Cisco ASA Series Cli Configuration Manual page 1045

Chapter 1 Configuring AAA Rules for Network Access
hostname(config)# aaa-server AuthOutbound (inside) host 10.1.1.1
hostname(config-aaa-server-host)# key TACPlusUauthKey
hostname(config-aaa-server-host)# exit
hostname(config)# aaa authentication match TELNET_AUTH inside AuthOutbound
hostname(config)# aaa authorization match SERVER_AUTH inside AuthOutbound
Configuring RADIUS Authorization
When authentication succeeds, the RADIUS protocol returns user authorizations in the access-accept
message sent by a RADIUS server. For more information about configuring authentication, see the
"Configuring Network Access Authentication" section on page
When you configure the ASA to authenticate users for network access, you are also implicitly enabling
RADIUS authorizations; therefore, this section contains no information about configuring RADIUS
authorization on the ASA. It does provide information about how the ASA handles access list
information received from RADIUS servers.
You can configure a RADIUS server to download an access list to the ASA or an access list name at the
time of authentication. The user is authorized to do only what is permitted in the user-specific access list.
Note
If you have used the access-group command to apply access lists to interfaces, be aware of the following
effects of the per-user-override keyword on authorization by user-specific access lists:
•
•
For more information, see the access-group command entry in the command reference.
This section includes the following topics:
•
•
Configuring a RADIUS Server to Send Downloadable Access Control Lists
This section describes how to configure Cisco Secure ACS or a third-party RADIUS server and includes
the following topics:
•
•
•
•
About the Downloadable Access List Feature and Cisco Secure ACS
Downloadable access lists is the most scalable means of using Cisco Secure ACS to provide the
appropriate access lists for each user. It provides the following capabilities:
•
Without the per-user-override keyword, traffic for a user session must be permitted by both the
interface access list and the user-specific access list.
With the per-user-override keyword, the user-specific access list determines what is permitted.
Configuring a RADIUS Server to Send Downloadable Access Control Lists, page 1-17
Configuring a RADIUS Server to Download Per-User Access Control List Names, page 1-21
About the Downloadable Access List Feature and Cisco Secure ACS, page 1-17
Configuring Cisco Secure ACS for Downloadable Access Lists, page 1-19
Configuring Any RADIUS Server for Downloadable Access Lists, page 1-20
Converting Wildcard Netmask Expressions in Downloadable Access Lists, page 1-21
Unlimited access list size—Downloadable access lists are sent using as many RADIUS packets as
required to transport the full access list from Cisco Secure ACS to the ASA.
Configuring Authorization for Network Access
1-7.
Cisco ASA Series CLI Configuration Guide
1-17