| 11.2 |  | Authentication Configuration |
| 11.2.4 |  | Virtual Telnet |

| The virtual Telnet option provides a way to reauthenticate users who require connections through the PIX Security Appliance using services or protocols that do not support authentication. The virtual Telnet IP address is used both to authenticate in and authenticate out of the PIX Security Appliance.

When an unauthenticated user Telnets to the virtual IP address, the user is asked for a username and password. The TACACS+ or RADIUS server then authenticates the user. Once authenticated, the user sees the message ‘Authentication Successful’ and the authentication credentials are cached in the PIX Security Appliance for the duration of the user authentication (uauth) timeout.

If a user wishes to log out and clear the entry in the PIX Security Appliance using the

clear uauth command, the user can again Telnet to the virtual address and the following will occur:

- The user is prompted for a username and password
- The PIX Security Appliance removes the associated credentials from the user authentication cache
- The user receives a ‘Logout Successful’ message

In Figure , the user wants to establish a NetBIOS session on port 139 to access the file server named “Superserver”. The user Telnets to the virtual IP address at 192.168.0.5 and is immediately asked for a username and password, before being authenticated with the TACACS+ AAA server. Once authenticated, the PIX Security Appliance allows the user to connect to the file server without reauthentication.