topic Cisco-assign-ip-pool RADIUS VSA is an integer? in Network Access Control

Cisco-assign-ip-pool RADIUS VSA is an integer?

Alex Kitaichik — Mon, 11 Mar 2019 03:06:23 GMT

Hi all,

I'm trying to configure IP pool selection by RADIUS on ACS 5-3-0-40-7.

So, I went to configuring the cisco-assign-ip-pool (Cisco VSA 218) attribute within some test authorization profile but discovered that cisco-assign-ip-pool is an integer (?!) and (therefore) accepts digits only.

As far as I can remember, we used to put pool *names* within ip:addr-pool (something along those lines: cisco-avpair = "ip:addr-pool=test-pool-1").

So how should we configure the values for this attribute in ACS 5?

Cisco-assign-ip-pool RADIUS VSA is an integer?

Jatin Katyal — Tue, 19 Feb 2013 13:15:13 GMT

If your NAS is "RADIUS (Cisco IOS/PIX)" it will use a Cisco-AVPair attribute with "ip:addr-pool=poolname" inside it.

If your NAS is just about any other RADIUS type, it will use attribute 88, Framed-Pool.

Use the dictionary Radius-Cisco and then select cisco av-pair in the radius authorization profile.

After that configure:

ip:addr-pool=poolname

The pool should be defined on the device itself like ASA. The ACS will only push the name of it.

Jatin Katyal
- Do rate helpful posts -

Cisco-assign-ip-pool RADIUS VSA is an integer?

jrabinow — Tue, 19 Feb 2013 13:15:41 GMT

I have checked and you can change the type of this attribute

However, you first need to make sure it is not in use in any authorization profile

To change the type go to:

System Administration > Configuration > Dictionaries > Protocols > RADIUS > RADIUS VSA > Cisco

and can then edit the type of the attribute with id of 218

I am not familiar with the specifics of this attribute and whether should change the default definitions here and so wil be interesting to see how things progress

Cisco-assign-ip-pool RADIUS VSA is an integer?

Alex Kitaichik — Tue, 19 Feb 2013 13:24:59 GMT

Hi jkatyal,

Thank you for your reply. The problem with ACS 5-3-0-40-7 is that VSA 218 (e.g. ip:addr-pool) is pre-configured to be integer. Hence, i can't put there "ip:addr-pool=poolname" or anything similar for that matter. ACS (based on the pre-configured type, I guess), accepts digits only.

That's the question. How can it be an integer.

Thank you.

Cisco-assign-ip-pool RADIUS VSA is an integer?

Alex Kitaichik — Tue, 19 Feb 2013 13:30:49 GMT

Hi jrabinow,

I suspected an error within the directory but i'd like it to be fixed for everybody (in case the VSA IS pre-configured wrong) and I prefer not to change such values based on my understanding of the RFC

Additionally, I'm having a hard time finding a documentation on the syntax I should use - should I put there the pool name, ip:addr-pool=poolname, some other syntax.

Thank you.