| 11.1 |  | AAA |
| 11.1.1 |  | Overview of authentication, authorization, and accounting |

| While students should already be familiar with authentication, authorization, and accounting (AAA) from module 4, this module will look at how AAA services are supported by the PIX Security Appliance. As with routers, AAA is used to tell the PIX Security Appliance certain information about the authentication process:

- Authentication - identifies who the user is
- Authorization - defines what the user can do
- Accounting - records what the user did

It should become apparent that these processes are similar regardless of which device is used.

For example, there are 100 users inside the firewall. The administrator wants only six of these users to be permitted to perform FTP, Telnet, or HTTP outside the network. The administrator needs to configure the PIX Security Appliance to authenticate outbound traffic and give all six users identifications on the TACACS+ or RADIUS AAA server. The PIX Security Appliance supports TACACS authorization only and does not support authorization with RADIUS.

With simple authentication, these six users are authenticated with a username and password, and then are permitted outside the network. The other 94 users cannot go outside the network. Like a router, the PIX Security Appliance provides authentication by prompting users for their username and password and then passing their username and password to the AAA server. Depending on the server response, the PIX opens or denies the connection.

Now suppose that the administrator does not trust one of the users. This user has the username ‘baduser’. As a security precaution, the administrator wants to allow baduser to perform only FTP, but not HTTP or Telnet, to the outside network. This means that the administrator must enable authorization services in order to control what users can do, in addition to authenticating services that verify who the users are.

Once authorization is added to the PIX, it first sends the untrusted user’s username and password to the AAA server. The PIX Security Appliance then sends an authorization request to the AAA server, telling the AAA server what command baduser is trying to do. If the AAA server is set up properly, baduser is allowed to perform FTP but is not allowed to perform HTTP or Telnet.

Accounting functions keep log files that detail various transactions. The administrator configures the location of these logs and what is recorded in them. The configuration is done according to the perceived network needs, which are defined in the network security policy.