Permit Zone for TACACS/RADIUS

The Permit Zone feature for TACACS/RADIUS devices controls user access based on the source IP address or subnet. Permit Zone rules define whether access from a specified IP address or subnet is granted or restricted according to the Direct Access configuration of the related user group.

A Permit Zone Policy field is available on the Permit Zone configuration screen. This field determines how the specified IP Address/Subnet is evaluated during authorization.

The Permit Zone Policy field provides the following options:

·         Grant Direct Access from IP Address/Subnet: Allows access from the specified IP address or subnet when Direct Access is disabled for the user group. This option represents the existing Permit Zone behavior.

·         Restrict Direct Access from IP Address/Subnet: Restricts users with Direct Access enabled to the specified IP address or subnet. Access attempts from IP addresses or subnets that are not defined with this policy are denied.

The Permit Zone authorization behavior depends on the Direct Access setting of the related user group:

·         When Direct Access is disabled, only Permit Zone records configured with Grant Direct Access from IP Address/Subnet are evaluated. Users can access TACACS/RADIUS devices only from the IP addresses or subnets defined with this policy. Restrict Direct Access from IP Address/Subnet records are not evaluated.

·         When Direct Access is enabled, only Permit Zone records configured with Restrict Direct Access from IP Address/Subnet are evaluated. If one or more Restrict Direct Access records are defined, users can access TACACS/RADIUS devices only from the IP addresses or subnets specified in these records. Grant Direct Access from IP Address/Subnet records are not evaluated.

·         When Direct Access is enabled and no Restrict Direct Access from IP Address/Subnet record is defined, Permit Zone does not restrict the source IP address or subnet and the existing Direct Access behavior continues.

This configuration allows administrators to apply IP/Subnet restrictions to users with Direct Access enabled without changing the existing Direct Access mechanism.

Existing Permit Zone configurations continue to operate with the same behavior. During migration, existing Permit Zone records are automatically configured with Grant Direct Access from IP Address/Subnet.

Therefore, existing Permit Zone rules are not affected by this enhancement. The new source IP/Subnet restriction for Direct Access users is applied only when Restrict Direct Access from IP Address/Subnet is explicitly configured.

1.      Navigate to Policy > Permit Zone.

2.      Click Add.

3.      Enter the IP Address or Subnet.

4.      Select the username.

5.      Select the required Permit Zone Policy:

a.      Grant Direct Access from IP Address/Subnet

b.      Restrict Direct Access from IP Address/Subnet

6.      Save the configuration.