Hi. > I'm looking for a way to pass ACLs via radius.
To begin with, why are you sending the VRF-info 3 times, in two different ways? > 126083: Sep 2 16:32:10 PDT: RADIUS: Vendor, Cisco [26] 55 > 126084: Sep 2 16:32:10 PDT: RADIUS: Cisco AVpair [1] 49 > "lcp:interface-config#1=ip vrf forwarding TestCo" > 126087: Sep 2 16:32:10 PDT: RADIUS: Vendor, Cisco [26] 24 > 126088: Sep 2 16:32:10 PDT: RADIUS: Cisco AVpair [1] 18 > "ip:vrf-id=TestCo" > 126089: Sep 2 16:32:10 PDT: RADIUS: Vendor, Cisco [26] 24 > 126090: Sep 2 16:32:10 PDT: RADIUS: Cisco AVpair [1] 18 > "ip:vrf-id=TestCo" It will suffice with one of those, and the last one (ip:vrf-id=<vrfname>) is prefered (as far as I can recall). > The docs seem to imply that is supported but I cannot > figure out which permutation of radius attributes to send. Are you refering to the RADIUS doc (http://www.cisco.com/en/US/docs/ios/sec_user_services/configuration/guide/sec_rad_ov_ietf_attr_ps10591_TSD_Products_Configuration_Guide_Chapter.html#wp1055985 [0])? The doc for attribute 11 states: "For Framed service, use %d or %d.out as interface output access list, and %d.in for input access list. The numbers are self-encoding to the protocol to which they refer.". I would *assume* this requires a numbered ACL, not a named one. If changing to a numbered one doesn't work, you can change from Filter-ID's to VSAs instead. To send a ACL "in the Cisco way", use "ip:inacl=n" (or ip:outacl=n) where n is the ACL number, OR "lcp:interface-config#2=ip access-group <name|number> <in|out>". All this are to be found in the TACACS+ Config Guide (http://www.cisco.com/en/US/docs/ios/sec_user_services/configuration/guide/sec_tacacs_attr_vp_ps10591_TSD_Products_Configuration_Guide_Chapter.html#wp1054081 [1]), but it will also work with RADIUS. [0] http://bit.ly/cyKIsW [1] http://bit.ly/9FALMO -- Pelle RFC1925, truth 11: Every old idea will be proposed again with a different name and a different presentation, regardless of whether it works. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
