topic Re: Using AAA to limit access rights in Network Access Control

Using AAA to limit access rights

fred.mancen — Sun, 10 Mar 2019 22:39:29 GMT

Hi there.

I have a 2611 router, IOS version 12.3(25), configured as an VPN server. I have already configured the IP Sec parameters, users...and it is all working fine. But my customer needs to limit the access of one user that uses the same group and interface of the others. Is it possible to set up an AAA profile that matches some ACL to permit access to a few IP addresses, without a authentication server? I was thinking a method to set up an ACL and implement it on the interface, but this will affect the traffic of the other users, since their external access addresses are dynamic (one time they are at home, other time they are on the remote office and so on). Any ideas? Thanks in advance.

Regards.

Re: Using AAA to limit access rights

Jagdeep Gambhir — Fri, 15 Feb 2008 14:56:08 GMT

Go for downloadable acl's. Following

requirements must be met:

* The AAA client must use RADIUS for authentication.

* The AAA client must support downloadable IP ACLs.

Examples of Cisco devices that support downloadable IP ACLs are:

* PIX Firewalls.

* VPN 3000-series concentrators.

* Cisco devices running IOS version 12.3(8)T or greater.

Check the following link for your reference:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/3.3/user/guide/c.html#wp696775

Regards,

~JG

Do rate helpful posts

Re: Using AAA to limit access rights

fred.mancen — Fri, 15 Feb 2008 15:55:56 GMT

Hey, Gambhir!

This link is great! I am reading carefully to make sure that it solves my problem; be sure that I will rate your post. Tks a lot!

Best regards.

Re: Using AAA to limit access rights

fred.mancen — Fri, 15 Feb 2008 18:37:41 GMT

Hi Gambhir.

Really, this document is fine, but does not solve my question...my customer does not have a RADIUS server that could be available to run the service. Unfortunately, because it will be the perfect solution. Anyway, thanks a lot.

regards.