| 3.2 |  | Types of IP ACLs |
| 3.2.8 |  | Authentication proxy |

| Authentication proxy is used to authenticate inbound or outbound users, or both. Users who would normally be blocked by an ACL can bring up a browser to go through the firewall and authenticate on a TACACS+ or RADIUS server. The server passes additional ACL entries down to the router to allow the users through after authentication.

Authentication proxy is similar to lock-and-key, or dynamic ACLs. The differences are as follows:

- Lock-and-key is turned on by a Telnet connection to the router. Authentication proxy is turned on by HTTP through the router.
- Authentication proxy must use an external server.
- Authentication proxy can handle the addition of multiple dynamic lists. Lock-and-key can only add one.
- Authentication proxy has an absolute timeout but no idle timeout. Lock-and-key has both.

Authentication proxy configuration will be covered in greater detail later in this course.