Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 32)

1-6

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 1 Getting Started

Controlling Network Access

Cut-Through Proxy

Cut-through proxy is a feature unique to PIX Firewall that allows user-based authentication of inbound

or outbound connections. A proxy server analyzes every packet at layer seven of the OSI model, which

is a time- and processing-intensive function. By contrast, the PIX

Firewall uses cut-through proxy to

authenticate a connection and then allow traffic to flow quickly and directly.

Cut-through proxy allows a much finer level of administrative control over connections than checking

source IP addresses. It allows security policies to be enforced based on individual user accounts.

Connections can be authenticated with a user ID and password before are established, and one-time

dynamic passwords or security tokens are supported for greater security. Authentication and

authorization are supported for HTTP, Telnet, or FTP connections.

Supported Routing Protocols

PIX Firewall Version 6.3 introduces support for Open Shortest Path First (OSPF), which allows

PIX

Firewall to fully participate in dynamic routing updates with dedicated routing devices.

PIX

Firewall before Version 6.3 only supports Routing Information Protocol (RIP) Version 2.

When using RIP, PIX Firewall only listens in passive mode and/or broadcasts a default route. The

PIX

Firewall supports Cisco IOS software standards, which conform to RFC 1058, RFC 1388, and RFC

2082 of RIPv2 with text and keyed MD5 authentication. The PIX

Firewall supports one key and key ID

per interface.

Access Control

This section describes the features implemented by the PIX Firewall to support authentication and

authorization of network users. It includes the following topics:

• AAA Integration, page 1-6

• Access Lists, page 1-7

• TurboACL, page 1-7

• Downloadable ACLs, page 1-7

• Object Grouping, page 1-8

• Conduits, page 1-8

Chapter 3, “Controlling Network Access and Use” provides configuration instructions for using the

features mentioned in this section.

AAA Integration

PIX Firewall provides integration with AAA (authentication, authorization, and accounting) services.

AAA services are provided by Terminal Access Controller Access Control System Plus (TACACS+) or

Remote Authentication Dial-In User Service

(RADIUS) servers.

PIX Firewall lets you define separate groups of TACACS+ or RADIUS servers for specifying different

types of traffic. For example, you could identify one TACACS+ server for inbound traffic and another

for outbound traffic.

AAA server groups are defined by a tag name that directs different types of traffic to each authentication

server. If accounting is in effect, the accounting information goes to the active server.

1 2 ... 27 28 29 30 31 32 33 34 35 36 37 ... 465 466

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 32

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Systemy kontroli dostępu bezpieczeństwa Cisco PIX 525