Cisco 500 Series, Configuration Manual

Page: 364 / 1140

19-6
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 19 Applying AAA for Network Access
Configuring Authentication for Network Access
–
When uauth timeout 0 is configured (the uauth timeout is set to 0), HTTPS authentication
might not work. If a browser initiates multiple TCP connections to load a web page after HTTPS
authentication, the first connection is let through, but the subsequent connections trigger
authentication. As a result, users are continuously presented with an authentication page, even
if the correct username and password are entered each time. To work around this, set the
uauth
timeout to 1 second with the timeout uauth 0:0:1 command. However, this workaround opens
a 1-second window of opportunity that might allow non-authenticated users to go through the
firewall if they are coming from the same source IP address.
– Because HTTPS authentication occurs on the SSL port 443, users must not configure an
access-list command statement to block traffic from the HTTP client to HTTP server on port
443. Furthermore, if static PAT is configured for web traffic on port 80, it must also be
configured for the SSL port. In the following example, the first line configures static PAT for
web traffic and the second line must be added to support the HTTPS authentication
configuration.
static (inside,outside) tcp 10.132.16.200 www 10.130.16.10 www
static (inside,outside) tcp 10.132.16.200 443 10.130.16.10 443
Authenticating Directly with the Security Appliance
If you do not want to allow HTTP, HTTPS, Telnet, or FTP through the security appliance but want to
authenticate other types of traffic, you can authenticate with the security appliance directly using HTTP,
HTTPS, or Telnet.
This section includes the following topics:
• Enabling Direct Authentication Using HTTP and HTTPS, page 19-6
•
Enabling Direct Authentication Using Telnet, page 19-7
Enabling Direct Authentication Using HTTP and HTTPS
If you enabled the redirect method of HTTP and HTTPS authentication in the “Enabling Network Access
Authentication” section on page 19-3 , then you also automatically enabled direct authentication.
If you want to continue to use basic HTTP authentication, but want to enable direct authentication for
HTTP and HTTPS, then enter the following command:
hostname(config)# aaa authentication listener http [ s ] interface_name
[
port portnum
]
where the interface_name argument is the interface on which you want to enable direct authentication.
The port portnum argument specifies the port number that the security appliance listens on; the defaults
are 80 (HTTP) and 443 (HTTPS).
Enter this command separately for HTTP and for HTTPS.
If the destination HTTP server requires authentication in addition to the security appliance, then the
virtual http command lets you authenticate separately with the security appliance (via a AAA server)
and with the HTTP server. Without virtual HTTP, the same username and password you used to
authenticate with the security appliance is sent to the HTTP server; you are not prompted separately for
the HTTP server username and password. Assuming the username and password is not the same for the
AAA and HTTP servers, then the HTTP authentication fails.