Cisco PIX 525 Especificações descarregar pdf (Página 33)

1-7

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 1 Getting Started

Controlling Network Access

The PIX Firewall allows a RADIUS server to send user group attributes to the PIX Firewall in the

RADIUS authentication response message. The PIX

Firewall then matches an access list to the attribute

and determines RADIUS authorization from the access list. After the PIX

Firewall authenticates a user,

it will apply an access list for the user that was returned by the AAA server using the Cisco acl attribute

(acl=<acl_name>).

For additional information about configuring AAA servers for use with the PIX Firewall see

Authentication and Command Authorization for PIX at the following URL:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00800949d6.sht

Access Lists

Beginning with Version 5.3, the PIX Firewall uses access lists to control connections between inside and

outside networks. Access lists are implemented with the access-list and access-group commands. These

commands are used instead of the conduit and outbound commands, which were used in earlier

versions of PIX Firewall software. In major software releases after Version 6.3, the conduit and

outbound commands are no longer supported. To migrate an obsolete PIX configuration file that

contains conduit and outbound commands to a supported configuration file that contains the equivalent

access-list commands, a tool is available to help with the conversion process:

• https://cco-dev.cisco.com/cgi-bin/Support/OutputInterpreter/home.pl (online tool)

• http://www.cisco.com/cgi-bin/tablebuild.pl/pix (download tool)

Note PIX Firewall Version 6.3 improves your ability to log information about activity associated with specific

access control lists (ACLs). Version 6.3 also lets you add comments to each ACL, so you can describe

the purpose and expected effect of each entry.

You can use access lists to control connections based on source address, destination address, or protocol.

Configure access lists carefully to allow the minimum access required. When possible, make access lists

more restrictive by specifying a remote source address, local destination address, and protocol. The

access-list and access-group commands take precedence over the conduit and outbound commands in

your configuration.

TurboACL

A feature called TurboACL was introduced in PIX Firewall Version 6.2 that improves the way that the

PIX

Firewall processes large access control lists. The method by which the PIX Firewall searches for an

access list entry has been improved to reduce the time spent searching large access lists. TurboACL

supports access lists with up to 16,000 access list entries.

Downloadable ACLs

When used with a AAA server, PIX Firewall lets you create access lists that control connections on a

per-user basis. Creating per-user access lists requires creating a user profile for the user on a RADIUS

server. In previous versions of PIX

Firewall, you also had to configure an access list for each user locally

on each PIX

Firewall. Beginning with PIX Firewall Version 6.2, the required per-user access list is

downloaded from the AAA server based on the user profile. No additional access list configuration is

required on any PIX

Firewall. This new feature greatly reduces the complexity and improves the

scalability of per-user access lists.

1 2 ... 28 29 30 31 32 33 34 35 36 37 38 ... 465 466

Comentários a estes Manuais

Sem comentários

Cisco PIX 525 Especificações Página 33

Comentários a estes Manuais

Manuais e produtos relacionados com Sistemas de segurança - controlo de acesso Cisco PIX 525