Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 279)

100

101

16-11

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 16 Applying AAA for Network Access

Using MAC Addresses to Exempt Traffic from Authentication and Authorization

Step 3 To enable accounting, enter the following command:

hostname/contexta(config)# aaa accounting match

acl_name

interface_name

server_group

Note Alternatively, you can use the aaa accounting include command (which identifies traffic within

the command) but you cannot use both methods in the same configuration. See the

Cisco Security Appliance Command Reference for more information.

The following commands authenticate, authorize, and account for inside Telnet traffic. Telnet traffic to

servers other than 209.165.201.5 can be authenticated alone, but traffic to 209.165.201.5 requires

authorization and accounting.

hostname/contexta(config)# aaa-server AuthOutbound protocol tacacs+

hostname/contexta(config-aaa-server-group)# exit

hostname/contexta(config)# aaa-server AuthOutbound (inside) host 10.1.1.1

hostname/contexta(config-aaa-server-host)# key TACPlusUauthKey

hostname/contexta(config-aaa-server-host)# exit

hostname/contexta(config)# access-list TELNET_AUTH extended permit tcp any any

eq telnet

hostname/contexta(config)# access-list SERVER_AUTH extended permit tcp any host

209.165.201.5 eq telnet

hostname/contexta(config)# aaa authentication match TELNET_AUTH inside AuthOutbound

hostname/contexta(config)# aaa authorization match SERVER_AUTH inside AuthOutbound

hostname/contexta(config)# aaa accounting match SERVER_AUTH inside AuthOutbound

Using MAC Addresses to Exempt Traffic from Authentication

and Authorization

The security appliance can exempt from authentication and authorization any traffic from specific MAC

addresses.

For example, if the security appliance authenticates TCP traffic originating on a particular network but

you want to allow unauthenticated TCP connections from a specific server, you would use the mac-list

command to create a rule permitting traffic from the MAC address of the server and then use the

aaa mac-exempt command to exempt from authentication and authorization any traffic from the server

specified by the MAC list.

Conversely, if traffic from a particular computer should never be permitted regardless of authentication,

you can use the MAC address of the computer in a mac-list command that denies traffic from the MAC

address. The use of the aaa mac-exempt command in this scenario would disallow traffic from the

computer even though authentication rules would otherwise permit the traffic.

1 2 ... 274 275 276 277 278 279 280 281 282 283 284 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 279

Kommentare zu diesen Handbüchern