Configuring Radius Authorization
When authentication succeeds, the RADIUS protocol returns user authorizations in the access-accept message sent by a RADIUS server. For more information about configuring authentication, see the "Configuring Authentication for Network Access" section on page 19-1.
When you configure the security appliance to authenticate users for network access, you are also implicitly enabling RADIUS authorizations; therefore, this section contains no information about configuring RADIUS authorization on the security appliance. It does provide information about how the security appliance handles access list information received from RADIUS servers.
You can configure a RADIUS server to download an access list to the security appliance or an access list name at the time of authentication. The user is authorized to do only what is permitted in the user-specific access list.
Note If you have used the access-group command to apply access lists to interfaces, be aware of the following effects of the per-user-override keyword on authorization by user-specific access lists:
• Without the per-user-override keyword, traffic for a user session must be permitted by both the interface access list and the user-specific access list.
• With the per-user-override keyword, the user-specific access list determines what is permitted.
For more information, see the access-group command entry in the Cisco Security Appliance Command Reference.
This section includes the following topics:
• Configuring a RADIUS Server to Send Downloadable Access Control Lists, page 19-9
• Configuring a RADIUS Server to Download Per-User Access Control List Names, page 19-12
Configuring a RADIUS Server to Send Downloadable Access Control Lists
This section describes how to configure Cisco Secure ACS or a third-party RADIUS server, and includes the following topics:
• About the Downloadable Access List Feature and Cisco Secure ACS, page 19-9
• Configuring Cisco Secure ACS for Downloadable Access Lists, page 19-10
• Configuring Any RADIUS Server for Downloadable Access Lists, page 19-11
• Converting Wildcard Netmask Expressions in Downloadable Access Lists, page 19-12
About the Downloadable Access List Feature and Cisco Secure ACS
Downloadable access lists is the most scalable means of using Cisco Secure ACS to provide the appropriate access lists for each user. It provides the following capabilities:
• Unlimited access list size—Downloadable access lists are sent using as many RADIUS packets as required to transport the full access list from Cisco Secure ACS to the security appliance.
• Simplified and centralized management of access lists—Downloadable access lists enable you to write a set of access lists once and apply it to many user or group profiles and distribute it to many security appliances.
This approach is most useful when you have very large access list sets that you want to apply to more than one Cisco Secure ACS user or group; however, its ability to simplify Cisco Secure ACS user and group management makes it useful for access lists of any size.
The security appliance receives downloadable access lists from Cisco Secure ACS using the following process:
1. The security appliance sends a RADIUS authentication request packet for the user session.
2. If Cisco Secure ACS successfully authenticates the user, Cisco Secure ACS returns a RADIUS access-accept message that contains the internal name of the applicable downloadable access list. The Cisco IOS cisco-av-pair RADIUS VSA (vendor 9, attribute 1) contains the following attribute-value pair to identify the downloadable access list set:
ACS:CiscoSecure-Defined-ACL=acI-sefc-name where acl-set-name is the internal name of the downloadable access list, which is a combination of the name assigned to the access list by the Cisco Secure ACS administrator and the date and time that the access list was last modified.
3. The security appliance examines the name of the downloadable access list and determines if it has previously received the named downloadable access list.
- If the security appliance has previously received the named downloadable access list, communication with Cisco Secure ACS is complete and the security appliance applies the access list to the user session. Because the name of the downloadable access list includes the date and time it was last modified, matching the name sent by Cisco Secure ACS to the name of an access list previous downloaded means that the security appliance has the most recent version of the downloadable access list.
- If the security appliance has not previously received the named downloadable access list, it may have an out-of-date version of the access list or it may not have downloaded any version of the access list. In either case, the security appliance issues a RADIUS authentication request using the downloadable access list name as the username in the RADIUS request and a null password attribute. In a cisco-av-pair RADIUS VSA, the request also includes the following attribute-value pairs:
AAA:service=ip-admission AAA:event=acl-download
In addition, the security appliance signs the request with the Message-Authenticator attribute (IETF RADIUS attribute 80).
4. Upon receipt of a RADIUS authentication request that has a username attribute containing the name of a downloadable access list, Cisco Secure ACS authenticates the request by checking the Message-Authenticator attribute. If the Message-Authenticator attribute is missing or incorrect, Cisco Secure ACS ignores the request. The presence of the Message-Authenticator attribute prevents malicious use of a downloadable access list name to gain unauthorized network access. The Message-Authenticator attribute and its use are defined in RFC 2869, RADIUS Extensions, available at http://www.ietf.org.
