Cisco ASA 5508-X, Руководство по настройке, Страница: 371 / 428

15-15
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 15 Inspection of Database, Directory, and Management Protocols
RADIUS Accounting Inspection
parameters
send response
enable gprs
validate-attribute 31
host 10.2.2.2 key 123456789
host 10.1.1.1 key 12345
class-map type management radius-class
match port udp eq radius-acct
policy-map global_policy
class radius-class
inspect radius-accounting radius-acct-pmap
Configure the RADIUS Accounting Inspection Service Policy
RADIUS accounting inspection is not enabled in the default inspection policy, so you must enable it if
you need this inspection. Because RADIUS accounting inspection is for traffic directed to the ASA, you
must configure it as a management inspection rule rather than a standard rule.
Procedure
Step 1 Create an L3/L4 management class map to identify the traffic for which you want to apply the inspection,
and identify the matching traffic.
class-map type management name
match {port | access-list} parameter
Example:
hostname(config)# class-map type management radius-class-map
hostname(config-cmap)# match port udp eq radius-acct
In this example, the match is for the radius-acct UDP port, which is 1646. You can specify a different
port, a range of ports (
match port udp range number1 number2 ) or use match access-list acl_name
and use an ACL.
Step 2
Add or edit a policy map that sets the actions to take with the class map traffic.
policy-map
name
Example:
hostname(config)# policy-map global_policy
In the default configuration, the global_policy policy map is assigned globally to all interfaces. If you
want to edit the global_policy, enter global_policy as the policy name.
Step 3 Identify the L3/L4 management class map you are using for RADIUS accounting inspection.
class name
Example:
hostname(config-pmap)# class radius-class-map
Step 4 Configure RADIUS accounting inspection.
inspect radius-accounting radius_accounting_policy_map
Where radius_accounting_policy_map is the RADIUS accounting inspection policy map you created in
Configure a RADIUS Accounting Inspection Policy Map, page 15-14 .