User Guide for Cisco Secure Access Control Server - Stewing Home

IP Pools Server
8-40
User Guide for Cisco Secure Access Control Server 4.2
Chapter 8 System Configuration: Advanced
To use IP pools, the AAA client must have network authorization (in IOS, aaa authorization network)
and accounting (in IOS, aaa accounting) enabled.
Note To use the IP Pools feature, you must set up your AAA client to perform authentication and accounting
by using the same protocol; TACACS+ or RADIUS.
For information on assigning a group or user to an IP pool, see Setting IP Address Assignment Method
for a User Group, page 5-21 or Assigning a User to a Client IP Address, page 6-7.
Allowing Overlapping IP Pools or Forcing Unique Pool Address Ranges
ACS provides automated detection of overlapping pools.
Note To use overlapping pools, you must be using RADIUS with VPN, and you cannot be using the Dynamic
Host Configuration Protocol (DHCP).
You can determine whether overlapping IP pools are allowed by checking which button appears below
the AAA Server IP Pools table:
Allow Overlapping Pool Address Ranges—Overlapping IP pool address ranges are not allowed.
Clicking this button allows IP address ranges to overlap between pools.
Force Unique Pool Address Range—Overlapping IP pool address ranges are allowed. Clicking
this button prevents IP address ranges from overlapping between pools.
To allow overlapping IP pools or to force unique pool address ranges:
Step 1 In the navigation bar, click System Configuration.
Step 2 Click IP Pools Server.
Note If this feature does not appear, click Interface Configuration > Advanced Options, then click
IP Pools.
The AAA Server IP Pools table lists any IP pools you have configured, their address ranges, and the
percentage of pooled addresses in use.
Step 3 To allow overlapping IP pool address ranges:
a. If the Allow Overlapping Pool Address Ranges button appears, click it.
ACS allows overlapping IP pool address ranges.
b. If the Force Unique Pool Address Range button appears, do nothing.
ACS already allows overlapping IP pool address ranges.
Step 4 To deny overlapping IP pool address ranges:
a. If the Allow Overlapping Pool Address Ranges button appears, do nothing.
ACS already does not permit overlapping IP pool address ranges.
b. If the Force Unique Pool Address Range button appears, click it.
OL-14386-02