not performing
NAT is possible, we do not recommend that you administer Cisco Secure ACS
through a firewall. For more information, see
Administrative Sessions, page
We do not recommend conducting remote administrative sessions across a
network device performing NAT. If the administrator runs a browser on a
workstation behind a NAT gateway, Cisco Secure ACS receives the HTTP
requests from the public IP address of the NAT device, which conflicts with the
workstation private IP address, included in the content of the HTTP requests.
Cisco Secure ACS does not permit this.
If Cisco Secure ACS is behind a NAT gateway and the URL used to access the
HTML interface specifies the Windows 2000 server running Cisco Secure ACS
by its hostname, remote administrative sessions operate correctly, provided that
DNS is functioning correctly on your network or that workstations used to access
the HTML interface have a hosts file entry for the Windows server that runs
Cisco Secure ACS.
If the URL used to access the HTML interface specifies the Windows 2000 server
running Cisco Secure ACS by its IP address, you could configure the gateway to
forward all connections to port 2002 to Cisco Secure ACS, using the same port.
Additionally, all the ports allowed using the HTTP port allocation feature would
have to be similarly mapped. We have not tested such a configuration and do not
recommend implementing it.
Chapter 1
HTTP Port Allocation for Remote
1-21.
HTTP Port Allocation for Remote
1-21.
Overview of Cisco Secure ACS
78-14696-01, Version 3.1