Nortel Networks 2300 manual Mapping User-Based Security ACLs

366Configuring and Managing Security ACLs

Mapping User-Based Security ACLs

When you configure administrator or user authentication, you can set a Filter-Id authorization attribute at the RADIUS server or at the WSS switch’s local database. The Filter-Id attribute is a security ACL name with the direction of the packets appended—for example, acl-name.inor acl-name.out. The security ACL mapped by Filter-Id instructs the WSS switch to use its local definition of the ACL, including the flow direction, to filter packets for the authenticated user.

Note. The Filter-Id attribute is more often received by the WSS through an external AAA RADIUS server than applied through the local database.

To map a security ACL to a user session, follow these steps:

1Create the security ACL. For example, to filter packets coming from 192.168.253.1 and going to 192.168.253.12, type the following command:

23x0# set security acl ip acl-222 permit ip 192.168.253.1 0.0.0.0 198.168.253.12 0.0.0.0 hits

2Commit the security ACL to the running configuration. For example, to commit acl-222, type the following command:

23x0# commit security acl acl-222 success: change accepted.

3Apply the Filter-Id authentication attribute to a user’s session through an external RADIUS server. For instructions, see the documentation for your RADIUS server.

Note. If the Filter-Id value returned through the authentication and authorization process does not match the name of a committed security ACL in the WSS, the user fails authorization and cannot be authenticated.

4Alternatively, authenticate the user with the Filter-Id attribute in the WSS switch’s local database. Use one of the following commands. Specify .in for incoming packets or .out for outgoing packets.

Mapping Target

User authenticated by a password

User authenticated by a MAC address

Commands

set user username attr filter-id acl-name.in set user username attr filter-id acl-name.out

set mac-user username attr filter-id acl-name.in set mac-user username attr filter-id acl-name.out

When assigned the Filter-Id attribute, an authenticated user with a current session receives packets based on the security ACL. For example, to restrict incoming packets for Natasha to those specified in acl-222, type the following command:

23x0# set user Natasha attr filter-id acl-222.in

success: change accepted.

320657-A