| 11.2 |  | Authentication Configuration |
| 11.2.6 |  | Authentication of console access |

| As with routers, a critical component of securing the PIX Security Appliance is to require authentication of console access. This is accomplished by using the aaa authentication console command. aaa authentication command This command can be used to secure different types of access shown in Figure .

Of course the aaa authentication command is configured slightly differently depending on which option or options are chosen. The PIX also treats these options slightly differently. This section will examine some of these differences.

While the

enable and ssh options allow three tries before stopping and issuing an ‘access denied' message, both the serial and Telnet options cause prompts to be issued continually until log in is successful.

Another difference is the way each method requires the user to provide a username and password. The serial option requests them before the first command-line interface (CLI) prompt on the console connection. Do not confuse this with a serial link such as Frame Relay, ISDN, Dialup, or other WAN link. This applies to a typical connection to the console port using a rollover cable to connect a PC running a terminal emulation program.

The

telnet option, on the other hand, forces an administrator to specify a username and password before the first CLI prompt of a Telnet console connection. The ssh option requests a username and password before the first CLI prompt on the SSH console connection. Finally, the enable option requests a username and password before accessing privileged mode for serial, Telnet, or SSH connections.

Telnet access to the PIX Security Appliance console is available from any internal interface and requires previous use of the

telnet command. Access is also available from the outside interface with IP Security (IPSec) configured. SSH access to the PIX Security Appliance console is available from any interface without IPSec configured and requires previous use of the ssh command.

Authentication of the serial console creates a potential deadlock situation. This could occur if the authentication server requests are not answered and access to the console is needed in order to diagnose this problem. If the console login request times out, administrators can gain access to the PIX Security Appliance from the serial console by entering the PIX Security Appliance username and the enable password. The maximum password length for accessing the console is 16 characters.

The aaa authentication command and the PDM
The PIX Device Manager (PDM) is a graphical user interface (GUI) method of configuring the PIX Security Appliance. Module 15 will look at this device in more detail. It is important, however, to know that the aaa authentication command also supports PDM authentication. By using the

aaa authentication http console command, administrators can configure the PIX Security Appliance to require authentication before allowing the PDM to access it. If an aaa authentication http console command statement is not defined, then administrators can gain access to the PIX Security Appliance, via PDM, with no username. All they need is the PIX Security Appliance enable password, which is set with the password command. If the aaa command is defined but the HTTP authentication request times out, this implies that the AAA server may be down or not available. Administrators can gain access to the PIX Security Appliance using the username ‘pix’ and the enable password.

The serial console option also logs any changes made to the configuration from the serial console to a Syslog server.