Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 121)

3-9

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 3 Controlling Network Access and Use

Using Authentication and Authorization

Follow these steps to enable the PIX Firewall to support user authentication and authorization:

Step 1 For inbound authentication, create the static and access-list command statements required to permit

outside hosts to access servers on the inside network.

Step 2 If the internal network connects to the Internet, create a global address pool of registered IP addresses.

Then specify the inside hosts that can start outbound connections with the nat command using the

access-list command.

Step 3 Identify the server that handles authentication or authorization using the aaa-server command. Create a

unique server group name.

For example:

aaa-server AuthInbound protocol tacacs+

aaa-server AuthInbound (inside) host 10.1.1.1 TheUauthKey

aaa-server AuthOutbound protocol tacacs+

aaa-server AuthOutbound (inside) host 10.1.1.2 TheUauthKey

Note This step is not required when using the LOCAL database for authentication.

The first command statement creates the AuthInbound authentication group using TACACS+

authentication. The second command statement states that the AuthInbound server is on the inside

interface, that its IP address is 10.1.1.1, and the encryption key is “TheUauthKey.”

The third command statement creates the AuthOutbound authentication group using TACACS+

authentication. The fourth command statement states that the AuthOutbound server is on the inside

interface, that its IP address is 10.1.1.2, and the encryption key is “TheUauthKey.”

Note RADIUS authorization is provided with the access-list command statement as described in

“Configuring RADIUS Authorization.”

Step 4 Enable authentication with the aaa authentication command:

aaa authentication include authen_service if_name 0 0 0 0 <server_tag|LOCAL>

Replace authen_service with an identifier that specifies the traffic to be included, such as ftp, telnet,

http or https. For details about this option, refer to the aaa authentication command in the Cisco PIX

Firewall Command Reference.

Replace if_name with the name of the interface on which you are enabling authentication, as configured

with the nameif command. To use the LOCAL database for authentication use the LOCAL keyword. To

use a AAA server, replace server_tag with the AAA server group name defined with the aaa-server

command. For example:

aaa authentication include ftp outside 0 0 0 0 AuthOutbound

aaa authentication include telnet outside 0 0 0 0 AuthOutbound

aaa authentication include http outside 0 0 0 0 AuthOutbound

aaa authentication include ftp inside 0 0 0 0 AuthInbound

aaa authentication include telnet inside 0 0 0 0 AuthInbound

aaa authentication include http inside 0 0 0 0 AuthInbound

Note Be careful to apply authentication only to protocols that can be authenticated. Applying

authentication using the any keyword will prevent protocols such as SMTP from passing

through the PIX Firewall.

1 2 ... 116 117 118 119 120 121 122 123 124 125 126 ... 465 466

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 121

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Systemy kontroli dostępu bezpieczeństwa Cisco PIX 525