Cisco ASA 5540 User Manual

1-7
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring AAA Rules for Network Access
Configuring Authentication for Network Access
Configuring Network Access Authentication
To configure network access authentication, perform the following steps:
Command Purpose
Step 1
aaa-server
Example:
hostname(config)# aaa-server AuthOutbound protocol
tacacs+
Identifies your AAA servers. If you have already
identified them, continue to the next step. For more
information about identifying AAA servers, see the
“Configuring AAA Server Groups” section on
page 1-11.
Step 2
access-list access_list_name extended {deny |
permit} {tcp | udp} [user_argument]
[security_group_argument] source_address_argument
[port_argument] [security_group_argument]
dest_address_argument [port_argument]
Example:
hostname(config)# access-list MAIL_AUTH extended
permit tcp any any eq smtp
Creates an access list that identifies the source
addresses and destination addresses of traffic that
you want to authenticate. The syntax shown here is
just an example. For details, see Chapter 1, “Adding
an Extended Access Control List.”
If you specify identity firewall arguments in the
ACL, then the following keywords in the ACL are
specifically relevant to AAA rules. The keywords
user-group any and user-group none can be
specified to support cut-through proxy
authentication.
• any—The access list matches any IP addresses
that has already been associated with any users.
• none—The access list matches any IP addresses
that has not been associated with any IP address.
Step 3
aaa authentication match acl_name interface_name
server_group [user-identity]
Example:
hostname(config)# aaa authentication match MAIL_AUTH
inside AuthOutbound
Configures authentication.
The acl_name argument is the name of the access
list that you created in Step 2. The interface_name
argument is the name of the interface specified with
the nameif command. The server_group argument is
the AAA server group that you created in Step 1.
Note You can alternatively use the aaa
authentication include command (which
identifies traffic within the command).
However, you cannot use both methods in
the same configuration. See the command
reference for more information.
The user-identity keyword matches authentication
to the identity firewall.

Cisco ASA 5540 Specifications

General

Firewall Throughput	650 Mbps
Maximum Firewall Connections	400, 000
VPN Throughput	225 Mbps
Maximum VPN Peers	5, 000
High Availability	Active/Active, Active/Standby
IPSec VPN Throughput	225 Mbps
Memory	1 GB
IPS Throughput	225 Mbps
Security Contexts	50
Flash Memory	64 MB
Form Factor	1U
Power Supply	Dual
Interfaces	4 x 10/100/1000 Ethernet