Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Downloadable ACLs


I am trying to get downloadable ACLs to a PIX firewall using ACS version 3.3 to PIX 6.3(4) IOS version:

Here is my config for the PIX:

aaa-server ACSACCESS protocol tacacs+

aaa-server ACSACCESS (inside) host c0nn3ctm3 timeout 15

access-list 111 permit ip any

aaa authentication match 111 outside ACSACCESS

The subnet is the EZVPN DHCP pool allocated to the EZVPN users.

Here is a screen dump of the ACS server config:

the commands take ok but when access through the VPN I get my WINS, DNS etc but cannot browse the network.

The IP addressing has been changed due to me displaying this on the internet.



New Member

Re: Downloadable ACLs


i think you should configure the downloadable ACL on the ACS Server as described in the document (shared profile components);

You should also configure the pix as a radius Client for this feature (Radius CiscoIOS/PIX6.0).

Look at



New Member

Re: Downloadable ACLs

I am trying to configure Downloadable ACL using ACS4.0 on my PIX. The authentication works fine but I am getting the following message on my PIX:

"can't find authorization ACL ..."

and in the client browser:

"Error: acl authorization denied"

Please correct if I am wrong. Here is my understanding about DACL using RADIUS:

1. Add PIX as AAA Client in ACS (using Cisco IOS/PIX 6.0) as the protocol

2. configure authentication for http/ftp/telnet,etc. using RADIUS as the server-tag

3. Configure a DACL in Shared Network Profiles section of ACS

4. Check "Assign IP ACL" and select the configured ACL from drop down list

....and that is it!

Few Q's: Do we still need to configure TACACS+ settings like shell access and privilege level even though we are using RADIUS authentication?

I have configured TACACS shell access as well as priv lvl to 15.

Greatly appreciate any help...

New Member

Re: Downloadable ACLs


I do see in ACS logs that Authentication failed for ACL where username is the ACL name sent by PIX. (#ACSACL#-IP-myACL-45e6c605).

The failure code is "DACL request from device is not acceptable"

I guess ACS is the one rejecting it! but WHY?

Cisco Employee

Re: Downloadable ACLs


You will need to upgrade to 6.3(5):


As mentioned in the Field Notice above, the concern is that someone who knows the aclname could use that to get access to the network. Thus, the fix is to insist that the AAA client send 2 other cisco AVPs:



In your case the PIX, which is not running the required code, didn't send these pairs, thus ACS complains.



CreatePlease login to create content