Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1035 / 2164

1-7
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring AAA Rules for Network Access
Configuring Authentication for Network Access
Configuring Network Access Authentication
To configure network access authentication, perform the following steps:
Command Purpose
Step 1
aaa-server
Example:
hostname(config)# aaa-server AuthOutbound protocol
Identifies your AAA servers. If you have already
identified them, continue to the next step. For more
information about identifying AAA servers, see the
“Configuring AAA Server Groups” section on
page 1-11
.
Step 2
access-list access_list_name extended { deny |
permit } { tcp | udp } [ user_argument ]
[ security_group_argument ] source_address_argument
[ port_argument ] [ security_group_argument ]
dest_address_argument [ port_argument ]
Example:
hostname(config)# access-list MAIL_AUTH extended
permit tcp any any eq smtp
Creates an access list that identifies the source
addresses and destination addresses of traffic that
you want to authenticate. The syntax shown here is
just an example. For details, see
Chapter 1, “Adding
an Extended Access Control List.”
If you specify identity firewall arguments in the
ACL, then the following keywords in the ACL are
specifically relevant to AAA rules. The keywords
user - group any and user - group none can be
specified to support cut-through proxy
authentication.
•
any —The access list matches any IP addresses
that has already been associated with any users.
•
none —The access list matches any IP addresses
that has not been associated with any IP address.
Step 3
aaa authentication match acl_name interface_name
server_group [ user-identity ]
Example:
hostname(config)# aaa authentication match MAIL_AUTH
inside AuthOutbound
Configures authentication.
The acl_name argument is the name of the access
list that you created in Step 2 . The interface_name
argument is the name of the interface specified with
the
nameif command. The server_group argument is
the AAA server group that you created in Step 1 .
Note
You can alternatively use the aaa
authentication include command (which
identifies traffic within the command).
However, you cannot use both methods in
the same configuration. See the command
reference for more information.
The user-identity keyword matches authentication
to the identity firewall.