Cisco ASA Cut-Through Proxy Authentication with User Identity

[giuseppe parlato]

Hello,

I'd like to implement Cut-Through Proxy LDAP Authentication with User Identity for pc that are not in AD domain. What about if those pc have ssh rules for example ? I guess it is not possible to intercept ssh traffic then open a listener http page to authenticate user.

[Vibhor Amrodia]

Hi,

So your query is that you would like Cut Thru Authentication to work for the users not in LDAP where LDAP is your AAA server ?

I don't think this should be possible as the user identity would not be known to the ASA device to apply the rules.

Thanks and Regards,

Vibhor Amrodia

[giuseppe parlato]

No sorry let me clarify, I was just wondering if there is any other way to catch traffic other then http/https for cut-through proxy autentication. I suppose the answer is no.

[Vibhor Amrodia]

Hi,

Actually you can.

You can refer this for more information:-

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113363-asa-cut-through-config-00.html

http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/70992-tacacs-radius-config.html

Thanks and Regards,

Vibhor Amrodia