Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 271)

16-3

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 16 Applying AAA for Network Access

Configuring Authentication for Network Access

Enabling Network Access Authentication

To enable network access authentication, perform the following steps:

Step 1 Using the aaa-server command, identify your AAA servers. If you have already identified your AAA

servers, continue to the next step.

For more information about identifying AAA servers, see the “Identifying AAA Server Groups and

Servers” section on page 10-11.

Step 2 Using the access-list command, create an ACL that identifies the source addresses and destination

addresses of traffic you want to authenticate. For steps, see the “Adding an Extended Access List”

section on page 13-9.

The permit ACEs mark matching traffic for authentication, while deny entries exclude matching traffic

from authentication. Be sure to include the destination ports for either HTTP, Telnet, or FTP in the ACL

because the user must authenticate with one of these services before other services are allowed through

the security appliance.

Step 3 To configure authentication, enter the following command:

hostname/contexta(config)# aaa authentication match

acl_name

interface_name

server_group

where acl_name is the name of the ACL you created in Step 2, interface_name is the name of the

interface as specified with the nameif command, and server_group is the AAA server group you created

in Step 1.

Note You can alternatively use the aaa authentication include command (which identifies traffic within the

command). However, you cannot use both methods in the same configuration. See the Cisco Security

Appliance Command Reference for more information.

Step 4 (Optional) If you are using the local database for network access authentication and you want to limit

the number of consecutive failed login attempts that the security appliance allows any given user

account, use the aaa local authentication attempts max-fail command. For example:

hostname/contexta(config)# aaa local authentication attempts max-fail 7

Tip To clear the lockout status of a specific user or all users, use the clear aaa local user lockout command.

For example, the following commands authenticate all inside HTTP traffic and SMTP traffic:

hostname/contexta(config)# aaa-server AuthOutbound protocol tacacs+

hostname/contexta(config-aaa-server-group)# exit

hostname/contexta(config)# aaa-server AuthOutbound (inside) host 10.1.1.1

hostname/contexta(config-aaa-server-host)# key TACPlusUauthKey

hostname/contexta(config-aaa-server-host)# exit

hostname/contexta(config)# access-list MAIL_AUTH extended permit tcp any any eq smtp

hostname/contexta(config)# access-list MAIL_AUTH extended permit tcp any any eq www

hostname/contexta(config)# aaa authentication match MAIL_AUTH inside AuthOutbound

1 2 ... 266 267 268 269 270 271 272 273 274 275 276 ... 603 604

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 271