Configuring RADIUS Server Support for Switch Services

Configuring and Using RADIUS-Assigned Access Control Lists

1.Enter the ACL standard attribute in the FreeRADIUS dictionary.rfc4849 file.

ATTRIBUTE

Nas-FILTER-Rule 92

2.Enter the switch IP address, NAS (Network Attached Server) type, and the key used in the FreeRADIUS clients.conf file. For example, if the switch IP address is 10.10.10.125 and the key (“secret”) is “1234”, you would enter the following in the server’s clients.conf file:

client 10.10.10.125 nastype = other secret = 1234

Note: The key configured in the switch and the secret configured in the RADIUS server supporting the switch must be identical. Refer to the chapter titled “RADIUS Authentication and Accounting” in the latest Access Security Guide for your switch.

Figure 6-3. Example of Switch Identity Information for a FreeRADIUS Application

3.For a given client username/password pair or MAC address, create an ACL by entering one or more ACEs in the FreeRADIUS “users” file. Remember that every ACL you create automatically includes an implicit deny in ip from any to any ACE. For example, suppose that you wanted to create identical ACL support for the following:

a client having a username of “mobilE011” and a password of “run10kFast”

a client having a MAC address of 08 E9 9C 4F 00 19

The ACL in this example must achieve the following:

permit http (TCP port 80) traffic from the client to the device at 10.10.10.101

deny http (TCP port 80) traffic from the client to all other devices

permit all other traffic from the client to all other devices

To configure the above ACL, you would enter the username/password and ACE information shown in figure 6-4into the FreeRADIUS “users” file.

Example of Configuring a RADIUS-assigned ACL Using the FreeRADIUS Application

This example illustrates one method for configuring RADIUS-assigned ACL support for two different client identification methods (username/password and MAC address). For information on how to configure this functionality on other RADIUS server types, refer to the documentation provided with the server.

6-21