In fact both ATTR_ID=1 and the " lcp:interface-config#3=ip access-group 198 in" methods do work.
I was relying on the output "show run int Vixxx full" and/or "show int Vixxx" to display the access-group applied to the interface. This does not happen. Thanks to you and Ivan P. for chiming in. Once I decided to actually test it, I can see that it's working. Thanks again, -Chris On 9/3/2010 1:36 AM, Per Carlson wrote: > Hi. > >> I'm looking for a way to pass ACLs via radius. > > To begin with, why are you sending the VRF-info 3 times, in two different > ways? > >> 126083: Sep 2 16:32:10 PDT: RADIUS: Vendor, Cisco [26] 55 >> 126084: Sep 2 16:32:10 PDT: RADIUS: Cisco AVpair [1] 49 >> "lcp:interface-config#1=ip vrf forwarding TestCo" > >> 126087: Sep 2 16:32:10 PDT: RADIUS: Vendor, Cisco [26] 24 >> 126088: Sep 2 16:32:10 PDT: RADIUS: Cisco AVpair [1] 18 >> "ip:vrf-id=TestCo" > >> 126089: Sep 2 16:32:10 PDT: RADIUS: Vendor, Cisco [26] 24 >> 126090: Sep 2 16:32:10 PDT: RADIUS: Cisco AVpair [1] 18 >> "ip:vrf-id=TestCo" > > It will suffice with one of those, and the last one > (ip:vrf-id=<vrfname>) is prefered (as far as I can recall). > > >> The docs seem to imply that is supported but I cannot >> figure out which permutation of radius attributes to send. > > Are you refering to the RADIUS doc > (http://www.cisco.com/en/US/docs/ios/sec_user_services/configuration/guide/sec_rad_ov_ietf_attr_ps10591_TSD_Products_Configuration_Guide_Chapter.html#wp1055985 > [0])? > > The doc for attribute 11 states: "For Framed service, use %d or %d.out > as interface output access list, and %d.in for input access list. The > numbers are self-encoding to the protocol to which they refer.". I > would *assume* this requires a numbered ACL, not a named one. > > If changing to a numbered one doesn't work, you can change from > Filter-ID's to VSAs instead. To send a ACL "in the Cisco way", use > "ip:inacl=n" (or ip:outacl=n) where n is the ACL number, OR > "lcp:interface-config#2=ip access-group <name|number> <in|out>". All > this are to be found in the TACACS+ Config Guide > (http://www.cisco.com/en/US/docs/ios/sec_user_services/configuration/guide/sec_tacacs_attr_vp_ps10591_TSD_Products_Configuration_Guide_Chapter.html#wp1054081 > [1]), but it will also work with RADIUS. > > [0] http://bit.ly/cyKIsW > [1] http://bit.ly/9FALMO > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
