PIX Authentication timer

cdellis — Fri, 21 Feb 2020 18:02:38 GMT

I have a requirement to authenticate all outbound HTTP connections.

I would like the user to have to authenticate once per session. By session I mean, they open the browser, point to an external site, get prompted for authentication, authenticate and now they can browse to any site they want to without having to re-authenticate. If they close their browser, they are again prompted for authentication.

This is not how the PIX works as far as I can tell. The PIX uses the internal uauth timer which basically has an absolute timeout or an inactivity timeout. In my testing, this has been problem because if a the uauth is set too low the user is re-prompted a number of times during one session. If the timer is set too high, the user could potentially close their browser, shut down the machine, a different user logs in on the same machine and then hi-jacks the authenticated HTTP session from the previous user. This is not acceptable.

Does anyone know of a way that I can authenticate on browser session with the PIX? I know Symantec Enterprise Firewall works this way. Am I not getting my timers right?

Any help is greatly appreciated!

Re: PIX Authentication timer

yusuff — Sun, 04 Aug 2002 09:06:56 GMT

Try configuring VIRTUAL HTTP or VIRTUAL TELNET options;

http://www.cisco.com/warp/public/110/atp52.html#tel_out

http://www.cisco.com/warp/public/110/atp52.html#http

HTH

R/Yusuf

topic PIX Authentication timer in Network Access Control

PIX Authentication timer

Re: PIX Authentication timer