Downloadable ACLs

Unanswered Question
Feb 23rd, 2007

Hi,

I am trying to get downloadable ACLs to a PIX firewall using ACS version 3.3 to PIX 6.3(4) IOS version:

Here is my config for the PIX:

aaa-server ACSACCESS protocol tacacs+

aaa-server ACSACCESS (inside) host 10.25.0.30 c0nn3ctm3 timeout 15

access-list 111 permit ip 10.25.61.0 255.255.255.0 any

aaa authentication match 111 outside ACSACCESS

The subnet 10.25.61.0 is the EZVPN DHCP pool allocated to the EZVPN users.

Here is a screen dump of the ACS server config:

the commands take ok but when access through the VPN I get my WINS, DNS etc but cannot browse the network.

The IP addressing has been changed due to me displaying this on the internet.

Regards,

Darren.

Attachment: 
I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
magurwara Thu, 03/01/2007 - 08:50

I am trying to configure Downloadable ACL using ACS4.0 on my PIX. The authentication works fine but I am getting the following message on my PIX:

"can't find authorization ACL ..."

and in the client browser:

"Error: acl authorization denied"

Please correct if I am wrong. Here is my understanding about DACL using RADIUS:

1. Add PIX as AAA Client in ACS (using Cisco IOS/PIX 6.0) as the protocol

2. configure authentication for http/ftp/telnet,etc. using RADIUS as the server-tag

3. Configure a DACL in Shared Network Profiles section of ACS

4. Check "Assign IP ACL" and select the configured ACL from drop down list

....and that is it!

Few Q's: Do we still need to configure TACACS+ settings like shell access and privilege level even though we are using RADIUS authentication?

I have configured TACACS shell access as well as priv lvl to 15.

Greatly appreciate any help...

magurwara Thu, 03/01/2007 - 09:11

Update.....

I do see in ACS logs that Authentication failed for ACL where username is the ACL name sent by PIX. (#ACSACL#-IP-myACL-45e6c605).

The failure code is "DACL request from device is not acceptable"

I guess ACS is the one rejecting it! but WHY?

Vivek Santuka Thu, 03/01/2007 - 09:24

Hi,

You will need to upgrade to 6.3(5):

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_field_not

ice09186a00805bf1c4.shtml

As mentioned in the Field Notice above, the concern is that someone who knows the aclname could use that to get access to the network. Thus, the fix is to insist that the AAA client send 2 other cisco AVPs:

AAA:service=ip-admission

AAA:event=acl-download

In your case the PIX, which is not running the required code, didn't send these pairs, thus ACS complains.

Regards,

Vivek

Actions

This Discussion