Cisco Systems 3.3 Manual De Usuario

External Databases—Of the databases that you have configured in the 
External User Databases section, lists the databases that Cisco Secure ACS 
does not use during posture validation or unknown user authentication.

Selected Databases—Of the databases that you have configured in the 
External User Databases section, lists the databases that Cisco Secure ACS 
does use during posture validation and unknown user authentication. 
Cisco Secure ACS attempts the requested service—authentication or posture 
validation—using the selected databases one at a time in the order specified. 
For more information about the significance of the order of selected 
databases, see 

For detailed steps for configuring your Unknown User Policy, see 

You can configure the order in which Cisco Secure ACS checks the selected 
databases when Cisco Secure ACS attempts posture validation and unknown 
authentication. The following processes reveal why database order in the Selected 
Databases list is significant:

Authentication—The Unknown User Policy supports unknown user 
authentication using the following logic:

Find the next user database in the Selected Databases list that supports 
the authentication protocol of the request. If there are no user databases 
in the list that support the authentication protocol of the request, stop 
unknown user authentication and deny network access to the user.

Send the authentication request to the database found in Step 1.

If the database responds with an “authentication succeeded” message, 
create the discovered user account, perform group mapping, and grant the 
user access to the network.

If the database responds with an “authentication failed” message or does 
not respond and other databases are listed below the current database, 
return to Step 1.

If there are no additional databases below the current database, deny 
network access to the user.