EasyManua.ls Logo

Cisco Catalyst 6500 Series User Manual

Cisco Catalyst 6500 Series
392 pages
To Next Page IconTo Next Page
To Next Page IconTo Next Page
To Previous Page IconTo Previous Page
To Previous Page IconTo Previous Page
Page #228 background imageLoading...
Page #228 background image
12-8
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide
OL-6392-01
Chapter 12 Configuring AAA
Configuring Authentication for CLI Access
Configuring Authentication for CLI Access
If you enable CLI authentication, the FWSM prompts you for your username and password to log in.
After you enter your information, you have access to unprivileged mode.
To enter privileged mode, enter the enable command or the login command (if you are using the local
database only).
If you configure enable authentication (see the “Configuring Authentication to Access Privileged Mode”
section on page 12-8), the FWSM prompts you for your username and password. If you do not configure
enable authentication, enter the system enable password when you enter the enable command (set by the
enable password command). However, if you do not use enable authentication, after you enter the
enable command, you are no longer logged in as a particular user. To maintain your username, use
enable authentication.
For authentication using the local database, you can use the login command, which maintains the
username but requires no configuration to turn on authentication.
Note Before the FWSM can authenticate a Telnet, SSH, or HTTP user, you must first configure access to the
FWSM using the telnet, ssh, and http commands. These commands identify the IP addresses that are
allowed to communicate with the FWSM. See Chapter 11,Allowing Remote Management.” The only
exception is when you session from the switch to the FWSM; this Telnet session is always allowed.
However, you cannot authenticate the system session because the system configuration does not contain
any aaa commands.
To authenticate users who access the CLI, enter the following command:
FWSM/contexta(config)# aaa authentication {telnet | ssh | http} console {LOCAL |
server_group
[LOCAL]}
The http keyword authenticates the PDM client that accesses the FWSM using HTTPS.
If you use a TACACS+ or RADIUS server group for authentication, you can configure the FWSM to use
the local database as a fallback method if the AAA server is unavailable. Specify the server group name
followed by LOCAL (LOCAL is case sensitive). We recommend that you use the same username and
password in the local database as the AAA server because the FWSM prompt does not give any
indication which method is being used.
You can alternatively use the local database as your main method of authentication (with no fallback) by
entering LOCAL alone.
Configuring Authentication to Access Privileged Mode
You can configure the FWSM to authenticate users with a AAA server or the local database when they
enter the enable command. Alternatively, users are automatically authenticated with the local database
when they enter the login command, which also accesses privileged mode depending on the user level
in the local database. See the following sections for information about these methods:
Configuring Authentication for the enable Command, page 12-9
Authenticating Users Using the login Command, page 12-9

Table of Contents

Other manuals for Cisco Catalyst 6500 Series

Questions and Answers:

Cisco Catalyst 6500 Series Specifications

General IconGeneral
Product TypeSwitch
Switch TypeModular
Switching CapacityUp to 720 Gbps
Forwarding RateUp to 400 Mpps
ModularYes
Uplink PortsVaries by module
QoSYes
Rack-mountableYes
SeriesCatalyst 6500
Power over Ethernet (PoE)Available on some models
Operating SystemCisco IOS
RedundancyYes (Supervisor engine, power supply)
Form FactorChassis-based
Slot Count3, 6, 9, or 13 slots
ManagementCLI, SNMP
Security FeaturesACLs, 802.1X, port security
VLAN SupportYes

Summary

Introduction to the Firewall Services Module

Stateful Inspection Feature

Explains how the FWSM inspects traffic using the Adaptive Security Algorithm and session management path.

Security Contexts

Describes how to partition a single FWSM into multiple virtual firewalls (security contexts).

Connecting to the Firewall Services Module and Managing the Configuration

Sessioning and Logging into the Firewall Services Module

Details how to connect to the FWSM CLI, log in, and access configuration mode.

Configuring the Firewall Mode

Setting the Firewall Mode

Details how to set the FWSM to run in routed or transparent firewall mode.

Managing Security Contexts

Security Context Overview

Explains security contexts as virtual firewalls within a single FWSM.

Enabling or Disabling Multiple Context Mode

Provides procedures to convert from single to multiple context mode and vice versa.

Configuring Resource Management

Details how to configure resource limits per context to prevent resource overuse.

Configuring a Security Context

Describes how to add a security context, including VLANs, resource class, and configuration URL.

Configuring Basic Settings

Changing the Passwords

Covers changing login, enable, and maintenance partition passwords for security.

Configuring Interfaces

Explains how to name and assign security levels to interfaces for full FWSM configuration.

Configuring Bridging Parameters and ARP Inspection

Configuring ARP Inspection

Describes how to enable and configure ARP inspection to prevent ARP spoofing.

Configuring IP Addresses, Routing, and DHCP

Configuring IP Addresses

Details setting IP addresses for routed or transparent firewall modes.

