| 11.3 |  | Authorization and Accounting Configuration |
| 11.3.4 |  | Defining traffic to utilize AAA services |

| Defining traffic that will utilize AAA services has traditionally been somewhat difficult. As has been explained in the previous sections, the include and exclude command arguments have been needed in order to accomplish this. However, in PIX Security Appliance IOS version 5.2 and higher, the aaa match acl_name command was introduced. Essentially, this command allows AAA services to be applied to traffic that is defined in an ACL. This gives the administrator greater flexibility in determining what traffic will be subject to these services.

Traditional aaa command configuration and functionality continue to work as in previous versions and are not converted to the ACL format. Hybrid configurations, which are traditional configurations combined with the new ACL configurations, are not recommended.

The Command Reference illustrates the ACL mylist permitting all TCP traffic from network 10.0.0.0 to network 172.26.26.0. The match acl_name option in the aaa command instructs the PIX Security Appliance to require authentication when the action the user is trying to perform matches the actions specified in mylist. Therefore, as shown in Figure , any time a user on the 10.0.0.0 internal network uses any TCP application to access network 172.26.26.0, the user will be required to authenticate.

The Command Reference examines long URLs and how to configure the PIX Security Appliance to deal with them.

| Lab Activity e-Lab Activity: AAA Configuration Lab In this activity, the student will configure your PIX Security Appliance to work with an AAA server running CSACS software.