Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 122)

3-10

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Using Authentication and Authorization

Step 5 Enable authorization with the aaa authorization command. PIX Firewall checks the authorization

request with the AAA server, which makes the decision about what services a user can access.

aaa authorization include authen_service if_name 0 0 0 0

Replace authen_service with an identifier that specifies the traffic to be included, such as ftp, telnet, or

http.

Note This step is not required when using the LOCAL database for authentication.

For example:

aaa authorization include ftp outside 0 0 0 0

aaa authorization include telnet outside 0 0 0 0

aaa authorization include http outside 0 0 0 0

aaa authorization include ftp inside 0 0 0 0

aaa authorization include telnet inside 0 0 0 0

aaa authorization include http inside 0 0 0 0

For further information about the different options available for the authorization and authentication

parameters, refer to the Cisco PIX Firewall Command Reference.

Enabling Secure Authentication of Web Clients

PIX Firewall Version 6.3 introduces a secured method of exchanging usernames and passwords between

a web client and a PIX

Firewall by using HTTP over SSL (HTTPS). HTTPS encrypts the user name and

password and makes the transmission secure.

Previous versions of PIX Firewall, when authenticating a web browser using a AAA server, obtained the

user name and password from the HTTP client in clear text.

Add the following keyword to the aaa command to enable this feature:

aaa authentication secure-http-client

The keyword secure-http-client enables this feature so that username and password are exchanged

securely between HTTP clients and the PIX

Firewall.

To enable this feature, you must configure AAA authentication, using the following command:

aaa authentication include authen_service if_name 0 0 0 0 <server_tag|LOCAL>

For the syntax of this command see the “Configuring AAA” section on page 3-8.

This feature also supports authentication of clients accessing secure (HTTPS) web sites.

Note Enabling AAA authentication secure-http-client is not required to authenticate HTTPS sessions.

After enabling this feature, when a user accesses a web page requiring authentication, the PIX Firewall

displays the Authentication dialog box shown in

Figure 3-2.

1 2 ... 117 118 119 120 121 122 123 124 125 126 127 ... 465 466

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 122