Cisco PIX 500 Series Configuration Manual page 664

Group Policies
Configuring Secure Unit Authentication
Secure unit authentication provides additional security by requiring VPN hardware clients to
authenticate with a username and password each time that the client initiates a tunnel. With this feature
enabled, the hardware client does not have a saved username and password. Secure unit authentication
is disabled by default.
With this feature enabled, to bring up a VPN tunnel, a user must be present to enter the username and
Note
password.
Secure unit authentication requires that you have an authentication server group configured for the
connection profile the hardware client(s) use. If you require secure unit authentication on the primary
security appliance, be sure to configure it on any backup servers as well.
Specify whether to enable secure unit authentication by entering the secure-unit-authentication
command with the enable keyword in group-policy configuration mode.
hostname(config-group-policy)# secure-unit-authentication {enable | disable}
hostname(config-group-policy)# no secure-unit-authentication
To disable secure unit authentication, enter the disable keyword. To remove the secure unit
authentication attribute from the running configuration, enter the no form of this command. This option
allows inheritance of a value for secure unit authentication from another group policy.
The following example shows how to enable secure unit authentication for the group policy named
FirstGroup:
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)# secure-unit-authentication enable
Configuring User Authentication
User authentication is disabled by default. When enabled, user authentication requires that individual
users behind a hardware client authenticate to gain access to the network across the tunnel. Individual
users authenticate according to the order of authentication servers that you configure.
Specify whether to enable user authentication by entering the user-authentication command with the
enable keyword in group-policy configuration mode.
hostname(config-group-policy)# user-authentication {enable | disable}
hostname(config-group-policy)# no user-authentication
To disable user authentication, enter the disable keyword. To remove the user authentication attribute
from the running configuration, enter the no form of this command. This option allows inheritance of a
value for user authentication from another group policy.
If you require user authentication on the primary security appliance, be sure to configure it on any
backup servers as well.
The following example shows how to enable user authentication for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)# user-authentication enable
Cisco Security Appliance Command Line Configuration Guide
30-48
Chapter 30 Configuring Connection Profiles, Group Policies, and Users
OL-12172-03