Cisco Secure ACS 4.1 - blocking authentication attempts to a specific host

[brian.emil.harris]

We use ACS 4.1's RADIUS implementation for both wireless 802.1x and for our old PIX 515E authentication, along with a couple other devices.

We're attempting to migrate users off of the PIX, and want a method of disabling their ability to login via the PIX once we have migrated them to the new remote access method.

The passed authentication logs in ACS do show the IP of our PIX under "NAS-IP-Address" as the source of the auth attempt.

Is there a relatively simple/easy way to block attempts from that IP (causing those attempts to fail) while allowing the wireless and other systems to proceed as normal on a per-user basis?

[Amjad Abdullah · Accepted solution]

Brian:

If I understood correctly, you need to allow users to connect to the wifi but prevent same users from connecting via PIX.

What you can do is to create a Network Access Restriction (NAR) config under the gorup config (or under user config if per-user basis).

see this image:

If you do not see the network access restriciton config under the user and/or group config, you can enable it from Interface configuration -> Advanced options.

HTH

Amjad

Rating useful replies is more useful than saying "Thank you"

[brian.emil.harris]

Excellent, thank you very much!  That does it, perfectly!

[Amjad Abdullah]

Thanks Brian. I am glad that I was able to help.

Rating useful replies is more useful than saying "Thank you"