ccna 200-301 wendell odom volume 2

ccna 200-301 wendell odom volume 2.When Cisco Security ACS is configured to communicate with an external user database, you can configure it to use the external user database to authenticate users in one of two ways.Authenticating specific users through a specific user assignment (By specific user assignment) ----------------- using an external user database.By unknownuser policy ------------ uses an external database to authenticate users that are not found in the Cisco security user database. This method does not require the administrator to define users in the Cisco security user database.Unknown user policies can be configured by checking the UnknownUser Policy link on the External User Database Configuration page. When configuring an unknown user policy, you must select the database from the External Databases list and place it in the Selected Databases list. You must do this for each database that Cicco Security ACS will use when attempting to authenticate an unknown user. The external databases are listed in the same order as the selected external databases are checked when Cisco Security ACS attempts to authenticate an unknown user O3.3.5.2 Cisco Security ACS Group SetupAfter a user is authenticated by an external database, the Cisco Security ACS determines authorization. This can complicate things because the authorization required by the Windowsserver authentication may require different authorizations than users authenticated by the LDAP server. Because of the potential need for different authorizations, it is possible to place users authenticated by the Windows server in one group and users authenticated by the LDAP server in another group. This can be done by using database group mapping.Database group mapping enables an administrator to map an authentication server (such as LDAP, Windows, or ODBC, etc.) to an already configured group in Cisco Security ACS. For some databases, a user can belong to only one group: for others, such as LDAP and Windows, group mapping through membership in an external database group is supported.One item that can be configured in the group settings is per-group command authorization, which uses Cisco Security ACS to authorize which router commands users belonging to a group can execute. For example, a group can be allowed to execute any router command other than show running-config.3.3.5.3 Cisco Security ACS User Settings