5. If the access list required is less than approximately 4 KB in length, Cisco Secure ACS responds with an access-accept message containing the access list. The largest access list that can fit in a single access-accept message is slightly less than 4 KB because some of the message must be other required attributes.
Cisco Secure ACS sends the downloadable access list in a cisco-av-pair RADIUS VSA. The access list is formatted as a series of attribute-value pairs that each contain an ACE and are numbered serially:
ip:inacl#1=ACE-l ip:inacl#2=ACE-2
ip:inacl#n=ACE-n
An example of an attribute-value pair follows:
ip:inacl#1=permit tcp 10.1.0.0 255.0.0.0 10.0.0.0 255.0.0.0
6. If the access list required is more than approximately 4 KB in length, Cisco Secure ACS responds with an access-challenge message that contains a portion of the access list, formatted as described above, and an State attribute (IETF RADIUS attribute 24), which contains control data used by Cisco Secure ACS to track the progress of the download. Cisco Secure ACS fits as many complete attribute-value pairs into the cisco-av-pair RADIUS VSA as it can without exceeding the maximum RADIUS message size.
The security appliance stores the portion of the access list received and responds with another access-request message containing the same attributes as the first request for the downloadable access list plus a copy of the State attribute received in the access-challenge message.
This repeats until Cisco Secure ACS sends the last of the access list in an access-accept message.
Configuring Cisco Secure ACS for Downloadable Access Lists
You can configure downloadable access lists on Cisco Secure ACS as a shared profile component and then assign the access list to a group or to an individual user.
The access list definition consists of one or more security appliance commands that are similar to the extended access-list command (see the "Adding an Extended Access List" section on page 16-5), except without the following prefix:
access-list acl_name extended
The following example is a downloadable access list definition on Cisco Secure ACS version 3.3:
Shared profile Components
Downloadable IP ACLs Content Name: acs_ten_acl ACL Definitions
|
permit |
tcp any host |
10. |
0 |
.0 |
.254 |
|
permit |
udp any host |
10. |
0 |
.0 |
.254 |
|
permit |
icmp any host |
10 |
0.254 |
||
|
permit |
tcp any host |
10. |
0 |
.0 |
.253 |
|
permit |
udp any host |
10. |
0 |
.0 |
.253 |
|
permit |
icmp any host |
10 |
0.253 |
||
|
permit |
tcp any host |
10. |
0 |
.0 |
.252 |
|
permit |
udp any host |
10. |
0 |
.0 |
.252 |
|
permit |
icmp any host |
10 |
.0. |
0.252 |
|
|
permit |
ip any any |
||||
For more information about creating downloadable access lists and associating them with users, see the user guide for your version of Cisco Secure ACS.
On the security appliance, the downloaded access list has the following name:
#ACSACL#-ip-acl_name-number
The acl_name argument is the name that is defined on Cisco Secure ACS (acs_ten_acl in the preceding example), and number is a unique version ID generated by Cisco Secure ACS.
The downloaded access list on the security appliance consists of the following lines:
|
access- |
list |
#ACSACL#- |
ip- |
asa- |
acs_ |
ten_ |
_acl |
-3b5385f7 |
permit |
tcp any host |
10. |
0 |
.0 |
.254 |
|
access- |
list |
#ACSACL#- |
ip- |
asa- |
acs_ |
ten_ |
_acl |
-3b5385f7 |
permit |
udp any host |
10. |
0 |
.0 |
.254 |
|
access- |
list |
#ACSACL#- |
ip- |
asa- |
acs_ |
ten_ |
_acl |
-3b5385f7 |
permit |
icmp any host |
10 |
0.254 |
||
|
access- |
list |
#ACSACL#- |
ip- |
asa- |
acs_ |
ten_ |
_acl |
-3b5385f7 |
permit |
tcp any host |
10. |
0 |
.0 |
.253 |
|
access- |
list |
#ACSACL#- |
ip- |
asa- |
acs_ |
ten_ |
_acl |
-3b5385f7 |
permit |
udp any host |
10. |
0 |
.0 |
.253 |
|
access- |
list |
#ACSACL#- |
ip- |
asa- |
acs_ |
ten_ |
_acl |
-3b5385f7 |
permit |
icmp any host |
10 |
0.253 |
||
|
access- |
list |
#ACSACL#- |
ip- |
asa- |
acs_ |
ten_ |
_acl |
-3b5385f7 |
permit |
tcp any host |
10. |
0 |
.0 |
.252 |
|
access- |
list |
#ACSACL#- |
ip- |
asa- |
acs_ |
ten_ |
_acl |
-3b5385f7 |
permit |
udp any host |
10. |
0 |
.0 |
.252 |
|
access- |
list |
#ACSACL#- |
ip- |
asa- |
acs_ |
ten_ |
_acl |
-3b5385f7 |
permit |
icmp any host |
10 |
.0. |
0.252 |
|
|
access- |
list |
#ACSACL#- |
ip- |
asa- |
acs_ |
ten_ |
_acl |
-3b5385f7 |
permit |
ip any any |
||||
Configuring Any RADIUS Server for Downloadable Access Lists
You can configure any RADIUS server that supports Cisco IOS RADIUS VSAs to send user-specific access lists to the security appliance in a Cisco IOS RADIUS cisco-av-pair VSA (vendor 9, attribute 1).
