HP E3800 Series, Access Security Manual

Page: 314 / 732

7-24
Configuring RADIUS Server Support for Switch Services
Configuring and Using Dynamic (RADIUS-Assigned) Access Control Lists
However, if you do not want both the IPv4 and IPv6 traffic of the selected type to go to their
respective “any” destinations, then two ACEs with explicit destination addresses are needed. In
this case, do one of the following:
• Use 0.0.0.0/0 in one ACE to specify the “any” destination for IPv4 traffic, and use a specific
IPv6 address for the destination in the other ACE.
• Use ::/0 in one ACE to specify the “any” destination for IPv6 traffic, and use a specific IPv4
address for the destination in the other ACE.
For example, if you want to allow the IPv4 Telnet traffic from a client to go to any destination, but
you want the IPv6 Telnet traffic from the same client to go only to a specific address or group of
addresses, you will need to distinguish the separate destinations. This is done by using explicit
addresses for the “any” destinations. For example:
HP-Nas-Rules-IPv6=1
Nas-filter-Rule=”deny in tcp from any to 0.0.0.0/0 23”
Nas-filter-Rule=”deny in tcp from any to fe80::b1 23”
The above example sends IPv4 Telnet traffic to its “any” destination, but allows IPv6 Telnet traffic
only to fe80::b1 23.To reverse this example, you would configure ACEs such as the following:
HP-Nas-Rules-IPv6=1
Nas-filter-Rule=”deny in tcp from any to 10.10.10.1 23”
Nas-filter-Rule=”deny in tcp from any to ::/0 23”
In cases where you do not want the selected traffic type for either IPv4 or IPv6 to go to the “any”
destination, you must use two ACEs to specify the destination addresses. For example:
HP-Nas-Rules-IPv6=1
Nas-filter-Rule=”deny in tcp from any to 10.10.10.1 23”
Nas-filter-Rule=”deny in tcp from any to fe80::23 23”
To use the IPv6 VSA while allowing only IPv4 traffic to be filtered, you would use a configuration
such as the following:
HP-Nas-Rules-IPv6=2
Nas-filter-Rule=”permit in tcp from any to any”
IPv4-Only ACLs
Applied to Client
Traffic Inbound to the
Switch
Assigns a RADIUS-
configured IPv4 ACL
to filter inbound IPv4
packets received from
a specific client
authenticated on a
switch port.
HP-Nas-Filter-Rule (Vendor-Specific Attribute): 61
This attribute is maintained for legacy purposes to support ACEs in RADIUS-assigned ACLs
capable of filtering only IPv4 traffic. However, for new or updated configurations (and any
configurations supporting IPv6 traffic filtering) HP recommends using the Standard Attribute (92)
described earlier in this table instead of the HP-Nas-filter-Rule attribute described here.
HP vendor-specific ID: 11
VSA: 61 (string = HP-Nas-Filter-Rule
Setting: HP-Nas-filter-Rule = “< permit or deny ACE >”
Note: An ACL applying this VSA to inbound traffic from an authenticated client drops any IPv6
traffic from the client.
Service Control Method and Operating Notes: