Solved

PIX 501 cut-through proxy

Posted on 2004-04-22
5
604 Views
Last Modified: 2012-06-27
Hello, I have a pix 501 and need what i would believe to be a very simple configuration(for someone that knows how to do it)

I am installing this small pix at a smal 15 client site.  The configuration needs to require that people enter a password to access the internet.  

I was reading from the syngress PIX book and am trying to get a handle on this.  

Basically NO ONE is to get on the net without a password, we do not require user accounts, just a password.  HOWEVER the server does need to access the internet without a password(smtp, rdp).

Also how will this work with one to one outside/in NATS for publishing servers?

0
Comment
Question by:Brent92663
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
5 Comments
 
LVL 23

Expert Comment

by:Tim Holman
ID: 10901200
0
 
LVL 1

Expert Comment

by:ambarishsen
ID: 10901411
For the internet password feature which you are looking for PIX cannot handle that by itself,
you need to deploy a 3rd part server as a TACACS/RADIUS, for FTP/HTTP/Telnet.
and a static translation with ACL is required for outside to inside access.

Thanks.
0
 
LVL 23

Expert Comment

by:Tim Holman
ID: 10906683
You can definitely do this with a local password setup on the PIX.
0
 

Author Comment

by:Brent92663
ID: 10939850
Hmmm, conflicting answers here... anyone have a definitive answer?  With anything to back it up?  I don't want to have to use a server external to the pix.
0
 
LVL 23

Accepted Solution

by:
Tim Holman earned 500 total points
ID: 10940679
It's definitely possible, but not very well documented.  You can only do it with http, https, telnet and ftp.

These lines should do the trick...  ;)

aaa-server local protocol local
aaa authentication include http outbound 0 0 0 0 local
aaa authentication include https outbound 0 0 0 0 local
username tim_holman password

Command ref for AAA commands on 6.3:

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_reference_chapter09186a0080104239.html

I don't have a PIX to play with at the moment, but should be at least 99% correct !
0

Featured Post

Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

From Cisco ASA version 8.3, the Network Address Translation (NAT) configuration has been completely redesigned and it may be helpful to have the syntax configuration for both at a glance. You may as well want to read official Cisco published AS…
You deserve ‘straight talk’ from your cloud provider about your risk, your costs, security, uptime and the processes that are in place to protect your mission-critical applications.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question