| 11.2 |  | Authentication Configuration |
| 11.2.7 |  | Changing authentication timeouts and authentication prompts |

| Students should now be familiar with how to enable AAA authentication on the PIX Security Appliance. However, once AAA authentication is enabled, there are several other auxiliary commands that are useful in providing additional security or a better user interface. Two of these commands are examined below.

timeout uauth

c ommand
One way to improve network security is to configure the connections that are established across a PIX Security Appliance to timeout after a specified period of time . This is referred to as the authentication timeout. PIX supports two methods of authentication timeout.

The first method is to drop connections that have been idle for a specified period of time. The user then must reauthenticate in order to reestablish the connection. The second method causes all connections to timeout after a specified period of time, regardless of whether they have been active or not. Again, the user must reauthenticate in order to reestablish the connection.

The second method provides a greater degree of security than the first. However, it also creates a larger burden on network users. The method of authentication timeout that an administrator chooses to use will depend on the network policy. Both types of authentication timeout are supported by the PIX Security Appliance using the

timeout uauth command. The inactivity and absolute qualifiers for this command determine whether users must reauthenticate after a period of inactivity or after an absolute duration. The timers are:

- Inactivity timer - The inactivity timer starts after a connection becomes idle. If a user establishes a new connection before the duration of the inactivity timer, the user is not required to reauthenticate. If a user establishes a new connection after the inactivity timer expires, the user must reauthenticate.
- Absolute timer - The absolute timer runs continuously, but waits to re-prompt the user when the user starts a new connection. The new connection can be started, by doing something such as clicking a link after the absolute timer has elapsed. The user is then prompted to reauthenticate. The absolute timer must be shorter than the xlate timer. Otherwise, a user could be re-prompted after their session has already ended.

auth-prompt command
Another potentially useful feature that the PIX Security Appliance provides is that the network administrator is allowed to modify the prompt that a user sees when that person is authenticating to the network .

By default, users only see the username and password prompt when authenticating to the network. The

auth-prompt command allows the administrator to modify this prompt. It also allows the administrator to define the message that is displayed when a user successfully, or unsuccessfully, authenticates to the network.

| Lab Activity e-Lab Activity: Authentication of Non-Telnet, FTP or HTTP Traffic In this activity, the student will configure virtual Telnet, virtual HTTP, console authentication, authentication timeouts and authentication prompts.