Vendor-Specific Attributes for
The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating
vendor-specific attributes (VSAs) between the network access server and the server. The IETF
uses attribute 26. VSAs allow vendors to support their own extended attributes that are not suitable for general
use.
Cisco VSA Format for
The Cisco implementation supports one vendor-specific option using the format recommended
in the IETF specification. The Cisco vendor ID is 9, and the supported option is vendor type 1, which is named
cisco-av-pair. The value is a string with the following format:
protocol : attribute separator value *
The protocol is a Cisco attribute for a particular type of authorization, the separator is = (equal sign) for
mandatory attributes, and * (asterisk) indicates optional attributes.
When you use servers for authentication on a Cisco NX-OS device, the protocol directs
the server to return user attributes, such as authorization information, along with authentication
results. This authorization information is specified through VSAs.
The following VSA protocol options are supported by the Cisco NX-OS software:
Shell
Protocol used in access-accept packets to provide user profile information.
Accounting
Protocol used in accounting-request packets. If a value contains any white spaces, you should enclose
the value within double quotation marks.
The Cisco NX-OS software supports the following attributes:
roles
Lists all the roles to which the user belongs. The value field is a string that lists the role names delimited
by white space. For example, if the user belongs to roles network-operator and network-admin, the value
field would be network-operator network-admin. This subattribute, which the server sends
in the VSA portion of the Access-Accept frames, can only be used with the shell protocol value. The
following examples show the roles attribute as supported by Cisco ACS:
shell:roles=network-operator network-admin
shell:roles*network-operator network-admin
When you specify a VSA as shell:roles*"network-operator network-admin", this VSA is flagged as an
optional attribute and other Cisco devices ignore this attribute.
Note
accountinginfo
Stores accounting information in addition to the attributes covered by a standard accounting
protocol. This attribute is sent only in the VSA portion of the Account-Request frames from the
client on the switch. It can be used only with the accounting protocol data units (PDUs).
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
70
Configuring
Vendor-Specific Attributes for
