Shared Network Access Restrictions Configuration - Cisco 2509 - Router - EN User Manual

Chapter 5 Setting Up and Managing Shared Profile Components
Network Access Restrictions
box—CLI, IP address, or MAC address—must match the format of what you
receive from your AAA client. You can determine this format from your RADIUS
Accounting Log.
When specifying a NAR you may use asterisks (*) as wildcards for any value, or
as part of any value to establish a range. All the values/conditions in a NAR
specification must be met for the NAR to restrict access; that is, the values are
"ANDed".
Note When an authentication request is forwarded by proxy to a Cisco Secure ACS,
any NARs for TACACS+ requests are applied to the IP address of the forwarding
AAA server, not to the IP address of the originating AAA client.
You can define a NAR for, and apply it to, a specific user or user group. For more
information on this, see Setting Network Access Restrictions for a User,
page 7-12, or Setting Network Access Restrictions for a User Group, page 6-7.
However, in the Shared Profile Components section of Cisco Secure ACS you can
create and name a shared NAR without directly citing any user or user group. You
give the shared NAR a name that can be referenced in other parts of the
Cisco Secure ACS HTML interface. Then, when you set up users or user groups,
you can select none, one, or multiple shared restrictions to be applied. When you
specify the application of multiple shared NARs to a user or user group, you
choose one of two access criteria: either "All selected filters must permit", or
"Any one selected filter must permit".
Shared access restrictions are kept in the CiscoSecure user database. You can use
the Cisco Secure ACS backup and restore features to back up and restore them.
You can also replicate the shared access restrictions, along with other
configurations, to secondary Cisco Secure ACSes.

Shared Network Access Restrictions Configuration

You can configure multiple shared NARs to restrict access to particular AAA
clients, all AAA clients, or to named NDGs.
User Guide for Cisco Secure ACS for Windows Server
5-8
78-14696-01, Version 3.1