Cisco 2509 - Router - EN User Manual page 147

Chapter 5 Setting Up and Managing Shared Profile Components
In setting up a NAR you can choose whether the filter operates positively or
negatively. That is, you specify in the NAR whether to permit—or deny—access
from AAA clients that send information that matches the information stored in the
NAR. However, if a NAR encounters insufficient information to operate, it
defaults to denied access. This is shown in
Table 5-1
Permit Access Granted Access Denied
Deny
Cisco Secure ACS supports two basic types of NARs:
•
•
IP-based restrictions are based on one of the following attribute fields, depending
on the protocol the AAA client uses:
•
•
AAA clients that do not provide sufficient IP-address information (for example,
some types of firewall) do not support full NAR functionality.
A non-IP-based NAR is a list of permitted or denied "calling"/ "point of access"
locations that you can employ in restricting a AAA client when you do not have
an IP-based connection established. The non-IP-based NAR generally uses the
calling line ID (CLI) number and the Dialed Number Identification Service
(DNIS) number.
However, by entering an IP address in place of the CLI you can use the
non-IP-based filter even when the AAA client does not use a Cisco IOS release
that supports CLI or DNIS. In another exception to entering a CLI, you can enter
a MAC address to permit or deny; for example, when you are using a Cisco
Aironet AAA client. Likewise, you could enter the Cisco Aironet AP MAC
address in place of the DNIS. The format of what you specify in the CLI
78-14696-01, Version 3.1
NAR Permit/Deny Conditions
Match
Access Denied
IP-based restrictions where the originating request relates to an existing IP
address.
Non-IP-based filters for all other cases where automatic number
identification (ANI) may be used.
If you are using TACACS+—The
If you are using RADIUS IETF—The
and
called-station-id
User Guide for Cisco Secure ACS for Windows Server
Table
No Match Insufficient Information
Access Denied
Access Granted Access Denied
rem_addr
calling-station-id
(attribute 30) fields are used.
Network Access Restrictions
5-1.
field is used.
(attribute 31)
5-7