Cisco PIX 525 Especificaciones descargar pdf (Pagina 274)

16-6

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 16 Applying AAA for Network Access

Configuring Authorization for Network Access

After a user authenticates for a given connection, the security appliance can use authorization to further

control traffic from the user.

This section includes the following topics:

• Configuring TACACS+ Authorization, page 16-6

• Configuring RADIUS Authorization, page 16-7

Configuring TACACS+ Authorization

You can configure the security appliance to perform network access authorization with TACACS+. You

identify the traffic to be authorized by specifying ACLs that authorization rules must match.

Alternatively, you can identify the traffic directly in authorization rules themselves.

Tip Using ACLs to identify traffic to be authorized can greatly reduced the number of authorization

commands you must enter. This is because each authorization rule you enter can specify only one source

and destination subnet and service, whereas an ACL can include many entries.

Authentication and authorization statements are independent; however, any unauthenticated traffic

matched by an authorization statement will be denied. For authorization to succeed, a user must first

authenticate with the security appliance. Because a user at a given IP address only needs to authenticate

one time for all rules and types, if the authentication session hasn’t expired, authorization can occur even

if the traffic is matched by an authentication statement.

After a user authenticates, the security appliance checks the authorization rules for matching traffic. If

the traffic matches the authorization statement, the security appliance sends the username to the

TACACS+ server. The TACACS+ server responds to the security appliance with a permit or a deny for

that traffic, based on the user profile. The security appliance enforces the authorization rule in the

response.

See the documentation for your TACACS+ server for information about configuring network access

authorizations for a user.

To configure TACACS+ authorization, perform the following steps:

Step 1 Enable authentication. For more information, see the “Enabling Network Access Authentication” section

on page 16-3. If you have already enabled authentication, continue to the next step.

Step 2 Using the access-list command, create an ACL that identifies the source addresses and destination

addresses of traffic you want to authorize. For steps, see the “Adding an Extended Access List” section

on page 13-9.

The permit ACEs mark matching traffic for authorization, while deny entries exclude matching traffic

from authorization. The ACL you use for authorization matching should contain rules that are equal to

or a subset of the rules in the ACL used for authentication matching.

Note If you have configured authentication and want to authorize all the traffic being authenticated,

you can use the same ACL you created for use with the aaa authentication match command.

1 2 ... 269 270 271 272 273 274 275 276 277 278 279 ... 603 604

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 274