Downloading access lists

[delewitz]

Hi.

I am trying to download a user access list from a RADIUS server. It looks like the server is passing it, but the firewall is ignoring it.

I am using FreeRADIUS (latest - 0.7.1) and PIX 515 6.2(2).

Any gotchas that I could be missing?

Am I correct that I want no sysopt connection permit-pptp?

Is it OK to have access lists applied to all interfaces and still get user access lists?

What is the exact setting I want RADIUS to pass? Reply-Message = "acl=101"? Filter-Id = "101"? Framed-Filter-Id = "101"?

Thanks in advance.

[p.krane]

Are you talking about Per-user access lists for IP? That is nothing but the basic authorization feature supported by RADIUS implementation. If that indeed is true, please refer to the document on AAA support and Configuring RADIUS support available at the following URL's:

Configuring Basic AAA on an Access Server

http://www.cisco.com/warp/public/793/access_dial/security.html