Newsgroup: it.comp.reti.cisco
Titolo: [Lungo] Autentication e authorization con acs (Tacacs+)

Ciao a tutti,
ho un problema che mi sta facendo uscire pazzo.
Praticamente ho bisogno di creare una vpn con 2 gruppi (administration e 
users) e ho bisogno di settare l'acs per gestire l'authorization almeno 
del gruppo users in quanto quando un utente del gruppo users si logga 
deve "aprire" una acl dinamica per un tot di tempo.
Come posso fare?
Allego la configurazione del router ed uno sh ver.
--------------------- Sh run -------------------
version 12.3
no service pad
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
service password-encryption
service compress-config
!
hostname gw
!
boot-start-marker
boot-end-marker
!
logging buffered 4096 debugging
enable secret 5 <removed>
!
memory-size iomem 25
clock timezone GMT+1 1
clock summer-time MET recurring last Sun Mar 2:00 last Sun Oct 3:00
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
aaa new-model
!
!
aaa authentication login default group tacacs+ local
aaa authentication login userauthen group tacacs+
aaa authorization exec groupauthor group tacacs+ local
aaa authorization network groupauthor local
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 0 default start-stop group tacacs+
aaa accounting network vpnaccounting start-stop group tacacs+
aaa accounting connection default start-stop group tacacs+
aaa accounting system default start-stop group tacacs+
aaa session-id common
ip subnet-zero
!
!
ip domain name virtualizer.mat
ip name-server 192.168.1.254
ip name-server 213.140.2.12
ip name-server 213.140.2.21
!
ip cef
ip audit po max-events 100
!
!
username matteo privilege 15 secret 5 <removed>
!
!
!
crypto isakmp policy 10
  encr 3des
  authentication pre-share
  group 2
!
crypto isakmp client configuration group vpngroup
  key <removed>
  dns 192.168.1.254
  domain virtualpod.mat
  pool VPN_Users
  acl vpn
!
crypto isakmp client configuration group admingroup
  key <removed>
  dns 192.168.1.254
  domain virtualizer.mat
  pool VPN_Admins
  acl vpn
!
!
crypto ipsec transform-set trans1 esp-3des esp-sha-hmac
!
crypto dynamic-map dymap 10
  set transform-set trans1
!
!
crypto map intmap client authentication list userauthen
crypto map intmap client accounting list vpnaccounting
crypto map intmap isakmp authorization list groupauthor
crypto map intmap client configuration address initiate
crypto map intmap client configuration address respond
crypto map intmap 10 ipsec-isakmp dynamic dymap
!
!
!
interface ATM0
  no ip address
  no atm ilmi-keepalive
  bundle-enable
  dsl operating-mode auto
  hold-queue 224 in
  pvc 8/35
   encapsulation aal5mux ppp dialer
   dialer pool-member 1
  !
!
interface FastEthernet0
  ip address 192.168.1.1 255.255.255.0
  ip nat inside
  speed auto
!
interface Dialer1
  ip address negotiated
  ip access-group 101 in
  ip nat outside
  encapsulation ppp
  dialer pool 1
  ppp authentication chap pap callin
  ppp chap hostname <removed>
  ppp chap password 7 <removed>
  ppp pap sent-username <removed> password 7 <removed>
  crypto map intmap
!
ip local pool VPN_Users 192.168.10.201 192.168.10.254
ip local pool VPN_Admins 192.168.10.200
ip nat inside source static tcp 192.168.1.253 80 interface Dialer1 80
ip nat inside source route-map nonat interface Dialer1 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
ip route 10.10.30.0 255.255.255.0 192.168.1.250
no ip http server
no ip http secure-server
!
!
!
ip access-list extended nonat
  deny   ip 192.168.1.0 0.0.0.255 192.168.10.0 0.0.0.255
  deny   ip 10.10.30.0 0.0.0.255 192.168.10.0 0.0.0.255
  permit ip any any
ip access-list extended vpn
  permit ip 192.168.1.0 0.0.0.255 192.168.10.0 0.0.0.255
  permit ip 10.10.30.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 101 permit ip host 192.168.10.200 any
access-list 101 permit ip any host 192.168.10.200
access-list 101 deny   ip 192.168.10.0 0.0.0.255 host 192.168.1.1
access-list 101 deny   ip 192.168.10.0 0.0.0.255 host 192.168.1.100
access-list 101 deny   ip 192.168.10.0 0.0.0.255 host 192.168.1.250
access-list 101 deny   ip 192.168.10.0 0.0.0.255 host 192.168.1.252
access-list 101 dynamic test permit ip any any log
access-list 101 deny   ip 192.168.10.0 0.0.0.255 any
access-list 101 permit ip any any
no cdp run
!
route-map nonat permit 10
  match ip address nonat
!
tacacs-server host 192.168.1.252
tacacs-server directed-request
tacacs-server key 7 <removed>
!
line con 0
  stopbits 1
line aux 0
line vty 0 4
  exec-timeout 0 0
  transport preferred none
  transport input telnet
  transport output telnet
line vty 5 15
  exec-timeout 0 0
  transport preferred none
  transport input telnet
  transport output telnet
!
scheduler max-task-time 5000
ntp clock-period 17180051
ntp server 62.94.26.10
end
-------------------- sh ver -----------------------
Cisco Internetwork Operating System Software
IOS (tm) C1700 Software (C1700-K9O3SY7-M), Version 12.3(16), RELEASE 
SOFTWARE (fc4)
Technical Support: 
http://www.cisco.com/techsupport
Copyright (c) 1986-2005 by cisco Systems, Inc.
Compiled Wed 24-Aug-05 00:28 by ssearch
Image text-base: 0x8000816C, data-base: 0x81094454
ROM: System Bootstrap, Version 12.0(3)T, RELEASE SOFTWARE (fc1)
ROM: C1700 Software (C1700-K9O3SY7-M), Version 12.3(16), RELEASE 
SOFTWARE (fc4)
gw uptime is 14 hours, 33 minutes
System returned to ROM by reload at 23:49:33 MET Thu Sep 22 2005
System restarted at 23:51:33 MET Thu Sep 22 2005
System image file is "flash:c1700-k9o3sy7-mz.123-16.bin"
cisco 1720 (MPC860T) processor (revision 0x601) with 39943K/9209K bytes 
of memory.
Processor board ID JAD05320CGD 
(3863439557
), with hardware revision 0000
MPC860T processor: part number 0, mask 32
Bridging software.
X.25 software, Version 3.0.0.
1 FastEthernet/IEEE 802.3 interface(s)
1 ATM network interface(s)
32K bytes of non-volatile configuration memory.
16384K bytes of processor board System flash (Read/Write)
Configuration register is 0x2102

 
[SNIP]
Scusate, avevo modificato il mittente per postare su un altro gruppo.
Matteo (ex Anonimo) :-)