Cisco PIX 500 Series Configuration Manual page 369

Chapter 19 Applying AAA for Network Access
This approach is most useful when you have very large access list sets that you want to apply to more
than one Cisco Secure ACS user or group; however, its ability to simplify Cisco Secure ACS user and
group management makes it useful for access lists of any size.
The security appliance receives downloadable access lists from Cisco Secure ACS using the following
process:
The security appliance sends a RADIUS authentication request packet for the user session.
1.
If Cisco Secure ACS successfully authenticates the user, Cisco Secure ACS returns a RADIUS
2.
access-accept message that contains the internal name of the applicable downloadable access list.
The Cisco IOS cisco-av-pair RADIUS VSA (vendor 9, attribute 1) contains the following
attribute-value pair to identify the downloadable access list set:
ACS:CiscoSecure-Defined-ACL= acl-set-name
where acl-set-name is the internal name of the downloadable access list, which is a combination of
the name assigned to the access list by the Cisco Secure ACS administrator and the date and time
that the access list was last modified.
The security appliance examines the name of the downloadable access list and determines if it has
3.
previously received the named downloadable access list.
–
–
Upon receipt of a RADIUS authentication request that has a username attribute containing the name
4.
of a downloadable access list, Cisco Secure ACS authenticates the request by checking the
Message-Authenticator attribute. If the Message-Authenticator attribute is missing or incorrect,
Cisco Secure ACS ignores the request. The presence of the Message-Authenticator attribute
prevents malicious use of a downloadable access list name to gain unauthorized network access. The
Message-Authenticator attribute and its use are defined in RFC 2869, RADIUS Extensions,
available at http://www.ietf.org.
If the access list required is less than approximately 4 KB in length, Cisco Secure ACS responds
5.
with an access-accept message containing the access list. The largest access list that can fit in a
single access-accept message is slightly less than 4 KB because some of the message must be other
required attributes.
Cisco Secure ACS sends the downloadable access list in a cisco-av-pair RADIUS VSA. The access
list is formatted as a series of attribute-value pairs that each contain an ACE and are numbered
serially:
ip:inacl#1= ACE-1
OL-12172-03
If the security appliance has previously received the named downloadable access list,
communication with Cisco Secure ACS is complete and the security appliance applies the
access list to the user session. Because the name of the downloadable access list includes the
date and time it was last modified, matching the name sent by Cisco Secure ACS to the name of
an access list previous downloaded means that the security appliance has the most recent
version of the downloadable access list.
If the security appliance has not previously received the named downloadable access list, it may
have an out-of-date version of the access list or it may not have downloaded any version of the
access list. In either case, the security appliance issues a RADIUS authentication request using
the downloadable access list name as the username in the RADIUS request and a null password
attribute. In a cisco-av-pair RADIUS VSA, the request also includes the following
attribute-value pairs:
AAA:service=ip-admission
AAA:event=acl-download
In addition, the security appliance signs the request with the Message-Authenticator attribute
(IETF RADIUS attribute 80).
Configuring Authorization for Network Access
Cisco Security Appliance Command Line Configuration Guide
19-11