Cisco PIX 525 Especificaciones descargar pdf (Pagina 273)

16-5

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 16 Applying AAA for Network Access

Configuring Authentication for Network Access

Note The Cisco Systems text field shown in this example was customized using the auth-prompt command.

For the detailed syntax of this command refer to the Cisco Security Appliance Command Reference. If

you do not enter a string using the auth-prompt command, this field will be blank.

After the user enters a valid username and password, an “Authentication Successful” page appears and

closes automatically. If the user fails to enter a valid username and password, an “Authentication Failed”

page appears.

Secured web-client authentication has the following limitations:

• A maximum of 16 concurrent HTTPS authentication sessions are allowed. If all 16 HTTPS

authentication processes are running, a new connection requiring authentication will not succeed.

• When uauth timeout 0 is configured (the uauth timeout is set to 0), HTTPS authentication might

not work. If a browser initiates multiple TCP connections to load a web page after HTTPS

authentication, the first connection is let through, but the subsequent connections trigger

authentication. As a result, users are continuously presented with an authentication page, even if the

correct username and password are entered each time. To work around this, set the uauth timeout

to 1 second with the timeout uauth 0:0:1 command. However, this workaround opens a 1-second

window of opportunity that might allow non-authenticated users to go through the firewall if they

are coming from the same source IP address.

• Because HTTPS authentication occurs on the SSL port 443, users must not configure an access-list

command statement to block traffic from the HTTP client to HTTP server on port 443. Furthermore,

if static PAT is configured for web traffic on port 80, it must also be configured for the SSL port. In

the following example, the first line configures static PAT for web traffic and the second line must

be added to support the HTTPS authentication configuration.

static (inside,outside) tcp 10.132.16.200 www 10.130.16.10 www

static (inside,outside) tcp 10.132.16.200 443 10.130.16.10 443

• HTTP users see a pop-up window generated by the browser itself if aaa authentication

secure-http-client is not configured. If aaa authentication secure-http-client is configured, a

form loads in the browser to collect username and password. In either case, if a user enters an

incorrect password, the user is prompted again. When the web server and the authentication server

are on different hosts, use the virtual command to get the correct authentication behavior.

To enable secure authentication of web clients, perform the following steps:

Step 1 Enable HTTP authentication. For more information about enabling authentication, see the “Enabling

Network Access Authentication” section on page 16-3.

Step 2 To enable secure authentication of web clients, enter this command:

aaa authentication secure-http-client

Note Use of the aaa authentication secure-http-client command is not dependent upon enabling HTTP

authentication. If you prefer, you can enter this command before you enable HTTP authentication so that

if you later enable HTTP authentication, usernames and passwords are already protected by secured

web-client authentication.

1 2 ... 268 269 270 271 272 273 274 275 276 277 278 ... 603 604

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 273