Cisco PIX 525 Especificaciones descargar pdf (Pagina 206)

13-4

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 13 Identifying Traffic with Access Lists

Access List Overview

b. Apply the access list using the aaa authorization match command.

• To identify traffic for network access authentication using a TACACS+ or RADIUS server, perform

the following tasks:

a. Add the access list using the “Adding an Extended Access List” section on page 13-9.

Permit entries in the access list mark matching traffic for authentication, while deny entries

exclude matching traffic from authentication.

b. Apply the access list using the aaa authentication match command in the “Configuring

Authentication for Network Access” section on page 16-1.

• To identify traffic for network access accounting using a TACACS+ or RADIUS server, perform the

following tasks:

a. Add the access list using the “Adding an Extended Access List” section on page 13-9.

Permit entries in the access list mark matching traffic for accounting, while deny entries exclude

matching traffic from accounting.

b. Apply the access list using the aaa accounting match command in the “Configuring

Accounting for Network Access” section on page 16-10.

Controlling Network Access for IP Traffic for a Given User (Extended)

When you configure user authentication for network access, you can also choose to configure user

authorization that determines the specific access privileges for each user. If you use a RADIUS server,

you can configure the RADIUS server to download a dynamic access list to be applied to the user, or the

server can send the name of an access list that you already configured on the security appliance. See the

following tasks for each method.

• For dynamic access lists, all access list configuration takes place on the RADIUS server. Perform

the following tasks:

a. Refer to the “Adding an Extended Access List” section on page 13-9 for access list syntax and

guidelines.

b. To create the access list on the RADIUS server, see the “Configuring a RADIUS Server to

Download Per-User Access Control Lists” section on page 16-8.

• For a downloaded access list name, perform the following tasks:

a. Configure an extended access list according to the “Adding an Extended Access List” section

on page 13-9.

This extended access list is not assigned to an interface, but is designed to be applied to one or

more users.

b. Use the access list name according to the “Configuring a RADIUS Server to Download Per-User

Access Control List Names” section on page 16-10.

Identifying Addresses for Policy NAT and NAT Exemption (Extended)

Policy NAT lets you identify local traffic for address translation by specifying the source and destination

addresses in an extended access list. You can also optionally specify the source and destination ports.

Regular NAT can only consider the local addresses. An access list that is used with policy NAT cannot

be configured to deny an ACE.

NAT exemption statements also use access lists, but you cannot specify the ports.

1 2 ... 201 202 203 204 205 206 207 208 209 210 211 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 206

Comentarios a estos manuales