| 11.2 |  | Authentication Configuration |
| 11.2.5 |  | Virtual HTTP |

| One common problem that is often encountered when using HTTP authentication is that Web browsers do not always work correctly in conjunction with the PIX Security Appliance. Virtual HTTP was designed to correct this problem. Virtual HTTP is especially useful for PIX Security Appliance interoperability with Microsoft Internet Information Server (IIS). It can also be useful for other authentication servers. When using HTTP authentication to a site running Microsoft IIS that has Basic text authentication or NT Challenge enabled, users may be denied access from the Microsoft IIS server. This is because the browser appends the following string to the HTTP GET commands:

> Authorization: Basic=Uuhjksdkfhk==

This string contains the PIX Security Appliance authentication credentials. Microsoft IIS servers respond to the credentials and assume that a Windows NT user is trying to access privileged pages on the server. Unless the PIX Security Appliance username and password combination is exactly the same as a valid Windows NT username and password combination on the Microsoft IIS server, the HTTP GET command is denied.

The problem occurs because the PIX Security Appliance assumes that the AAA server database is shared with a Web server. Therefore, the PIX automatically provides the AAA server and Web server with the same information. The virtual HTTP option solves this problem by doing the following:

- Working with the PIX Security Appliance to authenticate the user
- Separating the AAA server information from the Web client URL request Web
- Directing the Web client to the Web server

The virtual HTTP option redirects the initial web browser connection to an IP address that resides in the PIX Security Appliance. This authenticates the user, and then redirects the browser back to the URL that the user originally requested. This is called the Virtual HTTP option because it accesses a virtual HTTP server on the PIX Security Appliance. In reality this server does not physically exist. Virtual HTTP is transparent to the user. Therefore, users enter actual destination URLs in their browsers as they normally would.

Do not set the

timeout uauth duration to 0 seconds when using the virtual HTTP option. Doing so prevents HTTP connections to the real Web server.