Cisco 3.3 - Manual (Page 679)

C-7
User Guide for Cisco Secure ACS for Windows Server
78-16592-01
Appendix C RADIUS Attributes
About the cisco-av-pair RADUIS Attribute
About the cisco-av-pair RADUIS Attribute
The first attribute in the Cisco IOS/PIX RADIUS implementation, cisco-av-pair,
supports the inclusion of many AV pairs, using the following format:
attribute sep value
where attribute and value are an AV pair supported by the releases of IOS
implemented on your AAA clients, and sep is “=” for mandatory attributes and
“*” for optional attributes. This allows the full set of TACACS+ authorization
features to be used for RADIUS.
Note The attribute name in an AV pair is case sensitive. Typically, attribute names are
all in lowercase letters.
The following is an example of two AV pairs included in a single Cisco IOS/PIX
RADIUS cisco-av-pair attribute:
ip:addr-pool=first
shell:priv-lvl=15
The first example causes the Cisco multiple named IP address pools feature to be
activated during IP authorization (during PPP IPCP address assignment). The
second example causes a user of a device-hosted administrative session to have
immediate access to EXEC commands.
250 cisco-ssg-account-info String (maximum length
247 characters) Outbound No
251 cisco-ssg-service-info String (maximum length
247 characters) Both No
253 cisco-ssg-control-info String (maximum length
247 characters) Both No
Table C-2 Cisco IOS/PIX RADIUS VSAs (continued)
Number Attribute Type of Value Inbound/Outbound Multiple