Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 275)

16-7

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 16 Applying AAA for Network Access

Configuring Authorization for Network Access

Step 3 To enable authorization, enter the following command:

hostname/contexta(config)# aaa authorization match

acl_name

interface_name server_group

where acl_name is the name of the ACL you created in Step 2, interface_name is the name of the

interface as specified with the nameif command or by default, and server_group is the AAA server group

you created when you enabled authentication.

Note Alternatively, you can use the aaa authorization include command (which identifies traffic

within the command) but you cannot use both methods in the same configuration. See the

Cisco Security Appliance Command Reference for more information.

The following commands authenticate and authorize inside Telnet traffic. Telnet traffic to servers other

than 209.165.201.5 can be authenticated alone, but traffic to 209.165.201.5 requires authorization.

hostname/contexta(config)# access-list TELNET_AUTH extended permit tcp any any eq telnet

hostname/contexta(config)# access-list SERVER_AUTH extended permit tcp any host

209.165.201.5 eq telnet

hostname/contexta(config)# aaa-server AuthOutbound protocol tacacs+

hostname/contexta(config-aaa-server-group)# exit

hostname/contexta(config)# aaa-server AuthOutbound (inside) host 10.1.1.1

hostname/contexta(config-aaa-server-host)# key TACPlusUauthKey

hostname/contexta(config-aaa-server-host)# exit

hostname/contexta(config)# aaa authentication match TELNET_AUTH inside AuthOutbound

hostname/contexta(config)# aaa authorization match SERVER_AUTH inside AuthOutbound

Configuring RADIUS Authorization

When authentication succeeds, the RADIUS protocol returns user authorizations in the access-accept

packet sent by a RADIUS server. For more information about configuring authentication, see the

“Configuring Authentication for Network Access” section on page 16-1.

When you configure the security appliance to authenticate users for network access, you are also

implicitly enabling RADIUS authorizations; therefore, this section contains no information about

configuring RADIUS authorization on the security appliance. It does provide information about how the

security appliance handles ACL information received from RADIUS servers.

You can configure a RADIUS server to download an ACL to the security appliance or an ACL name at

the time of authentication. The user is authorized to do only what is permitted in the user-specific ACL.

Note If you have used the access-group command to apply ACLs to interfaces, be aware of the following

effects of the per-user-override keyword on authorization by user-specific ACLs:

• Without the per-user-override keyword, traffic for a user session must be permitted by both the

interface ACL and the user-specific ACL.

• With the per-user-override keyword, the user-specific ACL determines what is permitted.

For more information, see the access-group command entry in the Cisco Security Appliance Command

Reference.

1 2 ... 270 271 272 273 274 275 276 277 278 279 280 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 275

Kommentare zu diesen Handbüchern