Example Using Hp Vsa 61 To Assign Ipv4 Acls - HP 3500yl Series Access Security Manual

Example Using HP VSA 61 To Assign IPv4 ACLs

Software release K.14.01 continues to support the HP VSA 61 vendor-specific
method of earlier releases for enabling RADIUS-based IPv4 ACL assignments
on the switch. The recommended use of this option is to support legacy ACL
configurations that rely on VSA 61. Beginning with software release K.14.01,
HP recommends using the standard attribute (92) for new, RADIUS-based IPv4
ACLs (pages 7-24 and 7-28).
This example uses the HP VSA attribute 61 for configuring RADIUS-assigned
IPv4 ACL support on FreeRADIUS for two different client identification
methods (username/password and MAC address).
1.
VENDOR
BEGIN-VENDOR
ATTRIBUTE
END-VENDOR
Figure 7-9. Example of Configuring the VSA for RADIUS-Assigned IPv4 ACLs in a FreeRADIUS Server
2.
client 10.10.18.12
nastype =
secret = 1234
Figure 7-10. Example of Switch Identity Information for a FreeRADIUS Application
3.
Configuring and Using Dynamic (RADIUS-Assigned) Access Control Lists
Enter the HP vendor-specific ID and the ACL VSA in the
FreeRADIUS dictionary file:
HP 11
HP
HP-Nas-filter-Rule 61 STRING
HP
Enter the switch IPv4 address, NAS (Network Attached Server) type, and
the key used in the FreeRADIUS clients.conf file. For example, if the switch
IP address is 10.10.10.125 and the key ("secret") is "1234", you would enter
the following in the server's clients.conf file:
other
For a given client username/password pair, create an ACL by entering one
or more IPv4 ACEs in the FreeRADIUS "users" file. Remember that the
ACL you create to filter IPv4 traffic automatically includes an implicit deny
in ip from any to any ACE (for IPv4). For example, suppose that you wanted
Configuring RADIUS Server Support for Switch Services
HP Vendor-Specific ID
HP Vendor-Specific Attribute for
RADIUS-Assigned ACLs
Note that if you were also using the RADIUS server to
administer 802.1p (CoS) priority and/or Rate-Limiting, you
would also insert the ATTRIBUTE entries for these
functions above the END-VENDOR entry.
Note: The key configured in the switch and the
secret configured in the RADIUS server
supporting the switch must be identical. Refer
to the chapter titled "RADIUS Authentication
and Accounting" in the latest Access Security
Guide for your switch.
7-33