Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Downloadable ACLs

Hi,

I am trying to get downloadable ACLs to a PIX firewall using ACS version 3.3 to PIX 6.3(4) IOS version:

Here is my config for the PIX:

aaa-server ACSACCESS protocol tacacs+

aaa-server ACSACCESS (inside) host 10.25.0.30 c0nn3ctm3 timeout 15

access-list 111 permit ip 10.25.61.0 255.255.255.0 any

aaa authentication match 111 outside ACSACCESS

The subnet 10.25.61.0 is the EZVPN DHCP pool allocated to the EZVPN users.

Here is a screen dump of the ACS server config:

the commands take ok but when access through the VPN I get my WINS, DNS etc but cannot browse the network.

The IP addressing has been changed due to me displaying this on the internet.

Regards,

Darren.

4 REPLIES
at
New Member

Re: Downloadable ACLs

hi,

i think you should configure the downloadable ACL on the ACS Server as described in the document (shared profile components);

You should also configure the pix as a radius Client for this feature (Radius CiscoIOS/PIX6.0).

Look at

http://www.cisco.com/en/US/products/sw/secursw/ps5338/products_configuration_guide_chapter09186a00801fd703.html#wp391234

regards

alex

New Member

Re: Downloadable ACLs

I am trying to configure Downloadable ACL using ACS4.0 on my PIX. The authentication works fine but I am getting the following message on my PIX:

"can't find authorization ACL ..."

and in the client browser:

"Error: acl authorization denied"

Please correct if I am wrong. Here is my understanding about DACL using RADIUS:

1. Add PIX as AAA Client in ACS (using Cisco IOS/PIX 6.0) as the protocol

2. configure authentication for http/ftp/telnet,etc. using RADIUS as the server-tag

3. Configure a DACL in Shared Network Profiles section of ACS

4. Check "Assign IP ACL" and select the configured ACL from drop down list

....and that is it!

Few Q's: Do we still need to configure TACACS+ settings like shell access and privilege level even though we are using RADIUS authentication?

I have configured TACACS shell access as well as priv lvl to 15.

Greatly appreciate any help...

New Member

Re: Downloadable ACLs

Update.....

I do see in ACS logs that Authentication failed for ACL where username is the ACL name sent by PIX. (#ACSACL#-IP-myACL-45e6c605).

The failure code is "DACL request from device is not acceptable"

I guess ACS is the one rejecting it! but WHY?

Cisco Employee

Re: Downloadable ACLs

Hi,

You will need to upgrade to 6.3(5):

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_field_not

ice09186a00805bf1c4.shtml

As mentioned in the Field Notice above, the concern is that someone who knows the aclname could use that to get access to the network. Thus, the fix is to insist that the AAA client send 2 other cisco AVPs:

AAA:service=ip-admission

AAA:event=acl-download

In your case the PIX, which is not running the required code, didn't send these pairs, thus ACS complains.

Regards,

Vivek

208
Views
5
Helpful
4
Replies
CreatePlease login to create content