Cisco Systems ASA5515K9, ASA 5500 Configuring AAA Rules for Network Access

CHAPT ER
38-1
Cisco ASA 5500 Series Configuration Guide using the CLI
38
Configuring AAA Rules for Network Access
This chapter describes how to enable AAA (pronounced “triple A”) for network access.
For information about AAA for management access, see the “Configuring AAA for System
Administrators” section on page37-13.
This chapter includes the following sections:
•AAA Performance, page 38-1
•Licensing Requirements for AAA Rules, page38-1
•Guidelines and Limitations, page38-2
•Configuring Authentication for Network Access, page38-2
•Configuring Authorization for Network Access, page38-11
•Configuring Accounting for Network Access, page38-18
•Using MAC Addresses to Exempt Traffic from Authentication and Authorization, page38-20
•Feature History for AAA Rules, page 38-21
AAA Performance
The ASA uses “cut-through proxy” to significantly improve performance compared to a traditional
proxy server. The performance of a traditional proxy server suffers because it analyzes every packet at
the application layer of the OSI model. The ASA cut-through proxy challenges a user initially at the
application layer and then authenticates with standard AAA servers or the local database. After the ASA
authenticates the user, it shifts the session flow, and all traffic flows directly and quickly between the
source and destination while maintaining session state information.
Licensing Requirements for AAA Rules
The following table shows the licensing requirements for this feature:
Model License Requirement
All models Base License.