Cisco Systems Servers Manuale Utente

This section includes a description of NARs followed by detailed instructions 
regarding shared NAR access configuration and management.

NARs enable you to define additional authorization conditions that must be met 
before a user can gain access to the network. Cisco Secure ACS supports two 
basic types of network access restrictions:

IP-based restrictions where the originating request relates to an existing IP 
address 

Non-IP-based filters for all other cases where automatic number 
identification (ANI) may be used

A non-IP-based NAR is a list of permitted or denied “calling”/“point of access” 
locations that you can employ in restricting a AAA client when you do not have 
an IP-based connection established. The non-IP-based NAR generally uses the 
calling line ID (CLI) number and the Dialed Number Identification Service 
(DNIS) number.

However, you can use the non-IP-based filter even when the AAA client does not 
use a Cisco IOS release that supports CLI or DNIS by entering a IP address in 
place of the CLI. In another exception to entering a CLI, you can enter a MAC 
address to permit or deny; for example when you are using a Cisco Aironet AAA 
client. Likewise, you could enter a the Cisco Aironet AP MAC address in place 
of the DNIS. The format of what you specify in the CLI box—be it CLI, IP 
address, or MAC address—must match the format of what you receive from your 
AAA client. You can determine this format from your RADIUS Accounting Log.

When specifying a NAR you may use asterisks (*) as wildcards for any value, or 
as part of any value to establish a range. Cisco Secure ACS also accepts comma 
separated values in NAR definitions. All the values/conditions in a NAR 
specification must be met for the NAR to restrict access; that is, the values are 
“ANDed”.