In the cisco-av-pair VSA, configure one or more ACEs that are similar to the access-list extended command (see the "Adding an Extended Access List" section on page 16-5), except that you replace the following command prefix:
access-list acl_name extended with the following text:
ip:inacl#nnn=
The nnn argument is a number in the range from 0 to 999999999 that identifies the order of the command statement to be configured on the security appliance. If this parameter is omitted, the sequence value is 0, and the order of the ACEs inside the cisco-av-pair RADIUS VSA is used.
The following example is an access list definition as it should be configured for a cisco-av-pair VSA on a RADIUS server:
ip:inacl#1=permit tcp 10.1.0.0 255.0.0.0 10.0.0.0 255.0.0.0 ip:inacl#99=deny tcp any any ip:inacl#2=permit udp 10.1.0.0 255.0.0.0 10.0.0.0 255.0.0.0 ip:inacl#100=deny udp any any ip:inacl#3=permit icmp 10.1.0.0 255.0.0.0 10.0.0.0 255.0.0.0
For information about making unique per user the access lists that are sent in the cisco-av-pair attribute, see the documentation for your RADIUS server.
On the security appliance, the downloaded access list name has the following format:
AAA-user-username
The username argument is the name of the user that is being authenticated.
The downloaded access list on the security appliance consists of the following lines. Notice the order based on the numbers identified on the RADIUS server.
access-list AAA-user-bcham34-79AD4A08 permit tcp 10.1.0.0 255.0.0.0 10.0.0.0 255.0.0.0 access-list AAA-user-bcham34-79AD4A08 permit udp 10.1.0.0 255.0.0.0 10.0.0.0 255.0.0.0 access-list AAA-user-bcham34-79AD4A08 permit icmp 10.1.0.0 255.0.0.0 10.0.0.0 255.0.0.0 access-list AAA-user-bcham34-79AD4A08 deny tcp any any access-list AAA-user-bcham34-79AD4A08 deny udp any any
Downloaded access lists have two spaces between the word "access-list" and the name. These spaces serve to differentiate a downloaded access list from a local access list. In this example, "79AD4A08" is a hash value generated by the security appliance to help determine when access list definitions have changed on the RADIUS server.
Converting Wildcard Netmask Expressions in Downloadable Access Lists
If a RADIUS server provides downloadable access lists to Cisco VPN 3000 Series Concentrators as well as to the security appliance, you may need the security appliance to convert wildcard netmask expressions to standard netmask expressions. This is because Cisco VPN 3000 Series Concentrators support wildcard netmask expressions but the security appliance only supports standard netmask expressions. Configuring the security appliance to convert wildcard netmask expressions helps minimize the effects of these differences upon how you configure downloadable access lists on your RADIUS servers. Translation of wildcard netmask expressions means that downloadable access lists written for Cisco VPN 3000 Series Concentrators can be used by the security appliance without altering the configuration of the downloadable access lists on the RADIUS server.
You configure access list netmask conversion on a per server basis, using the acl-netmask-convert command, available in the AAA-server configuration mode. For more information about configuring a RADIUS server, see "Identifying AAA Server Groups and Servers" section on page 13-12. For more information about the acl-netmask-convert command, see the Cisco Security Appliance Command Reference.
Configuring a RADIUS Server to Download Per-User Access Control List Names
To download a name for an access list that you already created on the security appliance from the RADIUS server when a user authenticates, configure the IETF RADIUS filter-id attribute (attribute number 11) as follows:
filter-id=acl_name
Note In Cisco Secure ACS, the value for filter-id attributes are specified in boxes in the HTML interface, omitting filter-id= and entering only acl_name.
For information about making unique per user the filter-id attribute value, see the documentation for your RADIUS server.
See the "Adding an Extended Access List" section on page 16-5 to create an access list on the security appliance.
Continue reading here: Using MAC Addresses to Exempt Traffic from Authentication and Authorization
Was this article helpful?