| 11.2 |  | Authentication Configuration |
| 11.2.1 |  | Configuring the PIX Security Appliance to support authentication |

| As was discussed in the previous section, the PIX Security Appliance is capable of authenticating users to a remote Cisco Secure ACS using either the TACACS+ or RADIUS AAA protocols. This section will discuss how to enable the PIX Security Appliance to run authentication services and communicate successfully with Cisco Secure ACS servers.

Two primary commands configure the PIX for basic authentication to the Cisco Secure ACS. These are the

aaa-server command and the aaa authentication command. These commands are explained below and in the associated command references.

aaa-server command
The aaa-server command is used to specify AAA server groups. The PIX Security Appliance enables administrators to define separate groups of TACACS+ or RADIUS servers for specifying different types of traffic. An example of this would be defining and specifying a TACACS+ server for inbound traffic and another for outbound traffic. The aaa command references the group tag to direct authentication, authorization, or accounting traffic to the appropriate AAA server.

Up to 14 tag groups are allowed and each group can have up to 14 AAA servers, for a total of up to 196 TACACS+ or RADIUS servers. When a user logs in, the servers are accessed one at a time, starting with the first server specified in the tag group, until a server responds.

The default configuration provides the following two AAA server protocols:

- aaa-server TACACS+ protocol tacacs+
- aaa-server RADIUS protocol radius

Using the default server groups enables administrators to maintain backward compatibility with the

aaa command statements. This is only possible if the PIX Security Appliance is upgraded from a previous version of the PIX Security Appliance and has the aaa command statements in its configuration.

aaa authentication command
The aaa authentication command enables or disables user authentication services. When starting a connection via Telnet, FTP, or HTTP, administrators are prompted for a username and password. An AAA server, designated previously with the aaa-server command, verifies whether the username and password are correct. If they are correct, the PIX Security Appliance cut-through proxy permits further traffic between the initiating host and the target host.

The aaa authentication command is not intended to mandate the network security policy. The AAA servers determine the following:

- Whether a user can or cannot access the system
- What services can be accessed
- What IP addresses the user can access

The PIX Security Appliance interacts with Telnet, FTP, and HTTP to display the prompts for logging.

It is possible to specify that only a single service be authenticated, but the configurations of both the AAA server and the firewall must agree on this. For each IP address, one aaa authentication command is permitted for inbound connections, and one for outbound connections.

It should be noted that the PIX Security Appliance permits only one authentication type per network. For example, if one network connects through the PIX Security Appliance using TACACS+ for authentication, another network can connect through the PIX Security Appliance using RADIUS for authentication. However, a single network cannot authenticate with both TACACS+ and RADIUS.