| 4.5 |  | The Cisco IOS Firewall Authentication Proxy |
| 4.5.2 |  | Authentication proxy operation |

| When a user initiates an HTTP session through the firewall, it triggers the authentication proxy, which checks to see if the user has been authenticated. If a valid authentication entry exists for the user, the session is allowed. The authentication proxy requires no further intervention. If no entry exists, the authentication proxy responds to the HTTP connection request by prompting the user for a username and password.

Users must successfully authenticate with the authentication server by entering a valid username and password. If the authentication succeeds, the user’s authorization profile is retrieved from the AAA server. The authentication proxy uses the information in this profile to create dynamic access control entries (ACEs) and add them to the inbound access control list (ACL) of an input interface, and to the outbound ACL of an output interface if an output ACL exists at the interface. By doing this, the firewall allows authenticated users access to the network as permitted by the authorization profile. For example, a user can initiate a Telnet connection through the firewall if Telnet is permitted in the user’s profile.

If the authentication fails, the authentication proxy reports the failure to the user and prompts the user with multiple retries. If an input ACL exists on an interface and the user fails to authenticate after five attempts, the user must wait two minutes and initiate another HTTP session to trigger the authentication proxy.

The authentication proxy sets up an inactivity, or idle, timer for each user profile. As long as there is activity through the firewall, new traffic initiated from the user’s host does not trigger the authentication proxy, and all authorized user traffic is permitted access through the firewall.

If the idle timer expires, the authentication proxy removes the user’s profile information and dynamic ACL entries. When this happens, traffic from the client host is blocked. The user must initiate another HTTP connection to trigger the authentication proxy.

The following activity demonstrates the tasks involved in configuring the authentication proxy.

| Lab Activity Lab Exercise: Configure Authentication Proxy In this lab exercise, students will complete the following tasks:

- Configure ACS for Windows 2000
- Configure AAA
- Configure an authentication proxy
- Test and verify an authentication proxy

| Lab Activity e-Lab Activity: Configure Authentication Proxy on Cisco Router In this activity, students will configure AAA, configure authentication proxy, test and verify authentication proxy.

| Lab Activity e-Lab Activity: Test and Verify AAA In this activity, students will test and verify authentication proxy.

| Lab Activity e-Lab Activity: Configure Authentication In this activity, students will configure authentication proxy on a Cisco router.

| Lab Activity e-Lab Activity: Configure AAA In this activity, students will configure AAA on the Cisco router.