| Overview

A previous module introduced the concept of authentication, authorization, and accounting (AAA) security and how it is configured on Cisco routers. This module will review AAA security and show how the PIX Security Appliance supports AAA services.

Two primary commands configure the PIX for basic authentication to the Cisco Secure asynchronous communications server (ACS). These commands are the aaa-server command and the aaa authentication command. Both commands will be discussed in detail within this module. Students will also have the opportunity, through hands-on lab exercises, to work with these commands when configuring the PIX for authentication. Additional authentication using protocols excluding Telnet, FTP, or HTTP traffic on the PIX, is also discussed.

After discussing authentication, the student will learn how to configure authorization. As with authentication, authorization must be enabled on the PIX through the use of the aaa authorization command. Furthermore, by using the downloadable access control list (ACL) feature, per-user ACLs on an AAA server can be downloaded to the PIX Security Appliance during user authentication. After authorization, accounting configuration is discussed. When dealing with AAA, it is important to remember the following:

- Authentication asks who the user is
- Authorization determines what the user can do
- Accounting records what the user has done

This module will then examine how to configure, monitor, and troubleshoot AAA configurations on the PIX. Additionally, students will be introduced to the concept of Point-to-Point Protocol over Ethernet (PPPoE). Students will learn how this technology, combined with PIX Security Appliance support, provides secure broadband access to small offices and home users.

NOTE: It is required that the student study the commands covered in the chapter using the labs and the command reference. Not all required commands are covered in sufficient detail in the text alone. Successful completion of this course requires a thorough knowledge of command syntax and application.