Configuring RADIUS Server Support for Switch Services

Configuring and Using RADIUS-Assigned Access Control Lists

Configuring ACE Syntax in RADIUS Servers

The following syntax and operating information applies to ACLs configured in a RADIUS server.

ACE Syntax Nas-filter-Rule =”< permit deny > in <ip ip-protocol-value> from any to

(Standard < any ip-addr ipv4-addr/mask > [ < tcp/udp-port tcp/udp-port range > icmp-type ] [cnt ]”

Attribute-92)

ACE Syntax HP-Nas-filter-Rule=”< permit deny > in <ip ip-protocol-value> from any to

(Legacy VSA- < any ip-addr ipv4-addr/mask > [ < tcp/udp-port tcp/udp-port range > icmp-type ] [cnt ]”

61)

Nas-filter-Rule = : Standard attribute for filtering inbound IPv4 traffic from an authenticated client. Refer also to table 6-4, “Nas-Filter-Rule Attribute Options” on page 6-18.

HP-Nas-filter-Rule = : Legacy HP VSA for filtering inbound IPv4 traffic from an authenticated client. Refer also to table 6-4, “Nas-Filter-Rule Attribute Options” on page 6-18.

“. . . “ : Must be used to enclose and identifies a complete permit or deny ACE syntax

statement. For example: Nas-filter-Rule=”deny in tcp from any to 0.0.0.0/0 23”

<permit deny >: Specifies whether to forward or drop the identified IP traffic type from the authenticated client. (For information on explicitly permitting or denying all inbound IP traffic from an authenticated client, or for implicitly denying all such IP traffic not already permitted or denied, refer to “Configuration Notes” on page 6-24.)

in: Required keyword specifying that the ACL applies only to the traffic inbound from the authenticated client.

<ip ip-protocol-value>: Options for specifying the type of traffic to filter.

ip: Applies the ACE to all IP traffic from the authenticated client.

ip-protocol-value:This option applies the ACE to the type of IP traffic specified by either a protocol number or by tcp, udp, icmp, or (for IPv4-only) igmp. The range of protocol numbers is 0-255. (Protocol numbers are defined in RFC 2780. For a complete listing, refer to “Protocol Registries” on the Web site of the Internet Assigned Numbers Authority at www.iana.com.) Some examples of protocol numbers include:

1

= ICMP

17 = UDP

2

= IGMP (IPv4 only)

 

6

= TCP*IPv4 traffic only.

 

from any: Required keywords specifying the (authenticated) client source. (Note that a RADIUS-assigned ACL assigned to a port filters only the inbound traffic having a source MAC address that matches the MAC address of the client whose authentication invoked the ACL assignment.)

to: Required destination keyword.

6-19