Cisco PIX 500 Series Configuration Manual page 370

Configuring Authorization for Network Access
6.
Configuring Cisco Secure ACS for Downloadable Access Lists
You can configure downloadable access lists on Cisco Secure ACS as a shared profile component and
then assign the access list to a group or to an individual user.
The access list definition consists of one or more security appliance commands that are similar to the
extended access-list command (see the
without the following prefix:
access-list acl_name extended
The following example is a downloadable access list definition on Cisco Secure ACS version 3.3:
+--------------------------------------------+
| Shared profile Components
|
|
|
| Name:
|
|
|
| permit tcp any host 10.0.0.254
| permit udp any host 10.0.0.254
| permit icmp any host 10.0.0.254
| permit tcp any host 10.0.0.253
| permit udp any host 10.0.0.253
| permit icmp any host 10.0.0.253
| permit tcp any host 10.0.0.252
| permit udp any host 10.0.0.252
| permit icmp any host 10.0.0.252
| permit ip any any
+--------------------------------------------+
For more information about creating downloadable access lists and associating them with users, see the
user guide for your version of Cisco Secure ACS.
On the security appliance, the downloaded access list has the following name:
#ACSACL#-ip- acl_name - number
Cisco Security Appliance Command Line Configuration Guide
19-12
ip:inacl#2= ACE-2
.
.
.
ip:inacl# n = ACE-n
An example of an attribute-value pair follows:
ip:inacl#1=permit tcp 10.1.0.0 255.0.0.0 10.0.0.0 255.0.0.0
If the access list required is more than approximately 4 KB in length, Cisco Secure ACS responds
with an access-challenge message that contains a portion of the access list, formatted as described
above, and an State attribute (IETF RADIUS attribute 24), which contains control data used by
Cisco Secure ACS to track the progress of the download. Cisco Secure ACS fits as many complete
attribute-value pairs into the cisco-av-pair RADIUS VSA as it can without exceeding the maximum
RADIUS message size.
The security appliance stores the portion of the access list received and responds with another
access-request message containing the same attributes as the first request for the downloadable
access list plus a copy of the State attribute received in the access-challenge message.
This repeats until Cisco Secure ACS sends the last of the access list in an access-accept message.
Downloadable IP ACLs Content
acs_ten_acl
ACL Definitions
Chapter 19
"Adding an Extended Access List" section on page
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Applying AAA for Network Access
16-5), except
OL-12172-03