| 11.1 |  | AAA |
| 11.1.2 |  | What the user sees |

| There are three possible methods administrators can use to authenticate users using a PIX Security Appliance. In each case, users establish their own connections to the PIX. Next, the PIX opens a session to the target server. Each method will now be explained in greater detail:

- Telnet - The PIX Security Appliance issues a prompt and allows the user a maximum of four login attempts. If the username or password fails after the fourth attempt, the PIX Security Appliance drops the connection. If authentication and authorization are successful, the destination server will prompt the administrator for the user’s username and password.
- FTP - The user gets a prompt from the FTP program. If an incorrect password is entered, the connection is dropped immediately. If the username or password on the authentication database differs from the username or password on the remote host from which the user is accessing via FTP, enter the username and password in the following formats:

> aaa_username@remote_username

> aaa_password@remote_password

> The PIX sends the aaa_username and aaa_password to the AAA server. If authentication and authorization are successful, the remote_username and remote_password are sent to the destination FTP server.

- HTTP - The user will see a window generated in a Web browser. If an incorrect password is entered, a prompt appears. If the username or password on the authentication database differs from the username or password on the remote host that the user is using HTTP to access, the user enters the username and password in the following formats:

> aaa_username@remote_username

> aaa_password@remote_password

> The PIX Security Appliance sends the aaa_username and aaa_password to the AAA server. If authentication and authorization are successful, the remote_username and remote_password are passed to the destination HTTP server.

Figure illustrates what the user would see when authenticating with each of the methods listed above.

If PIX Security Appliances are in tandem, Telnet authentication works in the same way as a single PIX Security Appliance. However, FTP and HTTP authentication have additional complexity because administrators must enter each password and username with an additional @ character and password or username for each in-tandem PIX Security Appliance.

Once authenticated with HTTP, a user never has to reauthenticate no matter how low the PIX Security Appliance uauth timeout is set. This is because the browser caches the ‘Authorization: Basic= Uuhjksdkfhk== ’ string in every subsequent connection to that particular site. This can only be cleared when the user exits all instances of the Web browser and restarts. Flushing the cache will not clear the strings in this situation.