7-17
Cisco ASA Series Firewall CLI Configuration Guide
Chapter7 Configuring AAA Rules for Network Access
Configuring Authorization for Network Access
ciscoasa(config-aaa-server-host)# key TACPlusUauthKey
ciscoasa(config-aaa-server-host)# exit
ciscoasa(config)# aaa authentication match TELNET_AUTH inside AuthOutbound
ciscoasa(config)# aaa authorization match SERVER_AUTH inside AuthOutbound
Configuring RADIUS Authorization
When authentication succeeds, the RADIUS protocol returns user authorizations in the access-accept
message sent by a RADIUS server. For more information about configuring authentication, see the
“Configuring Network Access Authentication” section on page 7-7.
When you configure the ASA to authenticate users for network access, you are also implicitly enabling
RADIUS authorizations; therefore, this section contains no information about configuring RADIUS
authorization on the ASA. It does provide information about how the ASA handles ACL information
received from RADIUS servers.
You can configure a RADIUS server to download an ACL to the ASA or an ACL name at the time of
authentication. The user is authorized to do only what is permitted in the user-specific ACL.
Note If you have used the access-group command to apply ACLs to interfaces, be aware of the following
effects of the per-user-override keyword on authorization by user-specific ACLs:
•Without the per-user-override keyword, traffic for a user session must be permitted by both the
interface ACL and the user-specific ACL.
•With the per-user-override keyword, the user-specific ACL determines what is permitted.
For more information, see the access-group command entry in the command reference.
This section includes the following topics:
•Configuring a RADIUS Server to Send Downloadable Access Control Lists, page 7-17
•Configuring a RADIUS Server to Download Per-User Access Control List Names, page7-21

Configuring a RADIUS Server to Send Downloadable Access Control Lists

This section describes how to configure Cisco Secure ACS or a third-party RADIUS server and includes
the following topics:
•About the Downloadable ACL Feature and Cisco Secure ACS, page7-17
•Configuring Cisco Secure ACS for Downloadable ACLs, page7-19
•Configuring Any RADIUS Server for Downloadable ACLs, page7-20
•Converting Wildcard Netmask Expressions in Downloadable ACLs, page7-21

About the Downloadable ACL Feature and Cisco Secure ACS

Downloadable ACLs is the most scalable means of using Cisco Secure ACS to provide the appropriate
ACLs for each user. It provides the following capabilities:
•Unlimited ACL size—Downloadable ACLs are sent using as many RADIUS packets as required to
transport the full ACL from Cisco Secure ACS to the ASA.