Example Of Configuring A Radius-Assigned Acl Using The Freeradius Application - HP ProCurve 2910al Access Security Manual

1. Enter the ACL standard attribute in the FreeRADIUS dictionary.rfc4849 file.
ATTRIBUTE
2. Enter the switch IP address, NAS (Network Attached Server) type, and
the key used in the FreeRADIUS clients.conf file. For example, if the switch
IP address is 10.10.10.125 and the key ("secret") is "1234", you would enter
the following in the server's clients.conf file:
client 10.10.10.125
nastype = other
secret = 1234
Figure 6-3. Example of Switch Identity Information for a FreeRADIUS Application
3. For a given client username/password pair or MAC address, create an ACL
by entering one or more ACEs in the FreeRADIUS "users" file. Remember
that every ACL you create automatically includes an implicit deny in ip
from any to any ACE. For example, suppose that you wanted to create
identical ACL support for the following:
• a client having a username of "mobilE011" and a password of
"run10kFast"
• a client having a MAC address of 08 E9 9C 4F 00 19
The ACL in this example must achieve the following:
• permit http (TCP port 80) traffic from the client to the device at
10.10.10.101
• deny http (TCP port 80) traffic from the client to all other devices
• permit all other traffic from the client to all other devices
To configure the above ACL, you would enter the username/password and
ACE information shown in figure 6-4 into the FreeRADIUS "users" file.
Example of Configuring a RADIUS-assigned ACL Using the
FreeRADIUS Application
This example illustrates one method for configuring RADIUS-assigned ACL
support for two different client identification methods (username/password
and MAC address). For information on how to configure this functionality on
other RADIUS server types, refer to the documentation provided with the
server.
Configuring RADIUS Server Support for Switch Services
Configuring and Using RADIUS-Assigned Access Control Lists
Nas-FILTER-Rule 92
Note: The key configured in the switch and the
secret configured in the RADIUS server
supporting the switch must be identical. Refer
to the chapter titled "RADIUS Authentication
and Accounting" in the latest Access Security
Guide for your switch.
6-21