Cisco ASA 5506-X Configuration Manual page 250

RADIUS Accounting Inspection
match port udp eq radius-acct
policy-map global_policy
class radius-class
Configure the RADIUS Accounting Inspection Service Policy
RADIUS accounting inspection is not enabled in the default inspection policy, so you must enable it if
you need this inspection. Because RADIUS accounting inspection is for traffic directed to the ASA, you
must configure it as a management inspection rule rather than a standard rule.
Procedure
Create an L3/L4 management class map to identify the traffic for which you want to apply the inspection,
Step 1
and identify the matching traffic.
class-map type management name
match {port | access-list} parameter
Example:
hostname(config)# class-map type management radius-class-map
hostname(config-cmap)# match port udp eq radius-acct
In this example, the match is for the radius-acct UDP port, which is 1646. You can specify a different
port, a range of ports (match port udp range number1 number2) or use match access-list acl_name
and use an ACL.
Add or edit a policy map that sets the actions to take with the class map traffic.
Step 2
policy-map name
Example:
hostname(config)# policy-map global_policy
In the default configuration, the global_policy policy map is assigned globally to all interfaces. If you
want to edit the global_policy, enter global_policy as the policy name.
Identify the L3/L4 management class map you are using for RADIUS accounting inspection.
Step 3
class name
Example:
hostname(config-pmap)# class radius-class-map
Configure RADIUS accounting inspection.
Step 4
inspect radius-accounting radius_accounting_policy_map
Where radius_accounting_policy_map is the RADIUS accounting inspection policy map you created in
Configure a RADIUS Accounting Inspection Policy Map, page
Example:
hostname(config-class)# no inspect radius-accounting
hostname(config-class)# inspect radius-accounting radius-class-map
Cisco ASA Series Firewall CLI Configuration Guide
10-14
inspect radius-accounting radius-acct-pmap
Chapter 10 Inspection for Management Application Protocols
10-12.