Cisco PIX 525 Especificaciones descargar pdf (Pagina 120)

3-8

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Using Authentication and Authorization

You can use access lists to control traffic based on IP address and protocol, but to control access and use

for specific users or groups, you must use authentication and authorization. Authentication, which is the

process of identifying users, is supported by the PIX

Firewall for RADIUS and TACACS+ servers.

Authorization identifies the specific permissions for a given user.

If you want to apply authentication and authorization when an internal (local) host initiates a connection

to an external (lower security) network, enable it on the internal (higher security) interface. To set up

authentication and authorization to occur when an external host initiates a connection to an internal host,

enable it on the outside interface.

Note If you want a host on an outside (lower security level) interface to initiate connections with a host on an

internal (higher security level) interface, create static and access-list command statements for the

connection.

This section includes the following topics:

• Configuring AAA, page 3-8

• Enabling Secure Authentication of Web Clients, page 3-10

• Configuring RADIUS Authorization, page 3-12

• Using MAC-Based AAA Exemption, page 3-13

Configuring AAA

To enable authentication and authorization, you must complete the following:

• Identify the IP address of the authentication server that you will use and determine a server

encryption key to be shared by the authentication server and the PIX

Firewall.

• Configure the authentication server with the users that can access the network, the services that they

can use, and the hosts that they can access.

• Configure the PIX Firewall to either enable or disable authentication or authorization.

In addition, you can configure the PIX Firewall to control user access to specific hosts or services.

However, it is easier to maintain this kind of access control in a single location, at the authentication

server. After you enable authentication and authorization, the PIX

Firewall prompts users of FTP, Telnet,

or HTTP (Web) access. Controlling access to a specific system or service is handled by the

authentication and authorization server.

Note When using PIX Firewall Version 6.3 or higher, you can enable authentication with a user database that

you configure locally on your PIX

Firewall. The configuration steps are similar to those for configuring

a RADIUS/TACACS+ server. The differences are noted within each step in the following procedure. For

information about configuring the PIX

Firewall local user database, refer to “User Authentication” in

Chapter 3, “Controlling Network Access and Use.”

1 2 ... 115 116 117 118 119 120 121 122 123 124 125 ... 465 466

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 120

Comentarios a estos manuales

Relacionado con productos y manuales para Los Sistemas De Control De Acceso De Seguridad Cisco PIX 525