Configuring the Default Route

Explains how to configure the default route for FWSM traffic to reach unknown destinations.

Configuring Static Routes

Describes how to configure static routes for networks not directly connected to the FWSM.

Configuring the DHCP Server

Details how to use the Dynamic Host Configuration Protocol (DHCP) server provided by the FWSM.

Configuring DHCP Relay

Describes how to configure the FWSM to forward DHCP requests to a connected router.

Configuring Network Address Translation

NAT Overview

Explains how Network Address Translation (NAT) works on the FWSM.

Dynamic NAT

Explains how dynamic NAT translates local addresses to a pool of global addresses.

PAT

Describes PAT, which translates multiple local addresses to a single global IP address and unique port.

Static NAT

Explains how static NAT translates each local address to a fixed global address.

Static PAT

Details static PAT, which translates local IP to global IP and local port to global port.

Controlling Network Access with Access Control Lists

Access Control List Overview

Provides an overview of ACLs, their components (ACEs), and general guidelines for creation.

Controlling Network Access for IP Traffic (Extended)

Explains how to use extended ACLs to control IP traffic based on source, destination, protocol, or port.

Adding an Extended Access Control List

Provides step-by-step instructions for adding extended ACEs to an ACL.

Simplifying Access Control Lists with Object Grouping

Describes using object groups to simplify ACL creation and maintenance.

Allowing Remote Management

Allowing Telnet

Covers configuring Telnet access to the FWSM for management purposes.

Allowing SSH

Explains how to configure SSH access for secure management connections to the FWSM.

Allowing a VPN Management Connection

Describes how to configure IPSec VPN tunnels for secure management access.

Configuring AAA

AAA Overview

Introduces AAA (Authentication, Authorization, Accounting) for user access control.

Configuring the Local Database

Describes how to manage users in the local database for CLI and VPN access authentication.

Configuring Authentication for CLI Access

Explains how to configure username/password authentication for CLI login and enable commands.

Configuring Authentication to Access Privileged Mode

Details configuring authentication for users entering the enable or login commands.

Configuring Command Authorization

Describes how to control user access to specific commands via privilege levels or TACACS+.

Configuring Local Command Authorization

Explains how to assign commands to privilege levels and enable local command authorization.

Configuring TACACS+ Command Authorization

Details configuring TACACS+ for command authorization by checking commands against the server.

Recovering from a Lockout

Provides common lockout conditions and workarounds for CLI authentication and command authorization.

Configuring Authentication for Network Access

Describes configuring RADIUS or TACACS+ for network access authentication.

Enabling Network Access Authentication

Explains how to enable network access authentication using an ACL and a server group.

Configuring Authorization for Network Access

Describes configuring authorization rules or dynamic ACLs for network traffic access.

Configuring TACACS+ Authorization

Explains how to configure network access authorization using TACACS+ servers.

Configuring RADIUS Authorization

Describes how to configure RADIUS servers to download ACLs for per-user authorization.

Configuring Accounting for Network Access

Details how to send accounting information to RADIUS or TACACS+ servers for traffic tracking.

Configuring Application Protocol Inspection

Inspection Engine Overview

Provides an overview of application protocol inspection (fixup) and its impact on throughput.

Configuring an Inspection Engine

Provides instructions on how to configure or disable inspection engines for various protocols.

Filtering HTTP, HTTPS, or FTP Requests Using an External Server

Filtering Overview

Discusses using external servers for practical web and FTP filtering over ACLs.

Configuring General Filtering Parameters

Details FWSM communication with filtering servers, handling errors, long URLs, and caching.

Using Failover

Configuring Failover

Provides detailed steps to configure failover for the primary and secondary modules.

Verifying the Failover Configuration

Explains how to verify the failover configuration using the 'show failover' command.

Managing Software and Configuration Files

Installing Application or PDM Software

Details how to install or upgrade application, PDM, or maintenance software.

Installing Application or PDM Software to the Current Partition

Explains copying application or PDM software to the current partition from a server.

Downloading and Backing Up Configuration Files

Covers downloading text configurations and backing up configuration files.

Backing Up the Configuration

Explains methods to back up configuration to an external server or terminal display.

Copying the Configuration to a Server

Details backing up single-mode or multiple-mode system configurations to an external server.

Monitoring and Troubleshooting the Firewall Services Module

Troubleshooting the Firewall Services Module

Provides steps and techniques for troubleshooting FWSM issues.

Testing Your Configuration

Guides on testing FWSM connectivity, pinging interfaces, and verifying traffic flow.

Troubleshooting Passwords and AAA

Details how to recover from forgotten passwords or AAA lockout situations.

Sample Configurations

Example 1: Security Contexts With Outside Access

Example of creating multiple security contexts with inside, outside, and DMZ interfaces.

Example 5: Security Contexts With Outside Access

Example of transparent mode FWSM with multiple contexts and outside access.

Related product manuals