---
title: Permit Zone for TACACS/RADIUS
slug: kronpam-reference-guide-3-9-0/permit-zone-for-tacacsradius
docTags: 
createdAt: 2025-01-30T11:50:04.273Z
---

The **Permit Zone** feature for TACACS/RADIUS devices controls user access based on the source IP address or subnet. Permit Zone rules define whether access from a specified IP address or subnet is granted or restricted according to the **Direct Access** configuration of the related user group.

A **Permit Zone Policy** field is available on the Permit Zone configuration screen. This field determines how the specified IP Address/Subnet is evaluated during authorization.

The **Permit Zone Policy** field provides the following options:

·         **Grant Direct Access from IP Address/Subnet:** Allows access from the specified IP address or subnet when **Direct Access** is disabled for the user group. This option represents the existing Permit Zone behavior.

·         **Restrict Direct Access from IP Address/Subnet:** Restricts users with **Direct Access** enabled to the specified IP address or subnet. Access attempts from IP addresses or subnets that are not defined with this policy are denied.

The Permit Zone authorization behavior depends on the **Direct Access** setting of the related user group:

·         When **Direct Access is disabled**, only Permit Zone records configured with **Grant Direct Access from IP Address/Subnet** are evaluated. Users can access TACACS/RADIUS devices only from the IP addresses or subnets defined with this policy. **Restrict Direct Access from IP Address/Subnet** records are not evaluated.

·         When **Direct Access is enabled**, only Permit Zone records configured with **Restrict Direct Access from IP Address/Subnet** are evaluated. If one or more Restrict Direct Access records are defined, users can access TACACS/RADIUS devices only from the IP addresses or subnets specified in these records. **Grant Direct Access from IP Address/Subnet** records are not evaluated.

·         When **Direct Access is enabled** and no **Restrict Direct Access from IP Address/Subnet** record is defined, Permit Zone does not restrict the source IP address or subnet and the existing Direct Access behavior continues.

This configuration allows administrators to apply IP/Subnet restrictions to users with Direct Access enabled without changing the existing Direct Access mechanism.

*Existing Permit Zone configurations continue to operate with the same behavior. During migration, existing Permit Zone records are automatically configured with **Grant Direct Access from IP Address/Subnet**.*

Therefore, existing Permit Zone rules are not affected by this enhancement. The new source IP/Subnet restriction for Direct Access users is applied only when **Restrict Direct Access from IP Address/Subnet** is explicitly configured.

### To configure Permit Zone:

1.      Navigate to **Policy > Permit Zone**.

2.      Click **Add**.

3.      Enter the **IP Address or Subnet**.

4.      Select the **username**.

5.      Select the required **Permit Zone Policy**:

a.      **Grant Direct Access from IP Address/Subnet**

b.      **Restrict Direct Access from IP Address/Subnet**

6.      Save the configuration.