Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 125)

3-13

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Using Authentication and Authorization

Using MAC-Based AAA Exemption

PIX Firewall Versions 6.3 and higher let you use Media Access Control (MAC) addresses to bypass

authentication for devices, such as Cisco IP Phones, that do not support AAA authentication. To use this

feature, you identify the MAC addresses on the inside (higher security) interface. The PIX

Firewall

bypasses the AAA server for traffic that matches using both the MAC address and the IP address that has

been dynamically assigned to the MAC address. Authorization services are automatically disabled when

you bypass authentication. Accounting records are still generated (if enabled), but the username is not

displayed.

To enable MAC-based AAA exemption, create a list of MAC addresses to be exempted from AAA

authentication and then assign the list to a AAA server.

Note This feature cannot be applied on the outside or lower security level interface.

To define a list of MAC addresses, enter the following command:

mac-list mcl-id deny | permit mac mac-mask

Enter this command as many times as necessary to define all the MAC addresses you want to add to the

list.

Replace mcl-id with the identifier of the MAC list. Use the permit option to identify the MAC addresses

to be exempted from authentication. Use the deny option to prevent the bypassing of authentication.

Replace mac with a partial MAC address that can be used to select a group of devices based on a common

portion of the hardware address, such as the vendor ID. Replace mac-mask with a mask that identifies

the portion of the MAC address that should be used for matching.

For example, the following entry would bypass authentication for a single MAC address:

mypix(config)# mac-list adc permit 00a0.c95d.0282 ffff.ffff.ffff

In this example, the mask FFFF.FFFF.FFFF instructs the PIX Firewall to match all 12 digits (six bytes)

in the preceding hexadecimal address.

The following entry would bypass authentication for all Cisco IP Phones, which have the hardware ID

0003.E3:

mypix(config)# mac-list adc permit 0003.E300.0000 FFFF.FF00.0000

To apply the MAC list to the AAA server, enter the following command:

aaa mac-exempt match mcl-id

Replace mcl-id with the identifier for the MAC list that you want to apply.

For example, the following command applies the MAC-list adc to the AAA server.

aaa mac-exempt match adc

1 2 ... 120 121 122 123 124 125 126 127 128 129 130 ... 465 466

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 125