IEOC - Internetwork Expert's Online Community

Ok, I must really be missing something on this one.

Based on the information on the doc site, I would have configured the solution like this:

access 102 permit udp any any

access 102 deny ip any any

aaa new-model
aaa authen eou default enable group radius
aaa autoriz network default group radius
radius-server host 173.1.137.252
radius-server key cisco

ip radius source-interface lo0

ip addmission name cisco eapoudp

int e0
ip addmission cisco
ip access 102 in

Obviously, from the solution guide my configuration is incorrect. Unfortunately, there is no explanation and the solution example is missing the acl. Can someone please give an explanation of the configuration provided in the solution guide? I've read through the NAC section of the doc site twice now and I don't understand how anyone would know to configure the inactivity timeout or the auth and acct ports.

Also, if someone does manage to authenticate to the radius server, wouldn't acl 102 still block traffic? In other words, if someone authenticates, how does the router know to let traffic pass instead of blocking it with acl 102?

I might be making this a lot more complicated than it is, but it would be very helpful if the solution guide actually had an explanation.

-Bobby

hoodooman211:

 

Obviously, from the solution guide my configuration is incorrect. Unfortunately, there is no explanation and the solution example is missing the acl. Can someone please give an explanation of the configuration provided in the solution guide? I've read through the NAC section of the doc site twice now and I don't understand how anyone would know to configure the inactivity timeout or the auth and acct ports.

Also, if someone does manage to authenticate to the radius server, wouldn't acl 102 still block traffic? In other words, if someone authenticates, how does the router know to let traffic pass instead of blocking it with acl 102?

I might be making this a lot more complicated than it is, but it would be very helpful if the solution guide actually had an explanation.

-Bobby

http://forum.internetworkexpert.com/ubbthreads.php/ubb/showflat/Number/16513/page/2#Post16513

on this link there is no mentioning that we need to overcome AAA issues which come into play when we activate 'aaa new-model'. I'm talking about changing access methods to both console and vty's lines.

To find more information regarding this task...the key is the term "Cisco Trusted Agent"

Doc CD/IOS Security/Traffic Filtering, Firewalls.../Network Admission Control (NAC)

Thanks for the link, Tammy!

Since they changed the documentation structure, NAC can be found in the Cisco IOS Security Configuration Guide: Securing User Services, Release 12.4.

best regards

Matthias

some open (not ended) question still remains :

1) access list 102 no there in the SG, even if it could be a simple list permitting only udp traffic sourced from vlan4.

2) radius ports not standard, why do they changed from 1812/1813? they changed also the authorization port even if authorization is not enabled.

3) 60 minutes for the inactivity time is the default value.

it looks like a copy'n'paste from the doc-cd

/R