Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 128)

3-16

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Access Control Configuration Example

Authentication and Authorization

This section describes how to implement authentication and authorization for traffic through the

PIX

Firewall, using a TACACS+ server. The commands used for this purpose are in addition to the basic

firewall configuration required, which is described in the previous section, “

Basic Configuration.”

The aaa-server command specifies the IP address of the TACACS+ authentication server. The aaa

authentication command statement specifies that users on network 192.168.3.0 starting FTP, HTTP, and

Web connections from the inside interface be prompted for their usernames and passwords before being

permitted to access the servers on other interfaces. The aaa authorization command statement lets the

users on 192.168.3.0 access FTP, HTTP, or Telnet, and any TCP connections to anywhere as authorized

by the AAA server. Even though it appears that the aaa commands let the PIX

Firewall set security

policy, the authentication server actually does the work to decide which users are authenticated and what

services they can access when authentication is permitted.

Example 3-3 shows the command listing for configuring access to services for the network illustrated in

Figure 3-3.

Example 3-3 Authentication and Authorization Commands

aaa-server TACACS+ (inside) host 10.1.1.12 1q2w3e

aaa authentication include ftp inside 192.168.3.0 255.255.255.0 0 0 TACACS+

aaa authorization include ftp inside 192.168.3.0 255.255.255.0 0 0

aaa authentication include http inside 192.168.3.0 255.255.255.0 0 0 TACACS+

aaa authorization include http inside 192.168.3.0 255.255.255.0 0 0

aaa authentication include telnet inside 192.168.3.0 255.255.255.0 0 0 TACACS+

aaa authorization include telnet inside 192.168.3.0 255.255.255.0 0 0

Managing Access to Services

Note The commands in this section are used in addition to the basic firewall configuration required, which is

described in the previous section, “Basic Configuration.”

The following procedure shows the commands required to manage user access to H.323 and Web

services:

Step 1 Create outbound access lists to determine which hosts can access services:

access-list acl_in deny tcp host 192.168.3.3 any eq 1720

access-list acl_in permit tcp host 192.168.3.3 any eq 80

access-list acl_in permit tcp host 10.1.1.11 any eq 80

access-list acl_in deny tcp any any eq 80

The first access-list command statement denies host 192.168.3.3 from accessing H.323 (port 1720)

services such as MS NetMeeting or Intel Internet Phone. The next command statement permits host

192.168.3.3 to use the Web. The third access-list command statement permits host 10.1.1.11 access to

the Web (at port 80). The last command statement denies all other hosts from accessing the Web (port

80).

1 2 ... 123 124 125 126 127 128 129 130 131 132 133 ... 465 466

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 128

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Sicherheitszugriffskontrollsysteme Cisco PIX 525