Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 285)

8-5

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 8 Managing VPN Remote Access

Configuring Extended Authentication (Xauth)

To specify the length of time that a VPN tunnel can remain open without user activity, enter the following

command:

vpngroup groupname user-idle-timeout {hh:mm:ss}

This command specifies the length of time for the specified VPN group in hours, minutes, and seconds

(hh:mm:ss).

Once a downloaded VPN policy activates SUA on an Easy VPN Remote, this policy is stored locally in

the FLASH memory of the PIX

Firewall used as an Easy VPN Remote device.

When using IUA with a PIX Firewall, the Easy VPN Remote device sends its authentication request

directly to the AAA server.

To specify the AAA server to use for IUA on a PIX Firewall being used as the Easy VPN Server, enter

the following command:

vpngroup groupname authentication-server server_tag

This command specifies the AAA server identified by server_tag for the VPN group identified by

groupname.

Bypassing AAA Authentication

PIX Firewall Version 6.3 lets you use Media Access Control (MAC) addresses to bypass authentication

for devices, such as Cisco IP Phones, that do not support AAA authentication.

When MAC-based AAA exemption is enabled the Easy VPN Remote bypasses the AAA server for traffic

that matches both the MAC address of the device and the IP address that has been dynamically assigned

by a DHCP server. Authorization services are automatically disabled when you bypass authentication.

Accounting records are still generated (if enabled), but the username is not displayed.

To enable this feature for a specific Easy VPN Remote device, enter the following command:

vpngroup groupname device-pass-through

Note When using this feature with a PIX Firewall acting as an Easy VPN Remote device, the remote

administrator must identify the MAC addresses that are exempt from authentication. For information

about how to perform this configuration on the remote PIX

Firewall, refer to “Using MAC-Based AAA

Exemption” in Chapter 3, “Controlling Network Access and Use.”

Configuring Extended Authentication (Xauth)

The PIX Firewall supports the Extended Authentication (Xauth) feature within the IKE protocol. Xauth

lets you deploy IPSec VPNs using TACACS+ or RADIUS as your user authentication method.

This feature, which is designed for VPN clients, provides user authentication by prompting the user for

username and password and verifies them with the information stored in your TACACS+ or RADIUS

database. Xauth is negotiated between IKE Phase 1 (IKE device authentication phase) and IKE

Phase 2 (IPSec SA negotiation phase). If the Xauth fails, the IPSec security association will not be

established and the IKE security association will be deleted.

1 2 ... 280 281 282 283 284 285 286 287 288 289 290 ... 465 466

Brak uwag

Cisco PIX 525 Dokumentacja Strona 285