Cisco Systems Servers Manuale Utente

You can access the HTML interface from computers other than the 
Cisco Secure ACS server. This enables remote administration of 
Cisco Secure ACS. For more information about the HTML interface, including 
steps for accessing the HTML interface, see the 

.

The HTTP port allocation feature allows you to configure the range of TCP ports 
used by Cisco Secure ACS for remote administrative HTTP sessions (that is, 
administrative sessions conducted by a browser running on a computer other than 
the Cisco Secure ACS server). Narrowing this range with the HTTP port 
allocation feature reduces the risk of unauthorized access to your network by a 
port open for administrative sessions.

We do not recommend that you administer Cisco Secure ACS through a firewall. 
Doing so requires that you configure the firewall to permit HTTP traffic over the 
range of HTTP administrative session ports that Cisco Secure ACS uses. While 
narrowing this range reduces the risk of unauthorized access, a greater risk of 
attack remains if you allow administration of Cisco Secure ACS from outside a 
firewall. A firewall configured to permit HTTP traffic over the Cisco Secure ACS 
administrative port range must also permit HTTP traffic through port 2002, 
because this is the port a remote web browser must access to initiate an 
administrative session.

A broad HTTP port range could create a security risk. To prevent accidental 
discovery of an active administrative port by unauthorized users, keep the 
HTTP port range as narrow as possible. Cisco Secure ACS tracks the IP 
address associated with each remote administrative session. An unauthorized 
user would have to impersonate, or “spoof”, the IP address of the legitimate 
remote host to make use of the active administrative session HTTP port.

For information about configuring the HTTP port allocation feature, see the