Solved

PIX 501 cut-through proxy

Posted on 2004-04-22
5
589 Views
Last Modified: 2012-06-27
Hello, I have a pix 501 and need what i would believe to be a very simple configuration(for someone that knows how to do it)

I am installing this small pix at a smal 15 client site.  The configuration needs to require that people enter a password to access the internet.  

I was reading from the syngress PIX book and am trying to get a handle on this.  

Basically NO ONE is to get on the net without a password, we do not require user accounts, just a password.  HOWEVER the server does need to access the internet without a password(smtp, rdp).

Also how will this work with one to one outside/in NATS for publishing servers?

0
Comment
Question by:Brent92663
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
5 Comments
 
LVL 23

Expert Comment

by:Tim Holman
ID: 10901200
0
 
LVL 1

Expert Comment

by:ambarishsen
ID: 10901411
For the internet password feature which you are looking for PIX cannot handle that by itself,
you need to deploy a 3rd part server as a TACACS/RADIUS, for FTP/HTTP/Telnet.
and a static translation with ACL is required for outside to inside access.

Thanks.
0
 
LVL 23

Expert Comment

by:Tim Holman
ID: 10906683
You can definitely do this with a local password setup on the PIX.
0
 

Author Comment

by:Brent92663
ID: 10939850
Hmmm, conflicting answers here... anyone have a definitive answer?  With anything to back it up?  I don't want to have to use a server external to the pix.
0
 
LVL 23

Accepted Solution

by:
Tim Holman earned 500 total points
ID: 10940679
It's definitely possible, but not very well documented.  You can only do it with http, https, telnet and ftp.

These lines should do the trick...  ;)

aaa-server local protocol local
aaa authentication include http outbound 0 0 0 0 local
aaa authentication include https outbound 0 0 0 0 local
username tim_holman password

Command ref for AAA commands on 6.3:

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_reference_chapter09186a0080104239.html

I don't have a PIX to play with at the moment, but should be at least 99% correct !
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Have you experienced traffic destined through a Cisco ASA firewall disappears and you do not know if the traffic stops in the firewall or somewhere else? The solution is the capture feature. This feature was released in 6.2(1) and works in all firew…
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question