Cisco Catalyst 2960 Series, Configuration Manual

Page: 1502 / 2288

intercept the initial connection request from an user, before that request is subjected to any other processing.
If the user fails to gain authentication with the AAA server, the connection request is dropped.
How you apply the authentication proxy depends on your security policy. For example, you can block all
traffic through an interface and enable the authentication proxy feature to require authentication and
authorization for all user-initiated HTTP connections. Users are authorized for services only after successful
authentication with the AAA server.
The authentication proxy feature also allows you to use standard access lists to specify a host or group of
hosts whose initial HTTP traffic triggers the proxy.
The figure below shows the authentication proxy applied at the LAN interface with all network users required
to be authenticated upon the initial connection (all traffic is blocked at each interface).
Figure 97: Applying the Authentication Proxy at the Local Interface
The figure below shows the authentication proxy applied at the dial-in interface with all network traffic blocked
at each interface.
Figure 98: Applying the Authentication Proxy at an Outside Interface
Local Web Authentication Banner
With Web Authentication, you can create a default and customized web-browser banners that appears when
you log in to a switch.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1420
Information About Web-Based Authentication