Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 2137 / 2164

1-13
Cisco ASA Series CLI Configuration Guide
Appendix 1 Configuring an External Server for Authorization and Authentication
Configuring an External LDAP Server
Cisco AV Pair Attribute Syntax
The Cisco Attribute Value (AV) pair (ID Number 26/9/1) can be used to enforce access lists from a
RADIUS server (like Cisco ACS), or from an LDAP server via an LDAP attribute map.
The syntax of each Cisco-AV-Pair rule is as follows:
[Prefix] [Action] [Protocol] [Source] [Source Wildcard Mask] [Destination] [Destination Wildcard
Mask] [Established] [Log] [Operator] [Port]
Table 1-3 describes the syntax rules.
Cisco AV Pairs ACL Examples
Table 1-4 shows examples of Cisco AV pairs and describes the permit or deny actions that result.
Note
Each ACL # in inacl# must be unique. However, they do not need to be sequential (for example, 1, 2, 3,
4). That is, they could be 5, 45, 135.
Table 1-3 AV-Pair Attribute Syntax Rules
Field Description
Action Action to perform if the rule matches a deny or a permit.
Destination Network or host that receives the packet. Specify it as an IP address, a
hostname, or the
any keyword. If using an IP address, the source wildcard
mask must follow.
Destination Wildcard
Mask The wildcard mask that applies to the destination address.
Log Generates a FILTER log message. You must use this keyword to generate
events of severity level 9.
Operator Logic operators: greater than, less than, equal to, not equal to.
Port The number of a TCP or UDP port in the range of 0 - 65535.
Prefix A unique identifier for the AV pair (for example: ip:inacl#1= for standard
access lists or webvpn:inacl# = for clientless SSL VPN access lists). This
field only appears when the filter has been sent as an AV pair.
Protocol Number or name of an IP protocol. Either an integer in the range of 0 - 255
or one of the following keywords:
icmp , igmp , ip , tcp , udp .
Source Network or host that sends the packet. Specify it as an IP address, a
hostname, or the
any keyword. If using an IP address, the source wildcard
mask must follow. This field does not apply to Clientless SSL VPN because
the ASA has the role of the source or proxy.
Source Wildcard Mask The wildcard mask that applies to the source address. This field does not
apply to Clientless SSL VPN because the ASA has the role of the source or
proxy.