ACL Default Direction

The ACL Default Direction feature allows the filter direction to be changed on the server (where the filter direction is not specified) to inbound packets (packets coming into the network) only.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Prerequisites for ACL Default Direction

Before you can change the default direction of filters from RADIUS, you must perform the following tasks:

  • Configure your network access server (NAS) for authentication, authorization, and accounting (AAA) and to accept incoming calls.

For more information, refer to the AAA chapters of the Cisco IOS Security Configuration Guide: Securing User Services, Release 12.4T and the Cisco IOS Dial Technologies Configuration Guide, Release 12.4T .

  • Create a filter on your NAS.

For more information, see Cisco IOS IP Addressing Services Configuration Guide , Release 12.4T.

  • Add a filter definition for a RADIUS user; for example, Filter-Id = “myfilter”.

Information About ACL Default Direction

The radius-server attribute 11 direction default Command

The radius-server attribute 11 direction default command allows you to change the default direction of filters for your ACLs via RADIUS. (RADIUS attribute 11 (Filter-Id) indicates the name of the filter list for the user.) Enabling this command allows you to change the filter direction to inbound--which stops traffic from entering a router, and reduces resource consumption--rather than keeping the outbound default direction, where filtering occurs only as the traffic is about to leave the network.

Benefits of ACL Default Direction

The ACL Default Direction feature allows you to change the default direction, which is outbound, of filters for your ACLs to inbound via the radius-server attribute 11 direction default command.

How to Configure ACL Default Direction

Configuring the ACL Default Direction from RADIUS via Attribute 11 Filter-Id

Perform this task to configure the default direction of filters from RADIUS via attribute 11.

SUMMARY STEPS

    1.    enable

    2.    configure terminal

    3.    radius-server attribute 11 direction default [inbound | outbound]


DETAILED STEPS
     Command or ActionPurpose
    Step 1 enable


    Example:
    Router> enable
     

    Enables privileged EXEC mode.

    • Enter your password if prompted.

     
    Step 2 configure terminal


    Example:
    Router# configure terminal
     

    Enters global configuration mode.

     
    Step 3 radius-server attribute 11 direction default [inbound | outbound]


    Example:
    Router(config)# radius-server attribute 11 direction default inbound
     

    Specifies the default direction of filters from RADIUS to inbound or outbound.

     

    Verifying the ACL Default Direction from RADIUS via Attribute 11 Filter-Id

    Perform this task to verify the default direction of filters from RADIUS and to verify that RADIUS attribute 11 is being sent in access accept requests.

    SUMMARY STEPS

      1.    enable

      2.    more system:running-config

      3.    debug radius


    DETAILED STEPS
       Command or ActionPurpose
      Step 1 enable


      Example:
      Router> enable
       

      Enables privileged EXEC mode.

      • Enter your password if prompted.

       
      Step 2 more system:running-config


      Example:
      Router# more system:running-config
       

      Displays the contents of the current running configuration file.

       
      Step 3 debug radius


      Example:
      Router# debug radius
       

      Displays information associated with RADIUS. The output of this command shows whether attribute 11 is being sent in access accept requests.

       

      Configuration Examples for ACL Default Direction

      Default Direction of Filters via RADIUS Attribute 11 Filter-Id Example

      The following example shows how to configure RADIUS attribute 11 to change the default direction of filters. In this example, the filtering is applied to inbound packets only.

      radius-server attribute 11 direction default inbound

      RADIUS User Profile with Filter-Id Example

      The following is an example of a RADIUS user profile (Merit Daemon format) that includes RADIUS attribute 11 (Filter-Id):

      client Password = "password1"
        Service-Type = Framed,
        Framed-Protocol = PPP,
        Filter-Id = "myfilter.out"

      The RADIUS user profile shown in this example produces the following reply from the NAS:

      RADIUS: Send to unknown id 79 10.51.13.4:1645, Access-Request, len 85
RADIUS: authenticator 84 D3 B5 7D C2 5B 70 AD - 1E 5C 56 E8 3A 91 D0 6E
RADIUS: User-Name           [1]   8  "client"
RADIUS: CHAP-Password       [3]   19  *
RADIUS: NAS-Port            [5]   6   20030
RADIUS: NAS-Port-Type       [61]  6   ISDN                      [2]
RADIUS: Called-Station-Id   [30]  6   "4321"
RADIUS: Calling-Station-Id  [31]  6   "1234"
RADIUS: Service-Type        [6]   6   Framed                    [2]
RADIUS: NAS-IP-Address      [4]   6   10.1.73.74
RADIUS: Received from id 79 10.51.13.4:1645, Access-Accept, len 46
RADIUS: authenticator 9C 6C 66 E2 F1 42 D6 4B - C1 7D D4 5E 9D 09 BB A1
RADIUS: Service-Type        [6]   6   Framed                    [2]
RADIUS: Framed-Protocol     [7]   6   PPP                       [1]
RADIUS: Filter-Id           [11]  14
RADIUS: 6D 79 66 69 6C 74 65 72 2E 6F 75 74              [myfilter.out]

      Additional References

      The following sections provide references related to the ACL Default Direction feature.

      Related Documents

      Related Topic

      Document Title

      Cisco IOS Dial Technologies configuration

      Cisco IOS Dial Technologies Configuration Guide, Release 12.4T

      Cisco IOS security configuration

      Cisco IOS Security Configuration Guide: Securing User Services, Release 12.4T

      Cisco IOS security commands

      Cisco IOS Security Command Reference

      Configuring IP services

      Cisco IOS IP Addressing Services Configuration Guide , Release 12.4T.

      Standards

      Standard

      Title

      No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

      --

      MIBs

      MIB

      MIBs Link

      No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

      To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

      http:/​/​www.cisco.com/​go/​mibs

      RFCs

      RFC

      Title

      RFC 2865

      Remote Authentication Dial-In User Service (RADIUS)

      Technical Assistance

      Description

      Link

      The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

      To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

      Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

      http:/​/​www.cisco.com/​techsupport

      Feature Information for ACL Default Direction

      The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

      Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.
      Table 1 Feature Information for ACL Default Direction

      Feature Name

      Releases

      Feature Information

      ACL Default Direction

      Cisco IOS XE Release 3.9S

      The ACL Default Direction feature allows the filter direction to be changed on the server (where the filter direction is not specified) to inbound packets (packets coming into the network) only.

      The following command was introduced: radius-server attribute 11 direction default.