1-9
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring AAA Rules for Network Access
Configuring Authentication for Network Access
The following example shows a typical cut-through proxy configuration to allow a user to log in through
the ASA. In this example, the following conditions apply:
•
The ASA IP address is 192.168.123.10.
•
The Active Directory domain controller has the IP address 10.1.2.10.
•
The end user client has the IP address 192.168.123.10 and uses HTTPS to log in through a web
portal.
•
The user is authenticated by the Active Directory domain controller via LDAP.
•
The ASA uses the inside interface to connect to the Active Directory domain controller on the
corporate network.
hostname(config)#
access-list AUTH extended permit tcp any 192.168.123.10 255.255.255.0 eq http
hostname(config)#
access-list AUTH extended permit tcp any 192.168.123.10 255.255.255.0 eq https
hostname(config)#
aaa-server LDAP protocol ldap
hostname(config-aaa-server-group)#
aaa-server LDAP (inside) host 10.1.2.10
hostname(config-aaa-server-host)#
ldap-base-dn DC=cisco,DC=com
hostname(config-aaa-server-host)#
ldap-group-base-dn DC=cisco,DC=com
hostname(config-aaa-server-host)#
ldap-scope subtree
hostname(config-aaa-server-host)#
ldap-login-dn cn=kao,OU=Employees,OU=Cisco Users,DC=cisco,DC=com
hostname(config-aaa-server-host)#
ldap-login-password *****
hostname(config-aaa-server-host)#
ldap-over-ssl enable
hostname(config-aaa-server-host)#
server-type microsoft
hostname(config-aaa-server-host)#
aaa authentication match AUTH inside LDAP
hostname(config)#
hostname(config)#
http server enable
hostname(config)#
http 0.0.0.0 0.0.0.0 inside
hostname(config)#
hostname(config)#
auth-prompt prompt Enter Your Authentication
hostname(config)#
auth-prompt accept You are Good
hostname(config)#
auth-prompt reject Goodbye
In this example, the following guidelines apply:
•
In
access
-
list
commands, you should configure permit user NONE rules before entering the
access-list 100 ex deny any any
command to allow unauthenticated incoming users to trigger AAA
cut-through proxy.
•
In
access-list AUTH
commands, permit user NONE rules specify that only unauthenticated users
can trigger AAA cut-through proxy.
hostname(config)#
access-list listenerAuth extended permit tcp any any
hostname(config)#
aaa authentication match listenerAuth inside ldap
hostname(config)#
aaa authentication listener http inside port 8888
hostname(config)#
access-list 100 ex permit ip user SAMPLE\user1 any any
hostname(config)#
access-list 100 ex deny ip user SAMPLE\user2 any any
hostname(config)#
access-list 100 ex permit ip user NONE any any
hostname(config)#
access-list 100 ex deny any any
hostname(config)#
access-group 100 in interface inside
hostname(config)#
aaa authenticate match 100 inside user-identity
The following example shows how you can use AAA rules plus identity firewall (cut-through proxy) to
authenticate successfully:
hostname(config)#
access-list 100 ex permit ip user CISCO\xyz any any
hostname(config)#
access-list 100 ex deny ip user CISCO\abc any any
hostname(config)#
access-list 100 ex permit ip user NONE any any
hostname(config)#
access-list 100 ex deny any any
hostname(config)#
access-group 100 in interface inside
hostname(config)#
access-list 200 ex permit user NONE any any
hostname(config)#
aaa authenticate match 200 inside user-identity
Summary of Contents for 5505 - ASA Firewall Edition Bundle
Page 28: ...Glossary GL 24 Cisco ASA Series CLI Configuration Guide ...
Page 61: ...P A R T 1 Getting Started with the ASA ...
Page 62: ......
Page 219: ...P A R T 2 Configuring High Availability and Scalability ...
Page 220: ......
Page 403: ...P A R T 2 Configuring Interfaces ...
Page 404: ......
Page 499: ...P A R T 2 Configuring Basic Settings ...
Page 500: ......
Page 533: ...P A R T 2 Configuring Objects and Access Lists ...
Page 534: ......
Page 601: ...P A R T 2 Configuring IP Routing ...
Page 602: ......
Page 745: ...P A R T 2 Configuring Network Address Translation ...
Page 746: ......
Page 845: ...P A R T 2 Configuring AAA Servers and the Local Database ...
Page 846: ......
Page 981: ...P A R T 2 Configuring Access Control ...
Page 982: ......
Page 1061: ...P A R T 2 Configuring Service Policies Using the Modular Policy Framework ...
Page 1062: ......
Page 1093: ...P A R T 2 Configuring Application Inspection ...
Page 1094: ......
Page 1191: ...P A R T 2 Configuring Unified Communications ...
Page 1192: ......
Page 1333: ...P A R T 2 Configuring Connection Settings and QoS ...
Page 1334: ......
Page 1379: ...P A R T 2 Configuring Advanced Network Protection ...
Page 1380: ......
Page 1475: ...P A R T 2 Configuring Modules ...
Page 1476: ......
Page 1549: ...P A R T 2 Configuring VPN ...
Page 1550: ......
Page 1965: ...P A R T 2 Configuring Logging SNMP and Smart Call Home ...
Page 1966: ......
Page 2059: ...P A R T 2 System Administration ...
Page 2060: ......
Page 2098: ...1 8 Cisco ASA Series CLI Configuration Guide Chapter 1 Troubleshooting Viewing the Coredump ...
Page 2099: ...P A R T 2 Reference ...
Page 2100: ......