How to add more downloadable IP ACLs to Cisco Secure access control server once it reaches maximum limit

[TCC_2]

Resolution

The workaround to add more downloadable access control lists (ACLs) on the Cisco Secure access control server (ACS) is to use the object-group command. Refer to the example below:

Configuration on the PIX/ASA:

name 192.6.x.x HOST_SERVER

object-group service SVC_GROUP tcp
port-object eq 12006
port-object eq 12031
port-object eq 12915

object-group network HOST_GROUP
network-object host 192.7.x.x
network-object host 192.8.x.x
network-object host 192.9.x.x
network-object host 192.5.x.x
network-object host 192.4.x.x
network-object host 192.3.x.x
network-object host HOST_SERVER

This is the configuration for Downloadable IP ACLs:

permit tcp any object-group HOST_GROUP object-group SVC_GROUP

The previous ACL can be used to sum up the ACLs in the Downloadable IP ACLs section in order to not cross the limit of 32 KB.

Refer to the Downloadable IP ACLs section of Shared Profile Components for more information.

Features & Tasks

Access lists