Dynamic ACL for External Radius Accounts (ACS 5.3)

[tobin_jim]

We have a Cisco ACS 5.2 server that queries another radius server for certain AnyConnect VPN connections. We already use dynamic access-lists for some users in the Interal Identity Users Store. We would like to tie in a dynamic access-list to users in the external database, based on the username passed back from the external radius server. We are running ACS 5.3.0.40. Is it possible to do this?

[jrabinow]

I think this can be done. need to have an attribute that is retrieved from the external store with the name of the DACL.

Then build an authorization profile that dynamically takes the name of the DACL from this retirved attribute

If this direction makes sense and you need info on netx level of detail let me know

[tobin_jim]

I think what you've described is what I am trying to achieve. Basically the logic I am trying to implement, using programming logic is:

If you see Username=testuser1 then appy DACL=testuseracl

Any more details you can provided would be appreciated.

[jrabinow · Accepted solution]

[of running 5.3 and using AD then suggest to install latest 5.3 patch]

OK. Assume attribute is in AD and called DACL; then do the follwoing

1) Go to

Users and Identity Stores > External Identity Stores > Active Directory

and select "Directory Attributes" tab

2) Add the attribute called DACL and Save changes

3) Build the authorization profile that will return the DACL

go to

Policy Elements > Authorization and Permissions > Network Access > Authorization Profiles > Create

in "Common Tasks" tab, select "Dynamic" option for Downloadable ACL Name

then select "AD-AD1" and the attribute selected in step 2

and press Submit

You know an authoirzation profile that will dynamically retrieve the attribute from AD and use as the name of the downloadable ACS

4) Select this authoirzation profile as result in authorization policy

eg:

Access Policies > Access Services > Default Network Access > Authorization

Should be good to go

[tobin_jim]

Thanks for the response. Our external database if Radius but I think we can get it to send back a Radius attribute string that we can use to map the ACLs to.