ASA CTP https direct auth

giuseppe parlato — Mon, 11 Mar 2019 06:56:38 GMT

Hello,

I've configured the following to enable CTP on Cisco ASA (identity configuration was already in place),

aaa authentication listener https INSIDE port 5601
access-list INSIDE_authentication line 1 extended permit tcp host 10.15.196.129 host 10.0.1.129 eq 5601
aaa authentication match INSIDE_authentication INSIDE user-identity

It works but my concern relates to some commands that I do not understand what exactly serve, or if they can be useful to force authentication exclusively in https or encrypted which actually should already be guaranteed with "aaa authentication listener https". For instance redirect option in "aaa authentication listener command is it used to redirect in case INSIDE_authentication access-list contains other ip for which authentication is required ?

Then from http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/access_fwaaa.html#66940 also aaa authentication secure-http-client ?

Thanks for your help

topic ASA CTP https direct auth in Network Access Control

ASA CTP https direct auth