Cisco Access Control Server (ACS)

• What is Discovered and Monitored
• Event Types
• Configuration
• Settings for Access Credentials

What is Discovered and Monitored

Protocol	Information discovered	Metrics collected	Used for
SNMP	Application type	Process level CPU utilization, Memory utilization	Performance Monitoring
WMI	Application type, service mappings	Process level metrics: uptime, CPU Utilization, Memory utilization, Read I/O, Write I/O	Performance Monitoring
Syslog	Application type	Successful and Failed Authentications, Successful and Failed administrative logons, RADIUS accounting logs	Security Monitoring and compliance

Event Types

In ADMIN > Device Support > Event Types, search for "cisco secure acs" to see the event types associated with this device.

Configuration

• SNMP

• WMI

• Syslog

SNMP

1. Log into the device you want to enable SNMP for as an administrator.
2. Go to Control Panel >Program and Features.
3. Click Turn Windows features on or off.
4. If you are installing on a Windows 7 device, select Simple Network Management Protocol (SNMP).
   If you are installing on a Windows 2008 device, in the Server Manager window, go to Features > Add features > SNMP Services.
5. If necessary, select SNMP to enable the service.
6. Go to Programs > Administrative Tools > Services.
7. to set the SNMP community string and include FortiSIEM in the list of hosts that can access this server via SNMP.
8. Select SNMP Service and right-click Properties.
9. Set the community string to public.
10. Go to the Security tab and enter the FortiSIEM IP Address.
11. Restart the SNMP service.

WMI

Configuring WMI on your device so FortiSIEM can discover and monitor it requires you to create a user who has access to WMI objects on the device. There are two ways to do this:

• Creating a Generic User Who Does Not Belong to the Local Administrator Group
• Creating a User Who Belongs to the Domain Administrator Group

Creating a Generic User Who Does Not Belong to the Local Administrator Group

Log in to the machine you want to monitor with an administrator account.

Enable Remote WMI Requests by Adding a Monitoring Account to the Distributed COM Users Group and the Performance Monitor Users Group

1. Go to Start > Control Panel > Administrative Tools > Computer Management > Local Users and Groups.
2. Right-click Users and select Add User.
3. Create a user.
4. Go to Groups, right-click Distributed COM Users, and then click Add to group.
5. In the Distributed COM Users Properties dialog, click Add.
6. Find the user you created, and then click OK.
   This is the account you must use to set up the Performance Monitor Users group permissions.
7. Click OK in the Distributed COM Users Properties dialog, and then close the Computer Management dialog.
8. Repeat steps 4 through 7 for the Performance Monitor Users group.

Enable DCOM Permissions for the Monitoring Account

1. Go to Start > Control Panel > Administrative Tools > Component Services.
2. Right-click My Computer, and then Properties.
3. Select the COM Security tab, and then under Access Permissions, click Edit Limits.
4. Make sure that the Distributed COM Users group and the Performance Monitor Users group have Local Access and Remote Access set to Allowed.
5. Click OK.
6. Under Access Permissions, click EditDefault.
7. Make sure that the Distributed COM Users group and the Performance Monitor Users group have Local Access and Remote Access set to Allowed.
8. Click OK.
9. Under Launch and Activation Permissions, click Edit Limits.
10. Make sure that the Distributed COM Users group and the Performance Monitor Users group have the permissions Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation.
11. Click OK.
12. Under Launch and Activation Permissions, click Edit Defaults.
13. Make sure that the Distributed COM Users group and the Performance Monitor Users group have the permissions Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation.

See the sections on Enabling WMI Privileges and Allowing WMI Access through the Windows Firewall in the Domain Admin User set up instructions for the remaining steps to configure WMI.

Creating a User Who Belongs to the Domain Administrator Group

Log in to the Domain Controller with an administrator account.

Enable remote WMI requests by Adding a Monitoring Account to the Domain Administrators Group

1. Go to Start > Control Panel > Administrative Tools > Active Directory Users and Computers > Users.
2. Right-click Users and select Add User.
3. Create a user.
   
4. Go to Groups, right-click Administrators, and then click Add to Group.
5. In the Domain Admins Properties dialog, select the Members tab, and then click Add.
6. For Enter the object names to select, enter the user you created in step 3.
7. Click OK to close the Domain Admins Properties dialog.
8. Click OK.

Enable the Monitoring Account to Access the Monitored Device

Log in to the machine you want to monitor with an administrator account.

