cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
545
Views
0
Helpful
1
Replies

ACS 3.3 Access Restriction Question

raun.williams
Level 3
Level 3

Hello all. We're currently running ACS 3.3.3 and are wanting to restrict access for a particuler user based up on his MAC address, simply wether or not he can connect or not. It doesn't necessarly need to be the MAC, but something unique to that Host, the hostname, mac address, ect. We can't use the IP as it is DSL and dhcp. The user will have full rights, but we just want him coming off a particuler machine(laptop). He would be going through our ASA5520. Any ideas?

1 Reply 1

darpotter
Level 5
Level 5

In theory NARs should work for you - depending on what the ASA sticks in its authentication request.

For layer 2 authentications ACS applies CLI/DNIS NARs. Traditionally with dial the AAA client would put the calling number and called number into the RADIUS attributes: Calling-Station-Id and Called-Station-Id respectively.

With 802.1x devices stick the MAC address of the endpoint into Calling-Station-Id.

If the ASA does this to you can create a CLI/DNIS NAR just for this user (in the user record) that has a single permit entry:

AAA Client = All AAA Clients

Port = *

CLI =

DNIS = *

Note that user level NARs need to be enabled under interface config first.

Darran