ACS 3.3 Access Restriction Question
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-17-2006 10:42 AM - edited 03-10-2019 02:48 PM
Hello all. We're currently running ACS 3.3.3 and are wanting to restrict access for a particuler user based up on his MAC address, simply wether or not he can connect or not. It doesn't necessarly need to be the MAC, but something unique to that Host, the hostname, mac address, ect. We can't use the IP as it is DSL and dhcp. The user will have full rights, but we just want him coming off a particuler machine(laptop). He would be going through our ASA5520. Any ideas?
- Labels:
-
AAA
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-18-2006 02:43 AM
In theory NARs should work for you - depending on what the ASA sticks in its authentication request.
For layer 2 authentications ACS applies CLI/DNIS NARs. Traditionally with dial the AAA client would put the calling number and called number into the RADIUS attributes: Calling-Station-Id and Called-Station-Id respectively.
With 802.1x devices stick the MAC address of the endpoint into Calling-Station-Id.
If the ASA does this to you can create a CLI/DNIS NAR just for this user (in the user record) that has a single permit entry:
AAA Client = All AAA Clients
Port = *
CLI =
DNIS = *
Note that user level NARs need to be enabled under interface config first.
Darran
