Cisco 7604 Configuration Guide - Page 347

Chapter 17 Applying AAA for Network Access Configuring Authentication for Network Access Note If you use HTTP authentication without using the aaa authentication secure-http-client command, the username and password are sent from the client to the FWSM in clear text. We recommend that you use the aaa authentication secure-http-client command whenever you enable HTTP authentication. For more information about the aaa authentication secure-http-client command, see the "Enabling Secure Authentication of Web Clients" section on page 17-6. For FTP, a user has the option of entering the FWSM username followed by an at sign (@) and then the FTP username (name1@name2). For the password, the user enters the FWSM password followed by an at sign (@) and then the FTP password (password1@password2). For example, enter the following text. name> user1@user2 password> letmein@he110 This feature is useful when you have cascaded firewalls that require multiple logins. You can separate several names and passwords by multiple at signs (@). Static PAT and HTTP For HTTP authentication, the FWSM checks real ports when static PAT is configured. If it detects traffic destined for real port 80, regardless of the mapped port, the FWSM intercepts the HTTP connection and enforces authentication. For example, assume that outside TCP port 889 is translated to port 80 (www) and that any relevant access lists permit the traffic: static (inside,outside) tcp 10.48.66.155 889 192.168.123.10 www netmask 255.255.255.255 Then when users try to access 10.48.66.155 on port 889, the FWSM intercepts the traffic and enforces HTTP authentication. Users see the HTTP authentication page in their web browsers before the FWSM allows HTTP connection to complete. If the local port is different than port 80, as in the following example: static (inside,outside) tcp 10.48.66.155 889 192.168.123.10 111 netmask 255.255.255.255 Then users do not see the authentication page. Instead, the FWSM sends to the web browser an error message indicating that the user must be authenticated prior using the requested service. Authenticating Directly with the FWSM If you do not want to allow HTTP(S), Telnet, or FTP through the FWSM but want to authenticate other types of traffic, you can configure virtual Telnet, virtual SSH, or virtual HTTP. With virtual Telnet, SSH, or HTTP, the user connects using Telnet, SSH, or HTTP to a given IP address configured on the FWSM, and the FWSM provides a prompt. For more information about the virtual telnet, virtual ssh, or virtual http commands, see the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Command Reference. Enabling Network Access Authentication To enable network access authentication, perform the following steps: OL-20748-01 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM 17-3