Enable DCOM Permissions for the Monitoring Account

1. Go to Start > Control Panel > Administrative Tools > Component Services.
2. Right-click My Computer, and then select Properties.
3. Select the Com Security tab, and then under Access Permissions, click Edit Limits.
4. Find the user you created for the monitoring account, and make sure that user has the permission Allow for both Local Access and Remote Access.
5. Click OK.
6. In the Com Security tab, under Access Permissions, click Edit Defaults.
7. Find the user you created for the monitoring account, and make sure that user has the permission Allow for both Local Access and Remote Access.
8. Click OK.
9. In the Com Security tab, under Launch and Activation Permissions, click Edit Limits.
10. Find the user you created for the monitoring account, and make sure that user has the permission Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation.
11. In the Com Security tab, under Launch and Activation Permissions, click Edit Defaults.
12. Find the user you created for the monitoring account, and make sure that user has the permission Allow for Local Launch, Remote Launch, Local Activation, and Remote Activation.
    

Enable Account Privileges in WMI

The monitoring account you created must have access to the namespace and sub-namespaces of the monitored device.

1. Go to Start > Control Panel > Administrative Tools > Computer Management > Services and Applications.
2. Select WMI Control, and then right-click and select Properties.
3. Select the Security tab.
4. Expand the Root directory and select CIMV2.
5. Click Security.
6. Find the user you created for the monitoring account, and make sure that user has the permission Allow for Enable Account and Remote Enable.
7. Click Advanced.
8. Select the user you created for the monitoring account, and then click Edit.
9. In the Apply onto menu, select This namespace and subnamespaces.
10. Click OK to close the Permission Entry for CIMV2 dialog.
11. Click OK to close the Advanced Security Settings for CIMV2 dialog.
12. In the left-hand navigation, under Services and Applications, select Services.
13. Select Windows Management Instrumentation, and then click Restart.

Allow WMI to Connect Through the Windows Firewall (Windows 2003)

1. In the Start menu, select Run.
2. Run gpedit.msc.
3. Go to Local Computer Policy > Computer Configuration > Administrative Templates > Network > Network Connections > Windows Firewall.
4. Select Domain Profile or Standard Profile depending on whether the device you want to monitor is in the domain or not.
5. Select Windows Firewall: Allow remote administration exception.
6. Run cmd.exe and enter these commands:

   netsh firewall add portopening protocol=tcp port=135 name=DCOM_TCP135"netsh firewall add allowedprogram program=%windir%\system32\wbem\unsecapp.exe name=UNSECAPP 
   

7. Restart the server.

Allow WMI through Windows Firewall (Windows Server 2008, 2012)

1. Go to Control Panel > Windows Firewall.
2. In the left-hand navigation, click Allow a program or feature through Windows Firewall.
3. Select Windows Management Instrumentation, and the click OK.

Syslog

1. Log in to your Cisco Access Controls Server as an administrator.
2. Go to Start > All Programs > CiscoSecure ACS v4.1 > ACS Admin.
3. In the left-hand navigation, click System Configuration, then click Logging.
4. Select Syslog for Failed Attempts, Passed Authentication, and RADIUS Accounting to send these reports to FortiSIEM.
5. For each of these reports, click Configure under CSV, and select the following attributes to include in the CSV output.
   

   Report	CSV Attributes
   Failed Attempts	Message-Type User-Name NAS-IP-Address Authen-Failure-Code Author-Failure-Code Caller-ID NAS-Port Author-Date Group-Name Filter Information Access Device AAA Server
   Passed Authentication	Message-Type User-Name NAS-IP-Address Authen-Failure-Code Author-Failure-Code Caller-ID NAS-Port Author-Date Group-Name Filter Information Access Device AAA Server Proxy-IP-Address Source-NAS PEAP/EAP-FAST-Clear-Name Real Name
   RADIUS Accounting	User-Name NAS-IP-Address NAS-Port Group-Name Service-Type Framed-Protocol Framed-IP-Address Calling-Station-Id Acct-Status-Type Acct-Input-Octets Acct-Output-Octets Acct-Session-Id Acct-Session-Time Acct-Input-Packets Acct-Output-Packets

6. For each of these reports, click Configure under Syslog, and for Syslog Server, enter the IP address of the FortiSIEM virtual appliance that will receive the syslog as the syslog server, enter 514 for Port, and set Max message length to 1024.
7. To make sure your changes take effect, go to System Configuration > Service Control, and click Restart ACS.

You can now configure FortiSIEM to communicate with your device. For more information, refer to sections "Discovery Settings" and "Setting Credentials" in the User Guide.

Settings for Access Credentials

SNMP Access Credentials for All Devices

Use these Access Method Definition settings to allow FortiSIEM to communicate with your device over SNMP. Set the Name and Community String.

Setting	Value
Name	<set name>
Device Type	Generic
Access Protocol	SNMP
Community String	<your own>