| 11.3 |  | Authorization and Accounting Configuration |
| 11.3.2 |  | Providing authorization using downloadable ACLs |

| This section describes the advantages of downloadable ACLs and explains how they are configured. Overview of downloadable ACLs The PIX Security Appliance supports per-user ACL authorization. This means that users are authorized to do only what is permitted in their individual ACL entries. By using the PIX Security Appliance downloadable ACL feature, per-user ACLs on an AAA server can be downloaded to the PIX Security Appliance during user authentication.

Downloadable ACLs enable administrators to enter an ACL once, in Cisco Secure ACS, and then load that ACL to any number of PIX Security Appliances. This is far more efficient than directly entering the ACL into each PIX Security Appliance via its CLI. No additional configuration of the PIX Security Appliance is necessary after it has been configured for authentication and authorization using RADIUS.

Downloadable ACLs are only supported with RADIUS. They are not supported with TACACS+.

Configuring downloadable ACLs
There are two methods of configuring downloadable ACLs on the AAA server. The first, less common method, is to configure a user authentication profile on an AAA server. The profile should include the actual PIX Security Appliance ACL, which is not identified by a name. Each ACL entry in the user profile must be identified. This method should be used when there are not frequent requests for the same ACL. For instructions on downloading ACLs without names, refer to the documentation on Cisco Connection Online (CCO).

The second and more common method is downloading named ACLs. This method configures a user authentication profile to include a Shared Profile Component (SPC). It then configures the SPC to include both the ACL name and the actual ACL. If a downloadable ACL is configured as a named shared profile component, it can be applied to any number of Cisco Secure ACS user or user or group profiles. This method should be used when there are frequent requests for downloading a large ACL.

| Resources Configuring Downloadable ACLs on the CSACS Assigning the ACL to the User on the CSACS