Cisco Catalyst 6500 Series User Manual

12-24
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide
OL-6392-01
Chapter 12 Configuring AAA
Configuring Authorization for Network Access
This section includes the following topics:
• Configuring TACACS+ Authorization, page 12-24
• Configuring RADIUS Authorization, page 12-25
Configuring TACACS+ Authorization
The FWSM lets you configure network access authorization using TACACS+. You can identify the
traffic that needs to be authorized in the authorization rule, or by matching an ACL name. Authorization
rules can include only one source and destination subnet and service, while an ACL can include many
entries.
For all traffic that you want to authorize, a user must first authenticate with the FWSM for that traffic.
You can choose to authenticate, but not authorize, some traffic; be sure that the authorization rules are
equal to or a subset of the authentication rules. See the “Configuring Authentication for Network
Access” section on page 12-20 to configure authentication.
After a user authenticates, the FWSM checks the authorization rules for matching traffic. If the traffic
matches the authorization statement, the FWSM sends the username to the TACACS+ server. The
TACACS+ server responds to the FWSM with a permit or a deny for that traffic, based on the user’s
profile. See the TACACS+ server documentation for information about configuring network access
restrictions for a user.
To configure authorization, enter the following command:
FWSM/contexta(config)# aaa authorization match acl_name interface_name server_group
Identify the source addresses and destination addresses using an extended ACL. Create the ACL using
the access-list command (see the “Adding an Extended Access Control List” section on page 10-13).
The permit access control entries (ACEs) mark matching traffic for authorization, while deny entries
exclude matching traffic from authorization.
Note You can alternatively use the aaa authorization include command (which identifies traffic within the
command). However, you cannot use both methods in the same configuration. See the Catalyst 6500
Series Switch and Cisco 7600 Series Router Firewall Services Module Command Reference for more
information.
The following commands authenticate and authorize inside Telnet traffic. Telnet traffic to servers other
than 209.165.201.5 can be authenticated alone, but traffic to 209.165.201.5 requires authorization:
FWSM/contexta(config)# access-list TELNET_AUTH extended permit tcp any any eq telnet
FWSM/contexta(config)# access-list SERVER_AUTH extended permit tcp any host 209.165.201.5
eq telnet
FWSM/contexta(config)# aaa-server AuthOutbound protocol tacacs+
FWSM/contexta(config)# aaa-server AuthOutbound (inside) host 10.1.1.1 TheUauthKey
FWSM/contexta(config)# aaa authentication match TELNET_AUTH inside AuthOutbound
FWSM/contexta(config)# aaa authorization match SERVER_AUTH inside AuthOutbound

Cisco Catalyst 6500 Series Specifications

General

Product Type	Switch
Switch Type	Modular
Switching Capacity	Up to 720 Gbps
Forwarding Rate	Up to 400 Mpps
Modular	Yes
Uplink Ports	Varies by module
QoS	Yes
Rack-mountable	Yes
Series	Catalyst 6500
Power over Ethernet (PoE)	Available on some models
Operating System	Cisco IOS
Redundancy	Yes (Supervisor engine, power supply)
Form Factor	Chassis-based
Slot Count	3, 6, 9, or 13 slots
Management	CLI, SNMP
Security Features	ACLs, 802.1X, port security
VLAN Support	Yes

Summary

Introduction to the Firewall Services Module

Features

Stateful Inspection Feature

Explains how the FWSM inspects traffic using the Adaptive Security Algorithm and session management path.

Routed Firewall and Transparent Firewall Modes

Security Contexts

Describes how to partition a single FWSM into multiple virtual firewalls (security contexts).

Connecting to the Firewall Services Module and Managing the Configuration

Sessioning and Logging into the Firewall Services Module

Details how to connect to the FWSM CLI, log in, and access configuration mode.

Managing the Configuration at the CLI

Configuring the Firewall Mode

Firewall Mode Overview

Setting the Firewall Mode

Details how to set the FWSM to run in routed or transparent firewall mode.

Managing Security Contexts

Security Context Overview

Explains security contexts as virtual firewalls within a single FWSM.

Enabling or Disabling Multiple Context Mode

Provides procedures to convert from single to multiple context mode and vice versa.

Configuring Resource Management

Details how to configure resource limits per context to prevent resource overuse.

Configuring a Security Context

Describes how to add a security context, including VLANs, resource class, and configuration URL.

Changing Between Contexts and the System Execution Space

Monitoring Security Contexts

Configuring Basic Settings

Changing the Passwords

Covers changing login, enable, and maintenance partition passwords for security.

Configuring Interfaces

Explains how to name and assign security levels to interfaces for full FWSM configuration.

Allowing Communication Between Interfaces on the Same Security Level

Configuring Connection Limits for Non-NAT Configurations

Configuring Bridging Parameters and ARP Inspection

Customizing the MAC Address Table

Configuring ARP Inspection

Describes how to enable and configure ARP inspection to prevent ARP spoofing.

Configuring IP Addresses, Routing, and DHCP

Configuring IP Addresses

Details setting IP addresses for routed or transparent firewall modes.

Configuring the Default Route

Explains how to configure the default route for FWSM traffic to reach unknown destinations.

Configuring Static Routes

Describes how to configure static routes for networks not directly connected to the FWSM.

Configuring OSPF

Configuring RIP

Configuring the DHCP Server

Details how to use the Dynamic Host Configuration Protocol (DHCP) server provided by the FWSM.

Configuring DHCP Relay

Describes how to configure the FWSM to forward DHCP requests to a connected router.

Configuring Network Address Translation

NAT Overview

Explains how Network Address Translation (NAT) works on the FWSM.

