Take the 2-minute tour ×

I am able to specify access-lists for VPN users on my IAS radius server using avpairs like:

Cisco-AVpair = "ip:outacl[#number]={standard-access-control-list | 

So for example:

ip:inacl#101=deny tcp any eq 21

Instead of specifying each line of the ACL, is there a directive that will let me specify that it should use an extended access list that exists in the IOS config?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

The syntax is:


So for example:


From what I can tell, extended ACLs work, but named ACLs do not work.

share|improve this answer

I believe you want the filter-id attribute. See http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080a9eddc.shtml#new for details.

share|improve this answer

Your Answer


