ACS 3.3 Access Restriction Question

[raun.williams]

Hello all. We're currently running ACS 3.3.3 and are wanting to restrict access for a particuler user based up on his MAC address, simply wether or not he can connect or not. It doesn't necessarly need to be the MAC, but something unique to that Host, the hostname, mac address, ect. We can't use the IP as it is DSL and dhcp. The user will have full rights, but we just want him coming off a particuler machine(laptop). He would be going through our ASA5520. Any ideas?

[darpotter]

In theory NARs should work for you - depending on what the ASA sticks in its authentication request.

For layer 2 authentications ACS applies CLI/DNIS NARs. Traditionally with dial the AAA client would put the calling number and called number into the RADIUS attributes: Calling-Station-Id and Called-Station-Id respectively.

With 802.1x devices stick the MAC address of the endpoint into Calling-Station-Id.

If the ASA does this to you can create a CLI/DNIS NAR just for this user (in the user record) that has a single permit entry:

AAA Client = All AAA Clients

Port = *

CLI =

DNIS = *

Note that user level NARs need to be enabled under interface config first.

Darran