| 4.5 |  | The Cisco IOS Firewall Authentication Proxy |
| 4.5.1 |  | Introduction to the IOS firewall authentication proxy |

| Overview The Cisco IOS Firewall authentication proxy feature enables network administrators to apply specific security policies on a per-user basis. User identity and related authorized access were previously associated with a user’s IP address, or a single security policy had to be applied to an entire user group or subnet. Now, users can be identified and authorized on the basis of their per-user policy, and access privileges can be tailored on an individual basis. With the authentication proxy feature, users can log into the network or access the Internet through HTTP , and their specific access profiles are automatically retrieved and applied from a Cisco Secure ACS, a RADIUS, or a TACACS+ authentication server. The user profiles are active only when there is active traffic from the authenticated users.

The authentication proxy is compatible with other Cisco IOS security features such as Network Address Translation (NAT), Context-Based Access Control (CBAC), IP Security (IPSec) encryption, and virtual private network (VPN) client software.

Supported servers
The Cisco IOS Firewall authentication proxy supports the following AAA protocols and servers , :

- Terminal Access Controller Access Control System Plus (TACACS+)

- Cisco Secure Access Control Server for Windows NT/2000
- Cisco Secure Access Control Server for UNIX
- TACACS+ Freeware

- Remote Authentication Dial-In User Service (RADIUS)

- Cisco Secure ACS for Windows NT/2000
- Cisco Secure ACS for UNIX
- Lucent
- Other standard RADIUS servers