Table Of Contents
ACL Default Direction
First Published: October 15, 2001Last Updated: August 6, 2009
The ACL Default Direction feature allows the filter direction to be changed on the server (where the filter direction is not specified) to inbound packets (packets coming into the network) only.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for ACL Default Direction" section.
Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp. An account on Cisco.com is not required.
Prerequisites for ACL Default Direction
Before you can change the default direction of filters from RADIUS, you must perform the following tasks:
•Configure your network access server (NAS) for authentication, authorization, and accounting (AAA) and to accept incoming calls.
For more information, refer to the AAA chapters of the Cisco IOS Security Configuration Guide: Securing User Services, Release 12.4T and the Cisco IOS Dial Technologies Configuration Guide, Release 12.4T.
•Create a filter on your NAS.
For more information, see Cisco IOS IP Addressing Services Configuration Guide, Release 12.4T.
•Add a filter definition for a RADIUS user; for example, Filter-Id = "myfilter".
Information About ACL Default Direction
Before changing the default direction of filters for your access control lists (ACLs) from RADIUS, you should understand the following concepts:
The radius-server attribute 11 direction default Command
The radius-server attribute 11 direction default command allows you to change the default direction of filters for your ACLs via RADIUS. (RADIUS attribute 11 (Filter-Id) indicates the name of the filter list for the user.) Enabling this command allows you to change the filter direction to inbound—which stops traffic from entering a router, and reduces resource consumption—rather than keeping the outbound default direction, where filtering occurs only as the traffic is about to leave the network.
Benefits of ACL Default Direction
The ACL Default Direction feature allows you to change the default direction, which is outbound, of filters for your ACLs to inbound via the radius-server attribute 11 direction default command.
How to Configure ACL Default Direction
This section contains the following procedures:
Configuring the ACL Default Direction from RADIUS via Attribute 11 (Filter-Id)
Perform this task to configure the default direction of filters from RADIUS via attribute 11.
2. configure terminal
3. radius-server attribute 11 direction default [inbound | outbound]
Verifying the ACL Default Direction from RADIUS via Attribute 11 (Filter-Id)
Perform this task to verify the default direction of filters from RADIUS and to verify that RADIUS attribute 11 is being sent in access accept requests.
2. more system:running-config
3. debug radius
Configuration Examples for ACL Default Direction
This section provides the following configuration examples:
Default Direction of Filters via RADIUS Attribute 11 (Filter-Id): Example
The following example shows how to configure RADIUS attribute 11 to change the default direction of filters. In this example, the filtering is applied to inbound packets only.radius-server attribute 11 direction default inbound
RADIUS User Profile with Filter-Id: Example
The following is an example of a RADIUS user profile (Merit Daemon format) that includes RADIUS attribute 11 (Filter-Id):client Password = "password1"Service-Type = Framed,Framed-Protocol = PPP,Filter-Id = "myfilter.out"
The RADIUS user profile shown in this example produces the following reply from the NAS:RADIUS: Send to unknown id 79 10.51.13.4:1645, Access-Request, len 85RADIUS: authenticator 84 D3 B5 7D C2 5B 70 AD - 1E 5C 56 E8 3A 91 D0 6ERADIUS: User-Name  8 "client"RADIUS: CHAP-Password  19 *RADIUS: NAS-Port  6 20030RADIUS: NAS-Port-Type  6 ISDN RADIUS: Called-Station-Id  6 "4321"RADIUS: Calling-Station-Id  6 "1234"RADIUS: Service-Type  6 Framed RADIUS: NAS-IP-Address  6 10.1.73.74RADIUS: Received from id 79 10.51.13.4:1645, Access-Accept, len 46RADIUS: authenticator 9C 6C 66 E2 F1 42 D6 4B - C1 7D D4 5E 9D 09 BB A1RADIUS: Service-Type  6 Framed RADIUS: Framed-Protocol  6 PPP RADIUS: Filter-Id  14RADIUS: 6D 79 66 69 6C 74 65 72 2E 6F 75 74 [myfilter.out]
The following sections provide references related to the ACL Default Direction feature.
Related Topic Document Title
Cisco IOS Dial Technologies configuration
Cisco IOS Dial Technologies Configuration Guide, Release 12.4T
Cisco IOS security configuration
Cisco IOS security commands
Configuring IP services
Cisco IOS IP Addressing Services Configuration Guide, Release 12.4T.
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.
Feature Information for ACL Default Direction
Table 1 lists the release history for this feature.
Not all commands may be available in your Cisco IOS software release. For release information about a specific command, see the command reference documentation.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS and Catalyst OS software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp. An account on Cisco.com is not required.
Note Table 1 lists only the Cisco IOS software release that introduced support for a given feature in a given Cisco IOS software release train. Unless noted otherwise, subsequent releases of that Cisco IOS software release train also support that feature.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2001-2009 Cisco Systems, Inc. All rights reserved.