Cisco ASA Series Cli Configuration Manual page 1035

Chapter 1 Configuring AAA Rules for Network Access
Configuring Network Access Authentication
To configure network access authentication, perform the following steps:
Command
Step 1
aaa-server
Example:
hostname(config)# aaa-server AuthOutbound protocol
tacacs+
Step 2
access-list access_list_name extended {deny |
permit} {tcp | udp} [user_argument]
[security_group_argument] source_address_argument
[port_argument] [security_group_argument]
dest_address_argument [port_argument]
Example:
hostname(config)# access-list MAIL_AUTH extended
permit tcp any any eq smtp
Step 3
aaa authentication match acl_name interface_name
server_group [user-identity]
Example:
hostname(config)# aaa authentication match MAIL_AUTH
inside AuthOutbound
Configuring Authentication for Network Access
Purpose
Identifies your AAA servers. If you have already
identified them, continue to the next step. For more
information about identifying AAA servers, see the
"Configuring AAA Server Groups" section on
page 1-11.
Creates an access list that identifies the source
addresses and destination addresses of traffic that
you want to authenticate. The syntax shown here is
just an example. For details, see
an Extended Access Control List."
If you specify identity firewall arguments in the
ACL, then the following keywords in the ACL are
specifically relevant to AAA rules. The keywords
user-group any and user-group none can be
specified to support cut-through proxy
authentication.
•
any—The access list matches any IP addresses
that has already been associated with any users.
•
none—The access list matches any IP addresses
that has not been associated with any IP address.
Configures authentication.
The acl_name argument is the name of the access
list that you created in Step
argument is the name of the interface specified with
the nameif command. The server_group argument is
the AAA server group that you created in
Note
You can alternatively use the aaa
authentication include command (which
identifies traffic within the command).
However, you cannot use both methods in
the same configuration. See the command
reference for more information.
The user-identity keyword matches authentication
to the identity firewall.
Cisco ASA Series CLI Configuration Guide
Chapter 1, "Adding
2. The interface_name
Step 1.
1-7