topic Cisco Secure ACS 4.1 - blocking authentication attempts to a spe in Network Access Control

Cisco Secure ACS 4.1 - blocking authentication attempts to a specific host

brian.emil.harris — Mon, 11 Mar 2019 03:12:17 GMT

We use ACS 4.1's RADIUS implementation for both wireless 802.1x and for our old PIX 515E authentication, along with a couple other devices.

We're attempting to migrate users off of the PIX, and want a method of disabling their ability to login via the PIX once we have migrated them to the new remote access method.

The passed authentication logs in ACS do show the IP of our PIX under "NAS-IP-Address" as the source of the auth attempt.

Is there a relatively simple/easy way to block attempts from that IP (causing those attempts to fail) while allowing the wireless and other systems to proceed as normal on a per-user basis?

Re: Cisco Secure ACS 4.1 - blocking authentication attempts to a

Amjad Abdullah — Sat, 16 Mar 2013 07:18:16 GMT

Brian:

If I understood correctly, you need to allow users to connect to the wifi but prevent same users from connecting via PIX.

What you can do is to create a Network Access Restriction (NAR) config under the gorup config (or under user config if per-user basis).

see this image:

If you do not see the network access restriciton config under the user and/or group config, you can enable it from Interface configuration -> Advanced options.

HTH

Amjad

Rating useful replies is more useful than saying "Thank you"

Cisco Secure ACS 4.1 - blocking authentication attempts to a spe

brian.emil.harris — Tue, 19 Mar 2013 15:42:38 GMT

Excellent, thank you very much! That does it, perfectly!

Cisco Secure ACS 4.1 - blocking authentication attempts to a spe

Amjad Abdullah — Wed, 20 Mar 2013 05:29:41 GMT

Thanks Brian. I am glad that I was able to help.

Rating useful replies is more useful than saying "Thank you"