Cisco PIX 525 Especificaciones descargar pdf (Pagina 270)

16-2

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 16 Applying AAA for Network Access

Configuring Authentication for Network Access

Authentication Overview

The security appliance lets you configure network access authentication using AAA servers.

A user at a given IP address only needs to authenticate one time for all rules and types, until the

authentication session expires. (See the timeout uauth command in the Cisco Security Appliance

Command Reference for timeout values.) For example, if you configure the security appliance to

authenticate Telnet and FTP and a user first successfully authenticates for Telnet, then as long as the

authentication session exists, the user does not also have to authenticate for FTP.

Although you can configure the security appliance to require authentication for network access to any

protocol or service, users can authenticate directly with HTTP(S), Telnet, or FTP only. A user must first

authenticate with one of these services before the security appliance allows other traffic requiring

authentication.

If you do not want to allow HTTP(S), Telnet, or FTP through the security appliance but want to

authenticate other types of traffic, you can configure virtual Telnet. With virtual Telnet, the user Telnets

to a given IP address configured on the security appliance and the security appliance provides a Telnet

prompt. For more information about the virtual telnet command, see the Cisco Security Appliance

Command Reference.

For Telnet, HTTP(S), and FTP, the security appliance generates an authentication prompt. If the

destination server also has its own authentication, the user enters another username and password.

Note If you use HTTP authentication without using the aaa authentication secure-http-client command, the

username and password are sent in clear text to the destination web server, and not just to the AAA

server. For example, if you authenticate inside users when they access outside web servers, anyone on

the outside can learn valid usernames and passwords. We recommend that you use the aaa

authentication secure-http-client command whenever you enable HTTP authentication. For more

information about the aaa authentication secure-http-client command, see the “Enabling Secure

Authentication of Web Clients” section on page 16-4.

For FTP, a user has the option of entering the security appliance username followed by an at sign (@)

and then the FTP username (name1@name2). For the password, the user enters the security appliance

password followed by an at sign (@) and then the FTP password (password1@password2). For example,

enter the following text.

name> jamiec@jchrichton

password> letmein@he110

This feature is useful when you have cascaded firewalls that require multiple logins. You can separate

several names and passwords by multiple at signs (@).

1 2 ... 265 266 267 268 269 270 271 272 273 274 275 ... 603 604

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 270