Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 124)

3-12

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Using Authentication and Authorization

Because HTTPS authentication occurs on the SSL port 443, do not use the access-list command to block

traffic from the HTTP client to HTTP server on port 443. Also, if you configure static PAT for web traffic

on port 80, you must also configure a static entry for SSL port 443.

Configuring RADIUS Authorization

PIX Firewall allows a RADIUS server to send user group attributes to the PIX Firewall in the RADIUS

authentication response message.

The administrator first defines access lists on the PIX Firewall for each user group. For example, there

could be access lists for each department in an organization, sales, marketing, engineering, and so on.

The administrator then lists the access list in the group profile in the Cisco version of RADIUS, called

CiscoSecure.

The PIX Firewall requests authentication of the user by the RADIUS server. If the user is authorized, the

RADIUS server returns a confirming authorization response message to the PIX

Firewall with vendor

specific attribute 11 (filter-id) set to the access list for the given user's group. RADIUS attribute 11

cannot be used to pass this information.

To maintain consistency, PIX Firewall also provides the same functionality for TACACS+.

Note Access lists can be used with either RADIUS or TACACS but authorizing FTP, HTTP, or Telnet is only

possible with TACACS+.

To restrict users in a department to three servers and deny everything else, the access-list command

statements are as follows:

access-list eng permit ip any server1 255.255.255.255

access-list eng permit ip any server2 255.255.255.255

access-list eng permit ip any server3 255.255.255.255

access-list eng deny ip any any

In this example, the vendor-specific attribute string in the CiscoSecure configuration has been set to

acl=eng. Use this field in the CiscoSecure configuration to identify the access list identification name.

The PIX

Firewall gets the acl=acl_ID string from CiscoSecure, extracts the ACL identifier and puts it in

the user’s uauth entry.

When a user tries to open a connection, PIX Firewall checks the access list in the user’s uauth entry, and

depending on the permit or deny status of the access list match, permits or denies the connection. When a

connection is denied, PIX

Firewall generates a corresponding syslog message. If there is no match, then the

implicit rule is to deny.

Because the source IP of a given user can vary depending on where they are logging in from, set the

source address in the access-list command statement to any, and the destination address to identify the

network services to which user is permitted or denied access.

Note The aaa authorization command does not require a separate RADIUS option.

1 2 ... 119 120 121 122 123 124 125 126 127 128 129 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 124

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525