Can I Specify an Existing ACL using a Radius AV Pair?

Question

I am able to specify access-lists for VPN users on my IAS radius server using avpairs like:

Cisco-AVpair = "ip:outacl[#number]={standard-access-control-list | 
extended-access-control-list}"

So for example:

ip:inacl#101=deny tcp 192.168.1.0 0.0.0.255 any eq 21

Instead of specifying each line of the ACL, is there a directive that will let me specify that it should use an extended access list that exists in the IOS config?

Answer 1

The syntax is:

ip:inacl=<aclnumber>

So for example:

ip:inacl=101

From what I can tell, extended ACLs work, but named ACLs do not work.

Answer 2

I believe you want the filter-id attribute. See http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080a9eddc.shtml#new for details.