39-23
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter39 Configuring the Identity Firewall
Task Flow for Configuring the Identity Firewall
•For HTTP/HTTPS traffic, an authentication window appears for unauthenticated users.
•For Telnet and FTP traffic, users must log in through the cut-through proxy and again to Telnet and
FTP server.
•A user can specify an Active Directory domain while providing login credentials (in the format
domain\username). The ASA automatically selects the associated AAA server group for the
specified domain.
•If a user specifies an Active Directory domain while providing login credentials (in the format
domain\username), the ASA parses the domain and uses it to select an authentication server from
the AAA servers configured for the Identity Firewall. Only the username is passed to the AAA
server.
•If the backslash (\) delimiter is not found in the log in credentials, the ASA does not parse a domain
and authentication is conducted with the AAA server that corresponds to default domain configured
for the Identity Firewall.
•If a default domain or a server group is not configured for that default domain, the ASA rejects the
authentication.
•If the domain is not specified, the ASA selects the AAA server group for the default domain that is
configured for the Identity Firewall.
Detailed Steps
To configure the cut-through proxy for the Identity Firewall, perform the following steps:
Step1 Open the Configuration > Firewall > AAA Rules pane.
Step2 Choose Add > Add Authentication Rule. The Add Authentication Rule dialog box appears.
Step3 From the Interface drop-down list, choose inside.
Step4 In the Action field, click Authenticate.
Step5 From the AAA Server Group drop-down list, choose a server group. To add a AAA server to the server
group, click Add Server.
If you chose LOCAL for the AAA server group, you can optionally add a new user by clicking Add User.
See the “Adding a User Account to the Local Database” topic for more information.