Cisco 6500 - Catalyst Series 10 Gigabit EN Interface Module Expansion, Configuration Manual, Page: 348 / 742

17-4
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
Chapter 17 Applying AAA for Network Access
Configuring Authentication for Network Access
Step 1
Using the aaa-server command, identify your AAA servers. If you have already identified your AAA
servers, continue to the next step.
For more information about identifying AAA servers, see the “Identifying AAA Server Groups and
Servers” section on page 11-9 .
Step 2
Using the access-list command, create an access list that identifies the source addresses and destination
addresses of traffic you want to authenticate. For steps, see the “Adding an Extended Access List”
section on page 13-6 .
The permit ACEs mark matching traffic for authentication, while deny entries exclude matching traffic
from authentication. Be sure to include the destination ports for either HTTP(S), Telnet, or FTP in the
access list because the user must authenticate with one of these services before other services are allowed
through the FWSM.
Step 3
To configure authentication, enter the following command:
hostname(config)#
aaa authentication match
acl_name interface_name server_group
where acl_name is the name of the access list you created in Step 2 , interface_name is the name of the
interface as specified with the nameif command, and server_group is the AAA server group you created
in Step 1 .
Note You can alternatively use the aaa authentication include command (which identifies traffic
within the command). However, you cannot use both methods in the same configuration. See the
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Command
Reference
for more information.
Step 4 (Optional) If you are using the local database for network access authentication and you want to limit
the number of consecutive failed login attempts that the FWSM allows any given user account, use the
aaa local authentication attempts max-fail command. For example:
hostname(config)# aaa local authentication attempts max-fail 7
Tip
To clear the lockout status of a specific user or all users, use the clear aaa local user lockout command.
Step 5
(Optional) When a user authentication times out or you clear the authentication sessions using the clear
uauth command, you can force any active connections to close immediately by entering the following
command:
hostname(config)# aaa authentication clear-conn interface_name source_ip source_mask
Without this command, active connections are not terminated even though the user authentication
session expired.
For example, the following commands authenticate all inside HTTP traffic and SMTP traffic:
hostname(config)# aaa-server AuthOutbound protocol
hostname(config-aaa-server-group)# exit
hostname(config)# aaa-server AuthOutbound (inside) host 10.1.1.1
hostname(config-aaa-server-host)# key TACPlusUauthKey
hostname(config-aaa-server-host)# exit
hostname(config)# access-list MAIL_AUTH extended permit tcp any any eq smtp
hostname(config)# access-list MAIL_AUTH extended permit tcp any any eq www
hostname(config)# aaa authentication match MAIL_AUTH inside AuthOutbound