6-9
User Guide for Cisco Secure ACS for Windows Server
78-14696-01, Version 3.1
Chapter 6 Setting Up and Managing User Groups
Common User Group Settings
Step 4
To define and apply a NAR, for this particular user group, that permits or denies
access to this group based on IP address, or IP address and port, follow these
steps:
Tip
You should define most NARs from within the Shared Components section so that
the restrictions can be applied to more than one group or user. For more
information, see
Shared Network Access Restrictions Configuration, page 5-8
.
a.
In the Per Group Defined Network Access Restrictions section of the
Network Access Restrictions table, select the Define IP-based access
restrictions check box.
b.
To specify whether the subsequent listing specifies permitted or denied IP
addresses, from the Table Defines list, select either Permitted Calling/Point
of Access Locations or Denied Calling/Point of Access Locations.
c.
Select or enter the information in the following boxes:
•
AAA Client—Select either All AAA Clients or the name of the NDG or
the name of the individual AAA client to which to permit or deny access.
•
Port—Type the number of the port to which to permit or deny access.
You can use the wildcard asterisk (*) to permit or deny access to all ports
on the selected AAA client.
•
Address—Type the IP address or addresses to filter on when performing
access restrictions. You can use the wildcard asterisk (*).
d.
Click Enter.
Result: The specified the AAA client, port, and address information appears
in the NAR Access Control list.
Step 5
To permit or deny access to this user group based on calling location or values
other than an established IP address, follow these steps:
a.
Select the Define CLI/DNIS-based access restrictions check box.
b.
To specify whether the subsequent listing specifies permitted or denied
values, from the Table Defines list, select one of the following:
•
Permitted Calling/Point of Access Locations
•
Denied Calling/Point of Access Locations