Cisco PIX 525 Especificaciones descargar pdf (Pagina 124)

10-6

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 10 Configuring AAA Servers and the Local Database

AAA Server and Local Database Support

SDI Server Support

The security appliance can use RSA SecureID servers for VPN authentication. These servers are also

known as SDI servers. When a user attempts to establish VPN access and the applicable tunnel-group

record specifies a SDI authentication server group, the security appliance sends to the SDI server the

username and one-time password and grants or denies user access based on the response from the server.

This section contains the following topics:

• SDI Version Support, page 10-6

• Two-step Authentication Process, page 10-7

• SDI Primary and Replica Servers, page 10-7

SDI Version Support

The security appliance offers the following SDI version support:

• Versions prior to version 5.0—SDI versions prior to 5.0 use the concept of an SDI master and an

SDI slave server which share a single node secret file (SECURID).

• Versions 5.0—SDI version 5.0 uses the concepts of an SDI primary and SDI replica servers. Each

primary and its replicas share a single node secret file. The node secret file has its name based on

the hexadecimal value of the ACE/Server IP address with .sdi appended.

Accounting for CLI access You can configure the security appliance to send accounting information to a

TACACS+ server about administrative sessions.

User authentication for network

access

When a user attempts to access networks through the security appliance and the

traffic matches an authentication statement, the security appliance sends to the

TACACS+ server the user credentials (typically a username and password) and grants

or denies user network access based on the response from the server.

User authorization for network access When a user matches an authorization statement on the security appliance after

authenticating, the security appliance consults the TACACS+ server for user access

privileges.

VPN authentication When a user attempts to establish VPN access and the applicable tunnel-group record

specifies a TACACS+ authentication server group, the security appliance sends to the

TACACS+ server the username and password, and then grants or denies user access

based on the response from the server.

VPN accounting When user authentication for VPN access has succeeded and the applicable

tunnel-group record specifies a TACACS+ accounting server group, the security

appliance sends the TACACS+ server group accounting data about the VPN session.

User authorization for management

commands.

On the TACACS+ server, configure the commands that a user can use after

authenticating for CLI access. Each command that a user enters at the CLI is checked

by the TACACS+ server.

Accounting for network access per

user or IP address

You can configure the security appliance to send accounting information to the

TACACS+ server about any traffic that passes through the security appliance.

Table 10-3 TACACS+ Functions (continued)

Functions Description

1 2 ... 119 120 121 122 123 124 125 126 127 128 129 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 124

Comentarios a estos manuales