1-8
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring AAA Servers and the Local Database
Information About AAA
HTTP Forms Authentication for Clientless SSL VPN
The ASA can use the HTTP Form protocol for both authentication and SSO operations of Clientless SSL
VPN user sessions only. For configuration information, see the
“Using Single Sign-on with Clientless
Local Database Support, Including as a Fallback Method
The ASA maintains a local database that you can populate with user profiles.
The local database can act as a fallback method for several functions. This behavior is designed to help
you prevent accidental lockout from the ASA.
For users who need fallback support, we recommend that their usernames and passwords in the local
database match their usernames and passwords on the AAA servers. This practice provides transparent
fallback support. Because the user cannot determine whether a AAA server or the local database is
providing the service, using usernames and passwords on AAA servers that are different than the
usernames and passwords in the local database means that the user cannot be certain which username
and password should be given.
The local database supports the following fallback functions:
•
Console and enable password authentication—If the servers in the group are all unavailable, the
ASA uses the local database to authenticate administrative access, which can also include enable
password authentication.
•
Command authorization—If the servers in the group are all unavailable, the local
database is used to authorize commands based on privilege levels.
•
VPN authentication and authorization—VPN authentication and authorization are supported to
enable remote access to the ASA if AAA servers that normally support these VPN services are
unavailable. When a VPN client of an administrator specifies a tunnel group configured to fallback
to the local database, the VPN tunnel can be established even if the AAA server group is unavailable,
provided that the local database is configured with the necessary attributes.
How Fallback Works with Multiple Servers in a Group
If you configure multiple servers in a server group and you enable fallback to the local database for the
server group, fallback occurs when no server in the group responds to the authentication request from
the ASA. To illustrate, consider this scenario:
You configure an LDAP server group with two Active Directory servers, server 1 and server 2, in that
order. When the remote user logs in, the ASA attempts to authenticate to server 1.
If server 1 responds with an authentication failure (such as
user not found
), the ASA does not attempt to
authenticate to server 2.
If server 1 does not respond within the timeout period (or the number of authentication attempts exceeds
the configured maximum), the ASA tries server 2.
If both servers in the group do not respond, and the ASA is configured to fall back to the local database,
the ASA tries to authenticate to the local database.
Содержание 5505 - ASA Firewall Edition Bundle
Страница 28: ...Glossary GL 24 Cisco ASA Series CLI Configuration Guide ...
Страница 61: ...P A R T 1 Getting Started with the ASA ...
Страница 62: ......
Страница 218: ...1 56 Cisco ASA Series CLI Configuration Guide Chapter 1 Managing Feature Licenses Feature History for Licensing ...
Страница 219: ...P A R T 2 Configuring High Availability and Scalability ...
Страница 220: ......
Страница 358: ...1 22 Cisco ASA Series CLI Configuration Guide Chapter 1 Information About Failover Failover Messages ...
Страница 403: ...P A R T 2 Configuring Interfaces ...
Страница 404: ......
Страница 499: ...P A R T 2 Configuring Basic Settings ...
Страница 500: ......
Страница 516: ...1 16 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring Basic Settings Monitoring DNS Cache ...
Страница 533: ...P A R T 2 Configuring Objects and Access Lists ...
Страница 534: ......
Страница 558: ...1 4 Cisco ASA Series CLI Configuration Guide Chapter 1 Information About Access Lists Where to Go Next ...
Страница 601: ...P A R T 2 Configuring IP Routing ...
Страница 602: ......
Страница 632: ...1 8 Cisco ASA Series CLI Configuration Guide Chapter 1 Defining Route Maps Feature History for Route Maps ...
Страница 680: ...1 48 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring OSPF Feature History for OSPF ...
Страница 745: ...P A R T 2 Configuring Network Address Translation ...
Страница 746: ......
Страница 780: ...1 34 Cisco ASA Series CLI Configuration Guide Chapter 1 Information About NAT Where to Go Next ...
Страница 844: ...1 32 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring Twice NAT Feature History for Twice NAT ...
Страница 845: ...P A R T 2 Configuring AAA Servers and the Local Database ...
Страница 846: ......
Страница 859: ...1 13 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring AAA Servers and the Local Database Configuring AAA ...
Страница 871: ...1 25 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring AAA Servers and the Local Database Configuring AAA ...
Страница 981: ...P A R T 2 Configuring Access Control ...
Страница 982: ......
Страница 994: ...1 12 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring Access Rules Feature History for Access Rules ...
Страница 1028: ...1 34 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring Management Access Feature History for Management Access ...
Страница 1054: ...1 26 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring AAA Rules for Network Access Feature History for AAA Rules ...
Страница 1060: ...1 6 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring Web Cache Services Using WCCP Feature History for WCCP ...
Страница 1061: ...P A R T 2 Configuring Service Policies Using the Modular Policy Framework ...
Страница 1062: ......
Страница 1093: ...P A R T 2 Configuring Application Inspection ...
Страница 1094: ......
Страница 1191: ...P A R T 2 Configuring Unified Communications ...
Страница 1192: ......
Страница 1333: ...P A R T 2 Configuring Connection Settings and QoS ...
Страница 1334: ......
Страница 1370: ...1 20 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring QoS Feature History for QoS ...
Страница 1379: ...P A R T 2 Configuring Advanced Network Protection ...
Страница 1380: ......
Страница 1448: ...1 20 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring Threat Detection Configuration Examples for Threat Detection ...
Страница 1474: ...1 18 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring Filtering Services Monitoring Filtering Statistics ...
Страница 1475: ...P A R T 2 Configuring Modules ...
Страница 1476: ......
Страница 1504: ...1 28 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring the ASA IPS Module Feature History for the ASA IPS module ...
Страница 1528: ...1 24 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring the ASA CX Module Feature History for the ASA CX Module ...
Страница 1548: ...1 20 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring the ASA CSC Module Feature History for the CSC SSM ...
Страница 1549: ...P A R T 2 Configuring VPN ...
Страница 1550: ......
Страница 1592: ...1 42 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring IPsec and ISAKMP Supporting the Nokia VPN Client ...
Страница 1612: ...1 20 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring L2TP over IPsec Feature History for L2TP over IPsec ...
Страница 1796: ...1 6 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring the PPPoE Client Using Related Commands ...
Страница 1965: ...P A R T 2 Configuring Logging SNMP and Smart Call Home ...
Страница 1966: ......
Страница 1988: ...1 22 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring Logging Feature History for Logging ...
Страница 2002: ...1 14 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring NetFlow Secure Event Logging NSEL Feature History for NSEL ...
Страница 2036: ...1 34 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring SNMP Feature History for SNMP ...
Страница 2059: ...P A R T 2 System Administration ...
Страница 2060: ......
Страница 2098: ...1 8 Cisco ASA Series CLI Configuration Guide Chapter 1 Troubleshooting Viewing the Coredump ...
Страница 2099: ...P A R T 2 Reference ...
Страница 2100: ......