Using VSA 61 to assign IPv4 ACLs

The recommended use of this option is to support legacy ACL configurations that rely on VSA 61. Beginning with software release K.14.01, Hewlett Packard Enterprise recommends using the standard attribute (92) for new, RADIUS-based IPv4 ACLs, see Nas-filter-Rule attributes, and Configuring RADIUS-assigned IPv4 ACL support on FreeRADIUS.

This example uses the VSA attribute 61 for configuring RADIUS-assigned IPv4 ACL support on FreeRADIUS for two different client identification methods (user name/password and MAC address).

Procedure
  1. Enter the HPE vendor-specific ID and the ACL VSA in the FreeRADIUS dictionary file:
    Configuring the VSA for RADIUS-assigned IPv4 ACLs in a FreeRADIUS server
  2. Enter the switch IPv4 address, NAS (Network Attached Server) type, and the key used in the FreeRADIUS clients.conf file. For example, if the switch IP address is 10.10.10.125 and the key ("secret") is "1234", you would enter the following in the server clients.conf file:
    Switch identity information for a FreeRADIUS application
  3. For a given client user name/password pair, create an ACL by entering one or more IPv4 ACEs in the FreeRADIUS "users" file. Remember that the ACL created to filter IPv4 traffic automatically includes an implicit deny in ip from any to any ACE (for IPv4). For example, to create ACL support for a client having a user name of "User-10" and a password of "auth7X". The ACL in this example must achieve the following:
    • Permit http (TCP port 80) traffic from the client to the device at 10.10.10.117.

    • Deny http (TCP port 80) traffic from the client to all other IPv4 addresses.

    • Deny Telnet (TCP port 23) traffic from the client to any IPv4 address.

    • Permit all other IPv4 traffic from the client to all other devices.

  4. To configure the above ACL, you would enter the user name/password and ACE information shown in Configuring a FreeRADIUS server to filter IPv4 traffic for a client with the correct credentials into the FreeRADIUS "users" file.
    Configuring a FreeRADIUS server to filter IPv4 traffic for a client with the correct credentials