| 11.3 |  | Authorization and Accounting Configuration |
| 11.3.1 |  | Configuring the PIX Security Appliance to support AAA authorization |

| As with routers, once authentication has been enabled on the PIX Security Appliance, AAA authorization services can then be enabled. This section will focus on how to enable AAA authorization on the PIX Security Appliance. Authorization is enabled by using the aaa authorization command. Although PIX Security Appliances support authentication to either a TACACS+ server or a RADIUS server, they support authorization only to a TACACS+ server, as shown in the figure. Authorization is only supported to RADIUS using downloadable ACLs. This means that if a RADIUS server was selected for authentication with the aaa server command, standard authorization to it will not be supported. Downloadable ACLs will be discussed later in this module.

aaa authorization Command
Once a user has been authenticated, AAA authorization allows AAA servers to determine what services a user can access. The authorization process is transparent to the user and would only be noticed if a user attempts to access an application or file for which they do not have permission.

The aaa authorization command is very similar in syntax to the aaa authentication command and includes the same options:

- The ability to include or exclude authorization of specific service such as FTP, HTTP, and Telnet
- The ability to apply authorization to either inbound or outbound connections

The command also allows for the authorization of traffic that is not FTP, Telnet, or HTTP traffic. It does this by allowing the administrator to authorize services by protocol or by port number. Keep in mind that when authorization is enabled, authorization services are applied to all protocols and ports by default. To exclude specific protocols or ports, the exclude argument must be used to create an exception.

| Resources How to create Authorization Rules Allowing Specific Services on the CSACS How to Create Authorization Rules Allowing Services Only to Specific Hosts on the CSACS How to Authorize Non-Telnet, FTP, or HTTP Traffic on the CSACS