Configure The Radius Accounting Inspection Service Policy - Cisco ASA Series Configuration Manual

Chapter 15 Inspection of Database, Directory, and Management Protocols
parameters
class-map type management radius-class
match port udp eq radius-acct
policy-map global_policy
class radius-class

Configure the RADIUS Accounting Inspection Service Policy

RADIUS accounting inspection is not enabled in the default inspection policy, so you must enable it if
you need this inspection. Because RADIUS accounting inspection is for traffic directed to the ASA, you
must configure it as a management inspection rule rather than a standard rule.
Procedure
Create an L3/L4 management class map to identify the traffic for which you want to apply the inspection,
Step 1
and identify the matching traffic.
class-map type management name
match {port | access-list} parameter
Example:
hostname(config)# class-map type management radius-class-map
hostname(config-cmap)# match port udp eq radius-acct
In this example, the match is for the radius-acct UDP port, which is 1646. You can specify a different
port, a range of ports (match port udp range number1 number2) or use match access-list acl_name
and use an ACL.
Step 2 Add or edit a policy map that sets the actions to take with the class map traffic.
policy-map name
Example:
hostname(config)# policy-map global_policy
In the default configuration, the global_policy policy map is assigned globally to all interfaces. If you
want to edit the global_policy, enter global_policy as the policy name.
Step 3 Identify the L3/L4 management class map you are using for RADIUS accounting inspection.
class name
Example:
hostname(config-pmap)# class radius-class-map
Configure RADIUS accounting inspection.
Step 4
inspect radius-accounting radius_accounting_policy_map
Where radius_accounting_policy_map is the RADIUS accounting inspection policy map you created in
Configure a RADIUS Accounting Inspection Policy Map, page
send response
enable gprs
validate-attribute 31
host 10.2.2.2 key 123456789
host 10.1.1.1 key 12345
inspect radius-accounting radius-acct-pmap
RADIUS Accounting Inspection
15-14.
Cisco ASA Series Firewall CLI Configuration Guide
15-15