36-24
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter36 Configuring the Identity Firewall
Task Flow for Configuring the Identity Firewall
•The ASA IP address is 172.1.1.118.
•The Active Directory domain controller has the IP address 71.1.2.93.
•The end user client has the IP address 172.1.1.118 and uses HTTPS to log in through a web portal.
•The user is authenticated by the Active Directory domain controller via LDAP.
•The ASA uses the inside interface to connect to the Active Directory domain controller on the
corporate network.
hostname(config)# access-list AUTH extended permit tcp any 172.1.1.118 255.255.255.255 eq http
hostname(config)# access-list AUTH extended permit tcp any 172.1.1.118 255.255.255.255 eq https
hostname(config)# aaa-server LDAP protocol ldap
hostname(config-aaa-server-group)# aaa-server LDAP (inside) host 171.1.2.93
hostname(config-aaa-server-host)# ldap-base-dn DC=cisco,DC=com
hostname(config-aaa-server-host)# ldap-group-base-dn DC=cisco,DC=com
hostname(config-aaa-server-host)# ldap-scope subtree
hostname(config-aaa-server-host)# ldap-login-dn cn=kao,OU=Employees,OU=Cisco Users,DC=cisco,DC=com
hostname(config-aaa-server-host)# ldap-login-password *****
hostname(config-aaa-server-host)# ldap-over-ssl enable
hostname(config-aaa-server-host)# server-type microsoft
hostname(config-aaa-server-host)# aaa authentication match AUTH inside LDAP
hostname(config)#
hostname(config)# http server enable
hostname(config)# http 0.0.0.0 0.0.0.0 inside
hostname(config)#
hostname(config)# auth-prompt prompt Enter Your Authentication
hostname(config)# auth-prompt accept You are Good
hostname(config)# auth-prompt reject Goodbye
Example 2
hostname(config)# access-list listenerAuth extended permit tcp any any
hostname(config)# aaa authentication match listenerAuth inside ldap
hostname(config)# aaa authentication listener http inside port 8888
hostname(config)# access-list 100 ex permit ip user SAMPLE\user1 any any
hostname(config)# access-list 100 ex deny ip user SAMPLE\user2 any any
hostname(config)# access-list 100 ex permit ip user NONE any any
hostname(config)# access-list 100 ex deny any any
hostname(config)# access-group 100 in interface inside
hostname(config)# aaa authenticate match 200 inside user-identity
In this example, the following guidelines apply:
•In access-list commands, “permit user NONE” rules should be written before the “access-list 100
ex deny any any” to allow unauthenticated incoming users trigger AAA Cut-Through Proxy.
•In auth access-list command, “permit user NONE” rules guarantee only unauthenticated trigger
Cut-Through Proxy. Ideally they should be the last lines.
Configuring VPN Authentication
In an enterprise, some traffic might need to bypass the Identity Firewall.
The ASA reports users logging in through VPN authentication or a web portal (cut-through proxy) to the
AD Agent, which distributes the user information to all registered ASA devices. Specifically, the IP-user
mapping of authenticated users is forwarded to all ASA contexts that contain the input interface where
HTTP/HTTPS packets are received and authenticated. The ASA designates users logging in through a
VPN as belonging the LOCAL domain.
There are two different ways to apply IDFW rules on VPN users.