| 8.2 |  | The Cisco PIX Security Appliance |
| 8.2.4 |  | Cut-through proxy operation |

| Cut-through proxy is a method of transparently verifying the identity of the users at the firewall, and permitting or denying them access to any TCP- or UDP-based applications . Cut-through proxy is also known as user-based authentication for inbound or outbound connections. Unlike a proxy server that will analyze every packet at the application layer of the OSI model, the PIX Security Appliance first challenges a user at the application layer. After the user is authenticated and the policy is checked, the PIX Security Appliance shifts the session flow to a lower layer of the OSI model for dramatically faster performance. This allows security policies to be enforced on a per-user-identification basis.

Before a connection can be established, it must be authenticated with a user identification and password. The user identification and password is entered via an initial HTTP, Telnet, or FTP connection. This method eliminates the price performance impact that UNIX system-based firewalls impose on similar configurations. It also allows a finer level of administrative control over connections. Figure illustrates the cut-through proxy process.

The cut-through proxy method of the PIX Firewall also leverages the authentication and authorization services of the Cisco Secure Access Control Server (CSACS).