8-13
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter8 Configuring AAA Rules for Network Access
Configuring Authorization for Network Access
Step8 In the Service field, enter an IP service name or number for the destination service, or click the ellipsis
(...) to choose a service.
Step9 (Optional) In the Description field, enter a description.
Step10 (Optional) Click More Options to do any of the following:
•To specify a source service for TCP or UDP, enter a TCP or UDP service in the Source Service field.
•The destination service and source service must be the same. Copy and paste the Destination Service
field content into the Source Service field.
•To make the rule inactive, clear the Enable Rule check box.
You may not want to remove a rule, but instead turn it off.
•To set a time range for the rule, in the Time Range drop-down list, choose an existing time range.
To add a new time range, click the ellipsis (...). For more information, see the “Configuring Time
Ranges” section on page 20-15 in the general operations configuration guide.
Step11 Click OK.
The Add Authorization Rule dialog box closes, and the rule appears in the AAA Rules table.
Step12 Click Apply.
The changes are saved to the running configuration.
Configuring RADIUS Authorization
When authentication succeeds, the RADIUS protocol returns user authorizations in the access-accept
message sent by a RADIUS server. For more information about configuring authentication, see the
“Configuring Network Access Authentication” section on page 8-6.
When you configure the ASA to authenticate users for network access, you are also implicitly enabling
RADIUS authorizations; therefore, this section contains no information about configuring RADIUS
authorization on the ASA. It does provide information about how the ASA handles ACL information
received from RADIUS servers.
You can configure a RADIUS server to download an ACL to the ASA or an ACL name at the time of
authentication. The user is authorized to do only what is permitted in the user-specific ACL.
Note If you have enabled the Per User Override Setting (see the Configuration > Firewall > Access Rules >
Advanced > Access Rules Advanced Options dialog box), be aware of the following effects of the
per-user-override featureon authorization by user-specific ACLs:
•Without the per-user-override feature, traffic for a user session must be permitted by both the
interface ACL and the user-specific ACL.
•With the per-user-override feature, the user-specific ACL determines what is permitted.
This section includes the following topics:
•Configuring a RADIUS Server to Send Downloadable Access Control Lists, page 8-14
•Configuring a RADIUS Server to Download Per-User Access Control List Names, page8-17