| 4.5 |  | The Cisco IOS Firewall Authentication Proxy |
| 4.5.3 |  | Authentication proxy configuration tasks |

| Apply the authentication proxy in the inward direction at any interface on the router where per-user authentication and authorization is needed. Applying the authentication proxy inward at an interface causes it to intercept a user’s initial connection request before that request is subjected to any other processing by the firewall. If the user fails to authenticate with the AAA server, the connection request is dropped.

Authentication proxy should be applied based on the security policy. For example, all traffic can be blocked through an interface, and the authentication proxy feature can be enabled to require authentication and authorization for all user-initiated HTTP connections. Users are authorized for services only after successful authentication with the AAA server. The authentication proxy feature also enables the use of standard ACLs to specify a host or group of hosts whose initial HTTP traffic triggers the proxy.

The following tasks to configure the authentication proxy are shown in Figure . These tasks are covered in detail in the demonstration activities below.

First, configure the ACS server for authentication proxy. Second, the authentication proxy for AAA services must be configured. Use the following commands in global configuration mode to enable authorization and to define the authorization methods. Also, enable the HTTP server on the firewall and set the HTTP server authentication method to use AAA. Third, to configure the authentication proxy, use the following commands shown in Figure . Finally, to troubleshoot the authentication proxy configuration, use the commands shown in Figure .

| Media Activity Demonstration Activity: Task 1 - AAA Server Configuration for Auth-proxy This activity demonstrates how to configure the AAA server to provide authentication and authorization for the Cisco IOS Firewall authorization proxy.

| Media Activity Demonstration Activity: Task 2 - AAA Configuration for Auth-proxy This activity discusses how to configure the Cisco IOS Firewall to work with an authentication, authorization, and accounting (AAA) server and enable the authentication proxy feature.

| Media Activity Demonstration Activity: Task 3 - Authentication Proxy Configuration This activity discusses how to configure the authentication proxy settings on a Cisco router.

| Media Activity Demonstration Activity: Task 4 - Test and Verify the Auth-proxy Configuration This activity discusses the procedures for testing and verifying the authentication proxy configuration.