Cisco Systems Configuring Network Access Authentication

41-4
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter41 Configuring AAA Rules for Network Access
Configuring Authentication for Network Access
Note If you use HTTP authentication, by default the username and password are sent from the client to the
ASA in clear text; in addition, the username and password are sent on to the destination web server as
well. See the “Enabling Secure Authentication of Web Clients” section on page41-6 for information to
secure your credentials.
For FTP, a user has the option of entering the ASA username followed by an at sign (@) and then the
FTP username (name1@name2). For the password, the user enters the ASA password followed by an at
sign (@) and then the FTP password (password1@password2). For example, enter the following text:
name> name1@name2
password> password1@password2
This feature is useful when you have cascaded firewalls that require multiple logins. You can separate
several names and passwords by multiple at signs (@).
Static PAT and HTTP
For HTTP authentication, the ASA checks real ports when static PAT is configured. If it detects traffic
destined for real port 80, regardless of the mapped port, the ASA intercepts the HTTP connection and
enforces authentication.
For example, assume that outside TCP port 889 is translated to port 80 and that any relevant access lists
permit the traffic:
object network obj-192.168.123.10-01
host 192.168.123.10
nat (inside,outside) static 10.48.66.155 service tcp 80 889
Then when users try to access 10.48.66.155 on port 889, the ASA intercepts the traffic and enforces
HTTP authentication. Users see the HTTP authentication page in their web browsers before the ASA
allows HTTP connection to complete.
If the local port is different than port 80, as in the following example:
object network obj-192.168.123.10-02
host 192.168.123.10
nat (inside,outside) static 10.48.66.155 service tcp 111 889
Then users do not see the authentication page. Instead, the ASA sends an error message to the web
browser indicating that the user must be authenticated before using the requested service.
Configuring Network Access Authentication
To configure network access authentication, perform the following steps:
Step1 From the Configuration > Firewall > AAA Rules pane, choose Add > Add Authentication Rule.
The Add Authentication Rule dialog box appears.
Step2 From the Interface drop-down list, choose the interface for applying the rule.
Step3 In the Action field, click one of the following, depending on the implementation:
•Authenticate
•Do not Authenticate