AAA authentication- how to use grouping??

[rehanshaikh]

Hi All,

My question is;

I wish to add more ranges to exclude from authenticating to gain access to the web

10.20.242.0 - 255.255.255.0
10.20.244.0 - 255.255.255.0
10.20.246.0 – 255.255.255.0
10.20.248.0 - 255.255.255.0

and was wondering is it possible to use some sought of grouping to add more network ranges to the exclusion rule

aaa authentication exclude http inside 10.20.248.0 255.255.255.0 0.0.0.0 0.0.0.0

above instead of having to add them individually....

aaa authentication exclude http inside 10.20.242.0 255.255.255.0 0.0.0.0 0.0.0.0
aaa authentication exclude http inside 10.20.244.0 255.255.255.0 0.0.0.0 0.0.0.0
aaa authentication exclude http inside 10.20.246.0 255.255.255.0 0.0.0.0 0.0.0.0
aaa authentication exclude http inside 10.20.248.0 255.255.255.0 0.0.0.0 0.0.0.0

any suggestion will be appreciated, thanks

 

[lambent]

hmm I can only tell you that the most specific match is:

10.20.240.0 255.255.241.0

which includes the following subnets:

10.20.240.0/24
10.20.242.0/24
10.20.244.0/24
10.20.246.0/24
10.20.248.0/24
10.20.250.0/24
10.20.252.0/24
10.20.254.0/24

I believe the command should be a PIX command and it seems that there's no grouping or ACLs to represent the subnet range.