VMware ESXi and vSphere Cluster Management

Cisco ACS Initial Setup and Network Configuration

Learn how to configure Cisco ACS for first use: hostname, IPv4 management address, gateway, DNS, and the initial administrative account.

Cisco Secure Access Control System (ACS) provides centralized AAA: authentication, authorization, and accounting. Before ACS can be administered through its management interface, the appliance or virtual appliance needs an initial identity, management-network configuration, DNS settings, and an administrative account.

This initial setup is separate from later ACS policy work. After management connectivity is established, administrators can add network devices, configure RADIUS or TACACS+, connect identity stores, create authentication and authorization rules, and enable accounting or logging.

What the Initial Setup Configures

The initial setup establishes the minimum information ACS needs for administration and network communication:

• A local hostname for identifying the appliance.
• An IPv4 management address, subnet mask, and default gateway.
• A DNS domain and one or more DNS name servers.
• A primary administrative user and password.

The workflow is normally run from the appliance's local console after installation or first boot. For a virtual appliance, use the virtual machine console. It is not normally started from the web-based management interface because the management address has not yet been configured.

Accessing the Setup Workflow

Connect to the local appliance console or virtual machine console, sign in with the available console credentials, and run the setup command:

setup

The command starts an interactive, prompt-driven configuration process. Read each prompt carefully and enter values from the approved network design. Before accepting the final configuration, check every value because an incorrect address, mask, or gateway can make remote administration unavailable.

Initial Setup Prompts and Required Inputs

Hostname Configuration

A hostname is the local system name assigned to the ACS appliance. The setup workflow permits a hostname of up to 15 characters.

Choose a meaningful and unique name that follows the organization's convention. A name such as acs01 identifies the system more clearly than an ambiguous label. The hostname can help administrators recognize the server in DNS records, logs, monitoring systems, and high-availability deployments.

Keep the hostname distinct from the DNS domain. For example, with hostname acs01 and DNS domain example.com, the intended fully qualified name is typically acs01.example.com.

Management IP Addressing

The IP address entered during setup is the appliance's management address. Administrators use it to reach the management interface, and other services use it to communicate with ACS.

IPv4 address and subnet mask

Assign a valid IPv4 address from the approved management subnet. The address must not already be used by another appliance, server, or workstation. The subnet mask identifies which part of the address represents the local network and which part identifies the host.

The address and mask must agree with the Layer 3 design. For example, 192.0.2.10 with mask 255.255.255.0 places ACS in the 192.0.2.0/24 network. Documentation-range addresses are used here only as examples.

Default gateway

The default gateway is the router address ACS uses when the destination is outside its local subnet. It is needed when ACS communicates with remote administrators, DNS servers on another network, network devices, directory services, logging destinations, or other external systems.

The gateway should be the correct router interface for the management subnet. An incorrect gateway may still allow communication with hosts on the local subnet while preventing communication with remote networks.

DNS Domain and Name Servers

The DNS domain is the suffix associated with the appliance. A primary name server is the preferred DNS server that ACS contacts to translate hostnames into IP addresses.

Enter the IPv4 address of a reachable DNS server. During the optional additional-name-server prompt, answer yes when an approved secondary DNS server is available and should be configured. Answer no in a small lab or when the design intentionally provides only one resolver.

Production deployments generally benefit from DNS redundancy. DNS availability can affect administrative access by name, integrations, logging destinations, directory services, certificate-related operations, and other dependent services. Verify both network reachability to the DNS servers and the required DNS records.

Administrative Account Configuration

The setup process creates or configures the primary administrative user, which is the privileged account used to manage ACS after initial setup.

The workflow provides a default administrative username option. Press Enter to accept that default, or enter another username if organizational policy requires a different account name. Retaining a default name can make administration predictable, but changing it can reduce reliance on well-known account names. Follow the organization's account policy rather than changing the name without documenting the decision.

The password must contain:

• At least six characters.
• At least one lowercase letter.
• At least one uppercase letter.
• At least one numeric character.

These are minimum acceptance rules, not a recommended production standard. Use a longer, unique password or passphrase with additional permitted characters, store it in an approved password manager, and limit administrative access to authorized personnel.

Typical Management-Network Example

The following values illustrate how the fields can fit together. The addresses use documentation ranges and are not production assignments.

In a single-DNS-server lab, answer N when asked whether to add another name server. In production, configure a secondary resolver when the network design provides one.

Pre-Setup Network Information Checklist

Reviewing and Validating the Configuration

Before completing the workflow, review all supplied values:

• Hostname and 15-character limit.
• Management IPv4 address.
• Subnet mask.
• Default gateway.
• DNS domain.
• Primary and optional secondary DNS servers.
• Administrative username.
• Password compliance and secure handling.

After setup finishes, perform basic verification. Confirm that the appliance responds at its management IP from an authorized host, verify gateway connectivity, and test DNS resolution where applicable. If the design uses a separate management subnet, test from both a local management host and an approved remote administrator network.

Only after management connectivity is working should you proceed to web-based administration and later ACS configuration.

Security and Operational Considerations

• Use a dedicated management network or another secured management path when supported by the deployment design.
• Restrict administrative access to authorized personnel and approved management subnets.
• Record approved network values and account ownership in deployment documentation, but never record passwords in plain text.
• Plan DNS, routing, firewall rules, and time synchronization as supporting production services.
• Use unique administrative credentials and follow account-recovery and access-review procedures.

Initial setup does not complete an ACS deployment. A full deployment also requires configuration of AAA clients, identity stores, authentication methods, authorization rules, and accounting or logging options. Depending on the design, high availability and redundancy must also be planned.

Common Initial Setup Problems

Exam-Relevant Notes

• The setup command launches the interactive initial configuration from the appliance or virtual machine console.
• The hostname is limited to 15 characters in this workflow.
• The default gateway is required for communication with destinations outside the local management subnet.
• A secondary DNS server is optional, but it improves name-resolution resilience.
• The minimum administrative password requirement is six characters with at least one lowercase letter, one uppercase letter, and one number.
• Initial setup provides management connectivity; it does not configure AAA clients or ACS access policies.

Next Steps

Once the management address, gateway, DNS, and administrator account have been validated, continue with Cisco ACS setup and administration planning, including AAA clients, identity sources, authentication, authorization, and accounting.