Foundation Summary 269
Foundation Summary
Authentication, authorization, and accounting are three separate functions performed by AAA servers to allow access to resources. Each of these functions has a specific goal. No one is granted access of any kind until he or she is authenticated.
•
•
•
Authentication—Identifies the entity (user).
Authorization—Gives the user access based on his or her profile.
Accounting—Maintains a record of user access.
The Cisco PIX Firewall can maintain an internal user database or connect to an external AAA server. The PIX supports both RADIUS and TACACS+ technologies. Figure 13-14 shows the steps that the AAA server takes during the entire AAA process.
Figure 13-14 AAA Server Steps
Step 1: User initiates connection to Web server and is prompted for username/password.
Step 2: NAS forwards user
information to AAA for User authentication.
Workstation
Step 3: AAA server returns authentication and authorization to NAS.
Step 5: The firewall allows the connection.
Internal
Web Server
Step 4: AAA server logs the |
|
connection (by user). |
AAA Server |
CSACS is available for both Windows NT/2000 Server and UNIX and can be configured for TACACS+ and RADIUS. The CSACS installation on Windows 2000 is an easy step- by-step (Install Wizard) installation.
This chapter covers the following exam topics for the Secure PIX Firewall Advanced Exam (CSPFA 9E0-111):
29. Overview of AAA
20. Installation of CSACS for Windows NT/2000
31.Authentication configuration
32.Downloadable ACLs