Cisco PIX 525 Especificaciones descargar pdf (Pagina 123)

10-5

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 10 Configuring AAA Servers and the Local Database

AAA Server and Local Database Support

TACACS+ Server Support

The security appliance can use TACACS+ servers for the functionality described in Table 10-3. The

security appliance supports TACACS+ authentication with ASCII, PAP, CHAP, and MS-CHAPv1.

User authentication for network

access

When a user attempts to access networks through the security appliance and the

traffic matches an authentication statement, the security appliance sends to the

RADIUS server the user credentials (typically a username and password) and grants

or denies user network access based on the response from the server.

User authorization for network access

using dynamic ACLs per user

To implement dynamic ACLs, you must configure the RADIUS server to support it.

When the user authenticates, the RADIUS server sends a downloadable ACL to the

security appliance. Access to a given service is either permitted or denied by the ACL.

The security appliance deletes the ACL when the authentication session expires.

User authorization for network access

using a downloaded ACL name per

user

To implement downloaded ACL names, you must configure the RADIUS server to

support it. When the user authenticates, the RADIUS server sends a name of an ACL.

If an ACL with the name specified exists on the security appliance, access to a given

service is either permitted or denied by the ACL. You can specify the same ACL for

multiple users.

VPN authentication When a user attempts to establish VPN access and the applicable tunnel-group record

specifies a RADIUS authentication server group, the security appliance sends to the

RADIUS server the username and password, and then grants or denies user access

based on the response from the server.

VPN authorization When user authentication for VPN access has succeeded and the applicable

tunnel-group record specifies a RADIUS authorization server group, the security

appliance sends a request to the RADIUS authorization server and applies to the VPN

session the authorizations received.

VPN accounting When user authentication for VPN access has succeeded and the applicable

tunnel-group record specifies a RADIUS accounting server group, the security

appliance sends the RADIUS server group accounting data about the VPN session.

Accounting for network access per

user or IP address

You can configure the security appliance to send accounting information to a

RADIUS server about any traffic that passes through the security appliance.

Table 10-2 RADIUS Functions (continued)

Functions Description

Table 10-3 TACACS+ Functions

Functions Description

User authentication for CLI access When a user attempts to access the security appliance with Telnet, SSH, HTTP, or a

serial console connection and the traffic matches an authentication statement, the

security appliance challenges the user for a username and password, sends these

credentials to the TACACS+ server, and grants or denies user CLI access based on the

response from the server.

User authentication for the enable

command

When a user attempts to access the enable command, the security appliance

challenges the user for a password, sends to the TACACS+ server the username and

enable password, and grants or denies user access to enable mode based on the

response from the server.

1 2 ... 118 119 120 121 122 123 124 125 126 127 128 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 123

Comentarios a estos manuales