Downloadable ACLs

5c5administrator · ‎02-23-2007

Hi,

I am trying to get downloadable ACLs to a PIX firewall using ACS version 3.3 to PIX 6.3(4) IOS version:

Here is my config for the PIX:

aaa-server ACSACCESS protocol tacacs+

aaa-server ACSACCESS (inside) host 10.25.0.30 c0nn3ctm3 timeout 15

access-list 111 permit ip 10.25.61.0 255.255.255.0 any

aaa authentication match 111 outside ACSACCESS

The subnet 10.25.61.0 is the EZVPN DHCP pool allocated to the EZVPN users.

Here is a screen dump of the ACS server config:

the commands take ok but when access through the VPN I get my WINS, DNS etc but cannot browse the network.

The IP addressing has been changed due to me displaying this on the internet.

Regards,

Darren.

at · ‎02-24-2007

hi,

i think you should configure the downloadable ACL on the ACS Server as described in the document (shared profile components);

You should also configure the pix as a radius Client for this feature (Radius CiscoIOS/PIX6.0).

Look at

http://www.cisco.com/en/US/products/sw/secursw/ps5338/products_configuration_guide_chapter09186a00801fd703.html#wp391234

regards

alex

magurwara · ‎03-01-2007

I am trying to configure Downloadable ACL using ACS4.0 on my PIX. The authentication works fine but I am getting the following message on my PIX:

"can't find authorization ACL ..."

and in the client browser:

"Error: acl authorization denied"

Please correct if I am wrong. Here is my understanding about DACL using RADIUS:

1. Add PIX as AAA Client in ACS (using Cisco IOS/PIX 6.0) as the protocol

2. configure authentication for http/ftp/telnet,etc. using RADIUS as the server-tag

3. Configure a DACL in Shared Network Profiles section of ACS

4. Check "Assign IP ACL" and select the configured ACL from drop down list

....and that is it!

Few Q's: Do we still need to configure TACACS+ settings like shell access and privilege level even though we are using RADIUS authentication?

I have configured TACACS shell access as well as priv lvl to 15.

Greatly appreciate any help...

magurwara · ‎03-01-2007

Update.....

I do see in ACS logs that Authentication failed for ACL where username is the ACL name sent by PIX. (#ACSACL#-IP-myACL-45e6c605).

The failure code is "DACL request from device is not acceptable"

I guess ACS is the one rejecting it! but WHY?

Vivek Santuka · ‎03-01-2007

Hi,

You will need to upgrade to 6.3(5):

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_field_not

ice09186a00805bf1c4.shtml

As mentioned in the Field Notice above, the concern is that someone who knows the aclname could use that to get access to the network. Thus, the fix is to insist that the AAA client send 2 other cisco AVPs:

AAA:service=ip-admission

AAA:event=acl-download

In your case the PIX, which is not running the required code, didn't send these pairs, thus ACS complains.

Regards,

Vivek