topic ACS5 - Replacement for IP Pools in Network Access Control

ACS5 - Replacement for IP Pools

Paul Masterton — Mon, 11 Mar 2019 03:01:02 GMT

All,

I know ACS 5 lacks the IP Pools of earlier ACS versions. I'm looking at a 4 to 5 migration and was thinking of just configuring the IP Pools on the router ("ip pool local" etc) and sending back a RADIUS Cisco Attribute pair with the name of the pool. (Seemed like a neat fix, needs no extra kit, etc.)

I could have sworn that attribute pair existed... but I can't find it in ACS5! What's it's name?! Where is it!? Or have I gone mad!? (And, if I have gone mad, how would you go about fixing it?)

Cheers!

ACS5 - Replacement for IP Pools

Karsten Iwen — Sun, 27 Jan 2013 13:46:13 GMT

For the ASA it's the Attribute 217 "Address-Pools":

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/ref_extserver.html#wp1802187

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

ACS5 - Replacement for IP Pools

Amjad Abdullah — Mon, 28 Jan 2013 06:57:15 GMT

Hi Paul,

There are two attributs regarding the pools:

217 cisco-ip-pool-definition

218 cisco-assign-ip-pool

Those are configurable in ACS 5.x from ACS GUI:

Policy Elements -> Authorization and Permissions -> Network Access -> Authorization Profiles.

You create the authorization profile then from the "Radius Attributes" tab you choose the directory type = "RADIUS-Cisco".

Then if you press on the "select" button beside "RADIUS Attribute" field it will list you all the cisco attributes where 217 and 218 are included.

HTH

Amjad

Rating useful replies is more useful than saying "Thank you"

ACS5 - Replacement for IP Pools

codewize — Thu, 12 Dec 2013 15:39:59 GMT

So then how do we define the pools? There's a lot of discussion regarding this topic. I'm not exactlly sure why Ciso thought it was a good idea to remove this feature but I know there's a workaround.

The workaround I saw was to use pre defined pools from another device such as a router. That's fine but whats the ACS config to do that?

Someone has to know the answer to this.