Cisco ASA 5525-X - Page 1037

1-9
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring AAA Rules for Network Access
Configuring Authentication for Network Access
The following example shows a typical cut-through proxy configuration to allow a user to log in through
the ASA. In this example, the following conditions apply:
• The ASA IP address is 192.168.123.10.
• The Active Directory domain controller has the IP address 10.1.2.10.
• The end user client has the IP address 192.168.123.10 and uses HTTPS to log in through a web
portal.
• The user is authenticated by the Active Directory domain controller via LDAP.
• The ASA uses the inside interface to connect to the Active Directory domain controller on the
corporate network.
hostname(config)# access-list AUTH extended permit tcp any 192.168.123.10 255.255.255.0 eq http
hostname(config)# access-list AUTH extended permit tcp any 192.168.123.10 255.255.255.0 eq https
hostname(config)# aaa-server LDAP protocol ldap
hostname(config-aaa-server-group)# aaa-server LDAP (inside) host 10.1.2.10
hostname(config-aaa-server-host)# ldap-base-dn DC=cisco,DC=com
hostname(config-aaa-server-host)# ldap-group-base-dn DC=cisco,DC=com
hostname(config-aaa-server-host)# ldap-scope subtree
hostname(config-aaa-server-host)# ldap-login-dn cn=kao,OU=Employees,OU=Cisco Users,DC=cisco,DC=com
hostname(config-aaa-server-host)# ldap-login-password *****
hostname(config-aaa-server-host)# ldap-over-ssl enable
hostname(config-aaa-server-host)# server-type microsoft
hostname(config-aaa-server-host)# aaa authentication match AUTH inside LDAP
hostname(config)#
hostname(config)# http server enable
hostname(config)# http 0.0.0.0 0.0.0.0 inside
hostname(config)#
hostname(config)# auth-prompt prompt Enter Your Authentication
hostname(config)# auth-prompt accept You are Good
hostname(config)# auth-prompt reject Goodbye
In this example, the following guidelines apply:
• In access-list commands, you should configure permit user NONE rules before entering the
access-list 100 ex deny any any command to allow unauthenticated incoming users to trigger AAA
cut-through proxy.
• In access-list AUTH commands, permit user NONE rules specify that only unauthenticated users
can trigger AAA cut-through proxy.
hostname(config)# access-list listenerAuth extended permit tcp any any
hostname(config)# aaa authentication match listenerAuth inside ldap
hostname(config)# aaa authentication listener http inside port 8888
hostname(config)# access-list 100 ex permit ip user SAMPLE\user1 any any
hostname(config)# access-list 100 ex deny ip user SAMPLE\user2 any any
hostname(config)# access-list 100 ex permit ip user NONE any any
hostname(config)# access-list 100 ex deny any any
hostname(config)# access-group 100 in interface inside
hostname(config)# aaa authenticate match 100 inside user-identity
The following example shows how you can use AAA rules plus identity firewall (cut-through proxy) to
authenticate successfully:
hostname(config)# access-list 100 ex permit ip user CISCO\xyz any any
hostname(config)# access-list 100 ex deny ip user CISCO\abc any any
hostname(config)# access-list 100 ex permit ip user NONE any any
hostname(config)# access-list 100 ex deny any any
hostname(config)# access-group 100 in interface inside
hostname(config)# access-list 200 ex permit user NONE any any
hostname(config)# aaa authenticate match 200 inside user-identity