topic Re: ACS NAR Configuration problem in Network Access Control

ACS NAR Configuration problem

miklos.andrasi — Sun, 10 Mar 2019 23:26:18 GMT

Hi all!

I have a problem with configuration of Network Access Restriction.

I set the feature via Shared Profile Component and Group Level NAR also, but none of them works.

My test AAA client is a VASCO RADIUS Client Simulator. I thought that this software doesn't send the proper RADIUS attributes, but behaviour of ACS is never prohibitive, but sometime it should be.

I tried it with version 3.2 and 4.2 also.

Is there a trick or something I messed up?

Thank you for the answeres!

Re: ACS NAR Configuration problem

Jagdeep Gambhir — Tue, 14 Apr 2009 13:25:03 GMT

NAR works on the basis of attributes sent by aaa client.

IP-based NAR filters work only if ACS receives the Radius Calling-Station-Id (31) attribute. The Calling-Station-Id (31) must contain a valid IP address. If it does not, it will fall over to DNIS rules.

See this link

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/user/SPC.html#wpxref8530

Regards,

~JG

Do rate helpful posts

Re: ACS NAR Configuration problem

miklos.andrasi — Tue, 14 Apr 2009 13:49:59 GMT

Would it be problem, if I use RADIUS (IETF) "Authentication using" in the Network Configuration in ACS for Wireless AP? The productive envirement contains this configuration, and another device with TACACS+ configuration.

Re: ACS NAR Configuration problem

Jagdeep Gambhir — Tue, 14 Apr 2009 14:05:20 GMT

For wireless user you need to use CLIS/DNIS based access restriction.

If you user Radius IETF for wireless AP, basic authentication should work but issue would be with authorization part.

Regards,

~JG

Re: ACS NAR Configuration problem

miklos.andrasi — Wed, 15 Apr 2009 11:31:01 GMT

Thank you for your answers. If I use CLIS/DNIS based access restriction, it works but in case of router works only with CLIS/DNIS based access restriction also. It's interest for me.

Regards,

Miki