58
Enhancements
Release M.10.02 Enhancements
Configuring an ACL in a RADIUS Server
This section provides general guidelines for configuring a RADIUS server to specify RADIUS-based
ACLs. Also included is an example configuration for a FreeRADIUS server application. However, to
configure support for these services on a specific RADIUS server application, please refer to the
documentation provided with the application.
Elements in a RADIUS-Based ACL Configuration.
A RADIUS-based ACL configuration in a
RADIUS server has the following elements:
■
vendor and ACL identifiers:
•
ProCurve (HP) Vendor-Specific ID: 11
•
Vendor-Specific Attribute for ACLs: 61 (string = HP-IP-FILTER-RAW)
•
Setting: HP-IP-FILTER-RAW = < “permit” or “deny” ACE >
(Note that the “string” value and the “Setting” specifier are identical.)
■
ACL configuration, including:
•
one or more explicit “permit” and/or “deny” ACEs created by the system operator
•
implicit
deny in ip from any to any
ACE automatically active after the last operator-created
ACE
■
ACEs define the ACL for a given client:
•
A given ACE configuration on a RADIUS server includes the identity of the client to
which it applies. That is, the ACE includes the client username/password pair or the
client device’s MAC address.
•
All ACEs configured on a RADIUS server for the same client are interpreted as belonging
to the same ACL. (There is no ACL name or number configured on the RADIUS server.)
Example of Configuring a RADIUS-based ACL Using the FreeRADIUS Application.
This
example illustrates one method for configuring RADIUS-based ACL support for two different client
identification methods (username/password and MAC address). For information on how to configure
this functionality on other RADIUS server types, refer to the documentation provided with the server.
1.
Enter the HP vendor-specific ID and the ACL VSA in the FreeRADIUS
dictionary
file:
Per-Port Mask Usage
ACLs consume per-port (internal) mask resources rapidly and can be affected by
IGMP usage on the same switch. For more on this topic, refer to the “ACL
Resource Usage and Monitoring” and “Extended ACLs” subsections in the
chapter titled “Access Control Lists (ACLs) for the Series 3400cl and Series 6400cl
Switches” of the
Advanced Traffic Management Guide
for your 3400cl switch.
Item
Limit Notes