Cisco Systems 3.3 About the cisco-av-pair RADUIS Attribute

C-7

User Guide for Cisco Secure ACS for Windows Server

78-16592-01

Appendix C RADIUS Attributes

About the cisco-av-pair RADUIS Attribute

The first attribute in the Cisco IOS/PIX RADIUS implementation, cisco-av-pair,

supports the inclusion of many AV pairs, using the following format:

attribute sep value

where attribute and value are an AV pair supported by the releases of IOS

implemented on your AAA clients, and sep is “=” for mandatory attributes and

“*” for optional attributes. This allows the full set of TACACS+ authorization

features to be used for RADIUS.

Note The attribute name in an AV pair is case sensitive. Typically, attribute names are

all in lowercase letters.

The following is an example of two AV pairs included in a single Cisco IOS/PIX

RADIUS cisco-av-pair attribute:

ip:addr-pool=first

shell:priv-lvl=15

The first example causes the Cisco multiple named IP address pools feature to be

activated during IP authorization (during PPP IPCP address assignment). The

second example causes a user of a device-hosted administrative session to have

immediate access to EXEC commands.

250 cisco-ssg-account-info String (maximum length

247 characters)

Outbound No

251 cisco-ssg-service-info String (maximum length

247 characters)

Both No

253 cisco-ssg-control-info String (maximum length

247 characters)

Both No

Table C-2 Cisco IOS/PIX RADIUS VSAs (continued)

Number Attribute Type of Value Inbound/Outbound Multiple