CCNA Security online course

Cisco ACS Initial Setup and Network Configuration

Learn how to run the Cisco ACS setup command, configure hostname, IPv4, DNS, and the first administrative account, then validate management access.

Cisco Secure Access Control System (ACS) uses an initial console-based setup process to establish appliance management connectivity and create the first administrative login. This foundation must be complete before you configure ACS policies, identity stores, network access devices, or AAA services.

In this lesson, setup means the interactive console command that enters the appliance's initial configuration process. It is different from later ACS configuration performed through the management interface, such as RADIUS, TACACS+, access policies, and directory integration.

What the Initial Setup Accomplishes

• Assigns a meaningful appliance hostname.
• Configures the IPv4 management address, subnet mask, and default gateway.
• Associates the appliance with a DNS domain and name servers.
• Creates or selects the initial administrative user.
• Provides the network settings needed to reach the ACS management interface.

Initial setup does not define which network devices use ACS, how users are identified, or which authentication and authorization policies apply. Those are subsequent ACS administration tasks.

Prepare Before Starting

Because the setup process is interactive, collect the approved values before opening the console. At minimum, obtain a unique hostname, an unused management IP address, its subnet mask, a reachable default gateway, the DNS domain, one valid DNS server address, and an optional secondary DNS server. Also decide who owns the initial administrative credentials.

• Confirm that the address is unused and reserved for ACS.
• Confirm that the switch port and VLAN provide access to the intended management network.
• Verify that the gateway belongs to the same local subnet as the management IP address.
• Use DNS server addresses reachable from the management network.
• Prepare a strong password without recording the secret in screenshots, examples, or configuration documentation.

Access the ACS Setup Prompt

After installation or first boot, connect to the ACS appliance console. At the console prompt, enter:

setup

The command launches the interactive initial configuration process. Read each prompt carefully and review the values before accepting the final configuration.

Configure the Management Hostname

A hostname is the device name assigned to the appliance. Choose a unique, meaningful name such as acs01 or acslab. The setup process permits a hostname of up to 15 characters.

A consistent hostname helps administrators identify the appliance, interpret logs, and create or verify DNS records. Avoid names that are duplicated elsewhere or so vague that the appliance's role and location are unclear.

Configure IPv4 Management Networking

The management IP address is the IPv4 address used to reach and administer ACS. Enter it together with the corresponding subnet mask and default gateway.

The subnet mask separates the network portion of an address from its host portion. It determines which destinations are local to the management subnet. Traffic for a local destination can be delivered directly, while traffic for another network is sent to the default gateway. The gateway is therefore a router address that must be reachable on the local management subnet.

Use an unused, correctly routed address. An incorrect mask can make the appliance misclassify destinations as local or remote. An incorrect gateway can prevent administrators on other networks from reaching ACS even when local connectivity works.

Example: Management VLAN

Suppose the approved management network is 192.0.2.0/24. A suitable illustrative configuration is:

IP address:       192.0.2.10
Subnet mask:      255.255.255.0
Default gateway:  192.0.2.1

With this mask, the appliance and gateway are in the same management subnet. The addresses in this example are documentation addresses; substitute values assigned to the actual network.

Configure the DNS Domain and Name Servers

The DNS domain is the suffix associated with the appliance, such as example.com or lab.example. The primary name server is the main DNS server ACS queries for hostname resolution. When the prompt asks whether to add another nameserver, choose yes only when an additional valid server is available, then enter its IP address.

DNS provides reliable hostname resolution and supports integrations that depend on names rather than numeric addresses. A secondary name server improves availability if the primary server is temporarily unreachable. A single DNS server can be appropriate for a small lab, but production deployments generally benefit from redundancy.

Example: Two DNS Servers

DNS domain:              example.com
Primary name server:     192.0.2.53
Add another nameserver:  Y
Additional name server:  192.0.2.54

Example: Single-DNS Lab

DNS domain:              lab.example
Primary name server:     198.51.100.53
Add another nameserver:  No

Declining an additional name server is valid when no second server is available. It does not provide the same resilience as a redundant DNS design.

Configure the Initial Administrative Account

The setup process allows you to accept the default administrative username or select another username. This administrative user is the privileged account used to access and administer ACS after setup.

Set a unique password that meets all of the minimum requirements:

• At least six characters.
• At least one lowercase letter.
• At least one uppercase letter.
• At least one number.

These are minimum requirements, not a target for a production password. Use a longer, unique password managed according to organizational procedures. Limit knowledge of the initial credentials to authorized administrators and protect any credential record appropriately.

Cisco ACS Setup Prompt Parameters

Illustrative Setup Input Sequence

The following sequence demonstrates the type of values entered during setup. It is an example, not a replacement for the approved addressing plan.

Hostname: acs01
IP address: 192.0.2.10
Subnet mask: 255.255.255.0
Default gateway: 192.0.2.1
DNS domain: example.com
Primary name server: 192.0.2.53
Add another nameserver: Y
Additional name server: 192.0.2.54
Username: admin
Password: use a password satisfying the stated requirements

Review every response before finalizing. Pay particular attention to digits in the IP address, the subnet mask, the gateway, and the DNS server addresses.

Complete and Validate the Setup

1. Review the hostname, IPv4 values, DNS values, username, and other displayed settings.
2. Accept the configuration only after comparing it with the approved network plan.
3. From an authorized workstation on the management network, connect to the configured management IP address.
4. Verify that the default gateway is reachable from the appliance's management subnet.
5. Test hostname resolution where the environment permits it.
6. Sign in to the ACS management interface using the administrative account selected during setup.

Common Initial Setup Problems

Management Interface Cannot Be Reached

Compare the entered IP address and subnet mask with the approved plan. Confirm that the console is connected to the intended management network and that the switch port is in the correct management VLAN. Also check whether another device already uses the configured address.

Other Networks Cannot Reach ACS

Verify that the default gateway is correct, locally reachable, and in the same subnet as the appliance. Then confirm that routing exists between the administrator's network and the ACS management network.

Hostnames Do Not Resolve

Validate the primary and optional secondary name-server addresses. Check DNS reachability from the management network, confirm that the domain suffix is correct, and verify that the required DNS records exist. If the primary DNS server is unavailable and no secondary server was configured, name resolution may fail.

Password Is Rejected

Ensure the password has at least six characters and contains a lowercase letter, an uppercase letter, and a number. Do not place the actual password in a lab report, screenshot, or shared console transcript.

Administrative Login Fails

Confirm whether the default admin username was accepted or replaced during setup. Verify the final management IP address and use the credentials selected during the interactive process.

Operational Recordkeeping

After setup, record the final management address, hostname, DNS domain, and ownership of the administrative account according to operational procedures. Store credentials separately in an approved secure method. This record helps future administrators distinguish a network problem from an authentication or account-ownership problem.

Exam-Relevant Notes

• setup is launched from the ACS appliance console for initial configuration.
• The hostname limit in this setup process is 15 characters.
• The management IP address, subnet mask, and gateway must align with the same management network.
• The default gateway is used for destinations outside the local subnet.
• A secondary DNS server provides name-resolution redundancy; it is optional in the prompt.
• The initial password must contain at least six characters, one lowercase letter, one uppercase letter, and one number.
• Initial setup establishes appliance access; AAA policies and identity-store configuration occur later.

Once management access is validated, continue with Cisco ACS configuration, then connect network devices with router-to-ACS AAA configuration. You can also review Cisco ACS installation if the appliance has not yet been installed.