Introduction to NAT

NAT Types

Dynamic NAT

Explains how dynamic NAT translates local addresses to a pool of global addresses.

PAT

Describes PAT, which translates multiple local addresses to a single global IP address and unique port.

Static NAT

Explains how static NAT translates each local address to a fixed global address.

Static PAT

Details static PAT, which translates local IP to global IP and local port to global port.

Bypassing NAT

NAT Examples

Controlling Network Access with Access Control Lists

Access Control List Overview

Provides an overview of ACLs, their components (ACEs), and general guidelines for creation.

Access Control List Types and Uses

Controlling Network Access for IP Traffic (Extended)

Explains how to use extended ACLs to control IP traffic based on source, destination, protocol, or port.

Controlling Network Access for IP Traffic for a Given User (Extended)

Identifying Addresses for Policy NAT and NAT Exemption (Extended)

VPN Management Access (Extended)

Controlling Network Access for Non-IP Traffic (EtherType)

Adding an Extended Access Control List

Provides step-by-step instructions for adding extended ACEs to an ACL.

Simplifying Access Control Lists with Object Grouping

Describes using object groups to simplify ACL creation and maintenance.

Manually Committing Access Control Lists and Rules

Logging Extended Access Control List Activity

Allowing Remote Management

Allowing Telnet

Covers configuring Telnet access to the FWSM for management purposes.

Allowing SSH

Explains how to configure SSH access for secure management connections to the FWSM.

Allowing HTTPS for PDM

Allowing a VPN Management Connection

Describes how to configure IPSec VPN tunnels for secure management access.

Allowing ICMP to and from the FWSM

Configuring AAA

AAA Overview

Introduces AAA (Authentication, Authorization, Accounting) for user access control.

AAA Server and Local Database Support

Configuring the Local Database

Describes how to manage users in the local database for CLI and VPN access authentication.

Configuring Authentication for CLI Access

Explains how to configure username/password authentication for CLI login and enable commands.

Configuring Authentication to Access Privileged Mode

Details configuring authentication for users entering the enable or login commands.

Configuring Command Authorization

Describes how to control user access to specific commands via privilege levels or TACACS+.

Configuring Local Command Authorization

Explains how to assign commands to privilege levels and enable local command authorization.

Configuring TACACS+ Command Authorization

Details configuring TACACS+ for command authorization by checking commands against the server.

Viewing Command Privilege Levels

Recovering from a Lockout

Provides common lockout conditions and workarounds for CLI authentication and command authorization.

Configuring Authentication for Network Access

Describes configuring RADIUS or TACACS+ for network access authentication.

Enabling Network Access Authentication

Explains how to enable network access authentication using an ACL and a server group.

Enabling Secure Authentication of Web Clients

Configuring Authorization for Network Access

Describes configuring authorization rules or dynamic ACLs for network traffic access.

Configuring TACACS+ Authorization

Explains how to configure network access authorization using TACACS+ servers.

Configuring RADIUS Authorization

Describes how to configure RADIUS servers to download ACLs for per-user authorization.

Configuring Accounting for Network Access

Details how to send accounting information to RADIUS or TACACS+ servers for traffic tracking.

Configuring Application Protocol Inspection

Inspection Engine Overview

Provides an overview of application protocol inspection (fixup) and its impact on throughput.

When to Use Application Protocol Inspection

Inspection Support

Configuring an Inspection Engine

Provides instructions on how to configure or disable inspection engines for various protocols.

Detailed Information About Inspection Engines

Filtering HTTP, HTTPS, or FTP Requests Using an External Server

Filtering Overview

Discusses using external servers for practical web and FTP filtering over ACLs.

Configuring General Filtering Parameters

Details FWSM communication with filtering servers, handling errors, long URLs, and caching.

Identifying the Filtering Server

Filtering HTTP URLs

Filtering HTTPS URLs

Filtering FTP Requests

Viewing Filtering Statistics

Using Failover

Understanding Failover

Failover Overview

Regular and Stateful Failover

Failover and State Links

Configuring Failover

Provides detailed steps to configure failover for the primary and secondary modules.

Verifying the Failover Configuration

Explains how to verify the failover configuration using the 'show failover' command.

Testing the Failover Functionality

Disabling Failover

Monitoring Failover

Managing Software and Configuration Files

Installing Application or PDM Software

Details how to install or upgrade application, PDM, or maintenance software.

Installing Application or PDM Software to the Current Partition

Explains copying application or PDM software to the current partition from a server.

Installing Maintenance Software

Downloading and Backing Up Configuration Files

Covers downloading text configurations and backing up configuration files.

Downloading a Text Configuration

Backing Up the Configuration

Explains methods to back up configuration to an external server or terminal display.

Copying the Configuration to a Server

Details backing up single-mode or multiple-mode system configurations to an external server.

Monitoring and Troubleshooting the Firewall Services Module

Monitoring the Firewall Services Module

Using System Messages

Using SNMP

Troubleshooting the Firewall Services Module

Provides steps and techniques for troubleshooting FWSM issues.

Testing Your Configuration

Guides on testing FWSM connectivity, pinging interfaces, and verifying traffic flow.

Disabling the Test Configuration

Reloading the Firewall Services Module

Troubleshooting Passwords and AAA

Details how to recover from forgotten passwords or AAA lockout situations.

Common Problems

Sample Configurations

Routed Mode Examples

Example 1: Security Contexts With Outside Access

Example of creating multiple security contexts with inside, outside, and DMZ interfaces.

Example 2: Single Mode Using Same Security Level

Example 3: Shared Resources for Multiple Contexts

Example 4: Failover

Transparent Mode Examples

Example 5: Security Contexts With Outside Access

Example of transparent mode FWSM with multiple contexts and outside access.

Example 6: Failover