User Guide for Cisco Secure Access Control Server - Stewing Home

Chapter 14 Network Access Profiles
OL-14386-02
Step 7 Click Submit.
Related Topics
RADIUS Authorization Components, page 4-6
Downloadable IP ACLs, page 4-13
Configuring a Default Authorization Rule
Configuring Policies for Profiles
You can set a default authorization rule if a condition is not defined or no matched condition is found.
You can deny or grant access based on Shared RACs and DACLs selections.
To configure a default authorization rule:
Step 1 Choose Network Access Profiles.
Step 2 Choose the selected profile Authorization policy.
The Authorization Rules for profile_name appears.
Step 3 Click Add Rule.
Step 4 Select Authentication Action for the line that contains the text If a condition is not defined or there is
no matched condition.
Step 5 Choose Authentication Actions.
You may choose an authorization action to implement for the default rule:
Deny Access–Choose this option to deny access for users that have matching conditions.You do not
have to select any shared RACs or DACLs for this option.
Shared RAC–Choose a Shared RAC from the drop-down list. For more information, see
Troubleshooting Profiles, page 14-38.
Downloadable ACL–Choose a downloadable ACL from the drop-down list. See Downloadable IP
ACLs, page 4-13 for more information.
Step 6 Set RADIUS attribute overrides.
The following options are enabled by default. Uncheck them if you do not want to use RADIUS
attributes per user record or per user’s group:
Step 7 Click Submit.
Ordering the Authorization Rules
Include RADIUS attributes from user's group
Include RADIUS attributes from user record
The authorization policy first match is implemented to authorize a client request.
Note You must place your highest priority authorization policies at the top of the list. If you select Any Group
for the User Group or Any Assessment for the posture token first match, the underlying policies will not
be effective because authorization accepts the first match.
User Guide for Cisco Secure Access Control Server 4.2
14-37