Problem:
Want to let customer authenticate at PIX outside interface and then open up SQL port 1433 to run enterprise manager
Port 1433 not accessable by anyone else unless authenticated
I'm looking for the type of functionallity that the lock and key access lists can do in IOS
Customer will be outside the PIX, The server in question (2.2.2.2) currently has a functioning static and access-lists that
allow the world to hit a web site hosted on the server.
AAA is working for administrative login to the pix console over telnet and SSH
This is what I have:real IP addresses removed
access-list OutsideAuth permit tcp any host 2.2.2.2 eq 1433
access-list OutsideAuth permit tcp any host 2.2.2.100 eq www
access-list OutsideAuth permit tcp any host 2.2.2.100 eq https
aaa-server AuthServer protocol tacacs+
aaa-server AuthServer (inside) host 1.1.1.1 password timeout 5
aaa authentication secure-http-client
aaa authentication telnet console AuthServer
aaa authentication ssh console AuthServer
aaa authentication match OutsideAuth outside AuthServer
virtual http 2.2.2.100
My hope is that user could securely HTTP to 2.2.2.100, authenticate and then hit port 1433
If I hit the 2.2.2.100 address i get a web screen with a username and password boxes. I dont see the
secure Java based authentication screen.
Am I on the right track ? Can this be done?
