Authenticating directly with the asa – Cisco ASA 5505 User Manual
Page 781
38-7
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 38 Configuring AAA Rules for Network Access
Configuring Authentication for Network Access
timeout to 1 second with the timeout uauth 0:0:1 command. However, this workaround opens
a 1-second window of opportunity that might allow unauthenticated users to go through the
firewall if they are coming from the same source IP address.
Because HTTPS authentication occurs on the SSL port 443, users must not configure an access-list
command statement to block traffic from the HTTP client to the HTTP server on port 443. Furthermore,
if static PAT is configured for web traffic on port 80, it must also be configured for the SSL port.
–
In the following example, the first set of commands configures static PAT for web traffic, and
the second set of commands must be added to support the HTTPS authentication configuration:
object network obj-10.130.16.10-01
host 10.130.16.10
nat (inside,outside) static 10.132.16.200 service tcp 80 80
object network obj-10.130.16.10-02
host 10.130.16.10
nat (inside,outside) static 10.132.16.200 service tcp 443 443
Authenticating Directly with the ASA
If you do not want to allow HTTP, HTTPS, Telnet, or FTP through the ASA but want to authenticate
other types of traffic, you can authenticate with the ASA directly using HTTP, HTTPS, or Telnet.
This section includes the following topics:
•
Authenticating HTTP(S) Connections with a Virtual Server, page 38-8
•
Authenticating Telnet Connections with a Virtual Server, page 38-9