Cisco Systems Enabling Secure Authentication of Web Clients

41-6
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter41 Configuring AAA Rules for Network Access
Configuring Authentication for Network Access
Step3 For the Protocol, choose either HTTP or HTTPS. You can enable both by repeating this procedure and
creating two separate rules.
Step4 From the Interface drop-down list, choose the interface on which you want to enable the listener.
Step5 From the Port drop-down list, choose the port or enter a number.
This is the port that the ASA listens on for direct or redirected traffic; the defaults are 80 (HTTP) and
443 (HTTPS). You can use any port number and retain the same functionality, but be sure your direct
authentication users know the port number; redirected traffic is sent to the correct port number
automatically, but direct authenticators must specify the port number manually.
Step6 (Optional) Check Redirect network users for authentication request.
This option redirects through traffic to an authentication web page served by the ASA. Without this
option, only traffic directed to the ASA interface can access the authentication web pages.
Note If you enable the redirect option, you cannot also configure static PAT for the same interface
where you translate the interface IP address and the same port that is used for the listener; NAT
succeeds, but authentication fails.
Step7 Click OK, and then click OK again to close the AAA Rules Advanced Options dialog box.
Step8 Click Apply.
The changes are saved to the running configuration.
Enabling Secure Authentication of Web Clients
If you use HTTP authentication, by default the username and password are sent from the client to the
ASA in clear text; in addition, the username and password are sent to the destination web server as well.
The ASA provides the following methods for securing HTTP authentication:
•Enable the redirection method of authentication for HTTP—See the “Enabling the Redirection
Method of Authentication for HTTP and HTTPS” section on page41-5. This method prevents the
authentication credentials from continuing to the destination server. See the “ASA Authentication
Prompts” section on page 41-3 for more information about the redirection method compared to the
basic method.
•Enable virtual HTTP— Virtual HTTP lets you authenticate separately with the ASA and with the
HTTP server. Even if the HTTP server does not need a second authentication, this command
achieves the effect of stripping the basic authentication credentials from the HTTP GET request. See
the “Authenticating HTTP(S) Connections with a Virtual Server” section on page41-7 for more
information.
•Enable the exchange of usernames and passwords between a web client and the ASA with
HTTPS—To enable the exchange of usernames and passwords between a web client and the ASA
with HTTPS, perform the following steps:
a. From the Configuration > Firewall > AAA Rules pane, click Advanced. The AAA Rules
Advanced Options dialog box appears.
b. Under Secure HTTP, click Enable Secure HTTP.
c. Click OK, and then click OK again to close the AAA Rules Advanced Options dialog box.
d. Click Apply.