10-06-2006 04:53 AM - edited 03-10-2019 02:46 PM
hi,
I have this internal web server protected by the pix. now I want the pix to use aaa and ask for authentication when the user tries to connect to the firewall which by using static send the request to the web server.
this is my code,
access-list from_outside extended permit icmp any any log
access-list from_outside extended permit tcp any host <mypublicip> eq 11070 log
access-list from_outside extended permit tcp any host <mypublicip> eq https log
access-list from_outside extended deny ip any any log
access-list acl_auth extended permit tcp any any eq https
aaa-server MYAAA protocol radius
aaa-server MYAAA (inside) host 1.0.76.122
key MYSECRETKEY
authentication-port 1812
aaa authentication ssh console MYAAA LOCAL
aaa authentication match acl_auth outside MYAAA
auth-prompt prompt Enter your user and pass!
auth-prompt accept YESSSSSSSSSSSSSSSSSSSSSSSSSsss
auth-prompt reject NOOOOOOOOOOOOOOOOOOOOOOo
now when I try to connect to
https://<mypublicip>
I don't get any internet explorer popups and in my pix logs I see a line
%PIX-7-109014: uauth_lookup_net fail for get_np_flow_info()
on cisco it says that I have to use authorization as well but I don't understand why, I don't even get a popup to type my user/pass.
also, I'm using freeradius on a linux box, the authentication works because to log into my cisco I use aaa and I can log no problem there.
any help would be appreciated.
thank you.
10-06-2006 06:47 AM
my 2nd question:
if a user from a company that's using PAT gets to the pix, for the first user the pix will prompt for a user/pass but not for the other users since the user coming from that IP has already authenticated.
how can I force the pix to ask for a user/pass anyway? I'm not even sure that this can be done...
what's my option if I want all the user coming from the same IP to be authenticated by the pix?
thank you!!
10-16-2006 01:00 PM
Hi..
Regarding your second question :
Try to lower down the uauth timeout on the PIX.
Thanks
Kanishka
10-16-2006 01:02 PM
Hi
Regarding your first question :
Change the exisiting command to :
aaa authentication match acl_auth inside MYAAA
Thanks
Kanishka
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide