| 11.1 |  | AAA |
| 11.1.3 |  | Cut-through proxy operation |

| The PIX Security Appliance gains dramatic performance advantages because of using the cut-through proxy. Cut-through proxy is a method of transparently verifying the identity of users at the firewall, and permitting or denying access to any TCP or UDP-based application. In addition, cut-through proxy also leverages the authentication and authorization services of the Cisco Secure Access Control Server (ACS).

The PIX Security Appliance cut-through proxy initially challenges a user at the application layer. It then authenticates against standard TACACS+ or RADIUS databases. After the policy is checked, the PIX Security Appliance shifts the session flow and all traffic flows directly and quickly between the server and the client while maintaining session state information.