Cisco ASA 5505 User Manual
Page 693
35-13
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 35 Configuring AAA Servers and the Local Database
Configuring AAA
Step 2
merge-dacl
{before-avpair | after-avpair}
Example:
hostname(config)# aaa-server servergroup1
protocol radius
hostname(config-aaa-server-group)# merge-dacl
before-avpair
Merges a downloadable ACL with the ACL received in
the Cisco AV pair from a RADIUS packet. The default
setting is no merge dacl, which specifies that
downloadable ACLs will not be merged with Cisco AV
pair ACLs. If both an AV pair and a downloadable ACL
are received, the AV pair has priority and is used.
The before-avpair option specifies that the
downloadable ACL entries should be placed before the
Cisco AV pair entries.
The after-avpair option specifies that the downloadable
ACL entries should be placed after the Cisco AV pair
entries. This option applies only to VPN connections. For
VPN users, ACLs can be in the form of Cisco AV pair
ACLs, downloadable ACLs, and an ACL that is
configured on the ASA. This option determines whether
or not the downloadable ACL and the AV pair ACL are
merged, and does not apply to any ACLs configured on
the ASA.
Step 3
max-failed-attempts
number
Example:
hostname(config-aaa-server-group)#
max-failed-attempts 2
Specifies the maximum number of requests sent to a
AAA server in the group before trying the next server.
The number argument can range from 1 and 5. The
default is 3.
If you configured a fallback method using the local
database (for management access only; see the
“Configuring Local Command Authorization” section on
page 37-23
and the
Authorization” section on page 37-29
to configure the
fallback mechanism), and all the servers in the group fail
to respond, then the group is considered to be
unresponsive, and the fallback method is tried. The
server group remains marked as unresponsive for a
period of 10 minutes (by default), so that additional AAA
requests within that period do not attempt to contact the
server group, and the fallback method is used
immediately. To change the unresponsive period from the
default, see the reactivation-mode command in the next
step.
If you do not have a fallback method, the ASA continues
to retry the servers in the group.
Command
Purpose