Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 278)

16-10

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 16 Applying AAA for Network Access

Configuring Accounting for Network Access

Downloaded ACLs have two spaces between the word “access-list” and the name. These spaces serve to

differentiate a downloaded ACL from a local ACL. In this example, “79AD4A08” is a hash value

generated by the security appliance to help determine when ACL definitions have changed on the

RADIUS server.

Configuring a RADIUS Server to Download Per-User Access Control List Names

To download a name for an ACL that you already created on the security appliance from the RADIUS

server when a user authenticates, configure the IETF RADIUS filter-id attribute (attribute number 11)

as follows:

filter-id=

acl_name

Note In Cisco Secure ACS, the value for filter-id attributes are specified in boxes in the HTML interface,

omitting filter-id= and entering only acl_name.

For information about making unique per user the filter-id attribute value, see the documentation for your

RADIUS server.

See the “Adding an Extended Access List” section on page 13-9 to create an ACL on the security

appliance.

Configuring Accounting for Network Access

The security appliance can send accounting information to a RADIUS or TACACS+ server about any

TCP or UDP traffic that passes through the security appliance. If that traffic is also authenticated, then

the AAA server can maintain accounting information by username. If the traffic is not authenticated, the

AAA server can maintain accounting information by IP address. Accounting information includes when

sessions start and stop, username, the number of bytes that pass through the security appliance for the

session, the service used, and the duration of each session.

To configure accounting, perform the following steps:

Step 1 If you want the security appliance to provide accounting data per user, you must enable authentication.

For more information, see the “Enabling Network Access Authentication” section on page 16-3. If you

want the security appliance to provide accounting data per IP address, enabling authentication is not

necessary and you can continue to the next step.

Step 2 Using the access-list command, create an ACL that identifies the source addresses and destination

addresses of traffic you want accounted. For steps, see the “Adding an Extended Access List” section on

page 13-9.

The permit ACEs mark matching traffic for authorization, while deny entries exclude matching traffic

from authorization.

Note If you have configured authentication and want accounting data for all the traffic being

authenticated, you can use the same ACL you created for use with the aaa authentication match

command.

1 2 ... 273 274 275 276 277 278 279 280 281 282 283 ... 603 604

Brak uwag

Cisco PIX 525 Dokumentacja Strona 278