Cisco 500 Series, Configuration Manual

Page: 766 / 1140

37-10
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 37 Configuring Clientless SSL VPN
Getting Started
•
Specifying the SSO server.
• Specifying the URL of the SSO server to which the security appliance makes SSO authentication
requests.
•
Specifying a secret key to secure the communication between the security appliance and the SSO
server. This key is similar to a password: you create it, save it, and enter it on both the security
appliance and the SiteMinder Policy Server using the Cisco Java plug-in authentication scheme.
Optionally, you can do the following configuration tasks in addition to the required tasks:
•
Configuring the authentication request timeout.
• Configuring the number of authentication request retries.
After you complete these tasks, assign an SSO server to a user or group policy.
Detailed Tasks: Configuring SSO with SiteMinder
This section presents specific steps for configuring the security appliance to support SSO authentication
with CA SiteMinder. To configure SSO with SiteMinder, perform the following steps:
Step 1
In webvpn configuration mode, enter the sso-server command with the type option to create an SSO
server. For example, to create an SSO server named Example of type siteminder, enter the following:
hostname(config)# webvpn
hostname(config-webvpn)# sso-server Example type siteminder
hostname(config-webvpn-sso-siteminder)#
Step 2
Enter the web-agent-url command in webvpn-sso-siteminder configuration mode to specify the
authentication URL of the SSO server. For example, to send authentication requests to the URL
http://www.Example.com/webvpn, enter the following:
hostname(config-webvpn-sso-siteminder)# web-agent-url http://www.Example.com/webvpn
hostname(config-webvpn-sso-siteminder)#
Step 3
Specify a secret key to secure the authentication communications between the security appliance and
SiteMinder using the
policy-server-secret command in webvpn-sso-siteminder configuration mode.
You can create a key of any length using any regular or shifted alphanumeric character, but you must
enter the same key on both the security appliance and the SSO server.
For example, to create the secret key AtaL8rD8!, enter the following:
hostname(config-webvpn-sso-siteminder)# policy-server-secret AtaL8rD8!
hostname(config-webvpn-sso-siteminder)#
Step 4
Optionally, you can configure the number of seconds before a failed SSO authentication attempt times
out using the
request-timeout command in webvpn-sso-siteminder configuration mode. The default
number of seconds is 5 seconds and the possible range is 1 to 30 seconds. To change the number of
seconds before a request times out to 8, for example, enter the following:
hostname(config-webvpn-sso-siteminder)# request-timeout 8
hostname(config-webvpn-sso-siteminder)#
Step 5 Optionally, you can configure the number of times the security appliance retries a failed SSO
authentication attempt before the authentication times-out using the
max-retry-attempts command in
webvpn-sso-siteminder configuration mode. The default is 3 retry attempts and the possible range is 1
to 5 attempts. To configure the number of retries to be 4, for example, enter the following:
hostname(config-webvpn-sso-siteminder)# max-retry-attempts 4
hostname(config-webvpn-sso-siteminder)#