Cisco ASA 5505 - Manual (Page 1911)

C-13
Cisco ASA 5500 Series Configuration Guide using the CLI
Appendix C Configuring an External Server for Authorization and Authentication
Configuring an External LDAP Server
Cisco AV Pair Attribute Syntax
The Cisco Attribute Value (AV) pair (ID Number 26/9/1) can be used to enforce access lists from a
RADIUS server (like Cisco ACS), or from an LDAP server via an LDAP attribute map.
The syntax of each Cisco-AV-Pair rule is as follows:
[Prefix] [Action] [Protocol] [Source] [Source Wildcard Mask] [Destination] [Destination Wildcard
Mask] [Established] [Log] [Operator] [Port]
Table C-3 describes the syntax rules.
WebVPN-SVC-Rekey-Period Y Y Integer Single 0 = Disabled
n = Retry period in minutes
(4 - 10080)
WebVPN-SVC-Required-Enable Y Y Integer Single 0 = Disabled
1 = Enabled
WebVPN-URL-Entry-Enable Y Y Integer Single 0 = Disabled
1 = Enabled
WebVPN-URL-List Y String Single URL list name
Table C-2 ASA Supported Cisco Attributes for LDAP Authorization (continued)
Attribute Name VPN 3000 ASA PIX
Syntax/
Type Single or
Multi-Valued
Possible Values
Table C-3 AV-Pair Attribute Syntax Rules
Field Description
Action Action to perform if the rule matches a deny or a permit.
Destination Network or host that receives the packet. Specify it as an IP address, a
hostname, or the any keyword. If using an IP address, the source wildcard
mask must follow.
Destination Wildcard
Mask The wildcard mask that applies to the destination address.
Log Generates a FILTER log message. You must use this keyword to generate
events of severity level 9.
Operator Logic operators: greater than, less than, equal to, not equal to.
Port The number of a TCP or UDP port in the range of 0 - 65535.
Prefix A unique identifier for the AV pair (for example: ip:inacl#1= for standard
access lists or webvpn:inacl# = for clientless SSL VPN access lists). This
field only appears when the filter has been sent as an AV pair.
Protocol Number or name of an IP protocol. Either an integer in the range of 0 - 255
or one of the following keywords: icmp, igmp, ip, tcp, udp.