Internet_Access

[amancuso]

In my current configuration all web access is done via an ISA proxy server. Only server vlans are NAT'd by the pix. However individual workstations have the need to telnet, ftp or vpn out. To accomplish this the workstations are permitted to receive NAt from the PIX.

As you know this requires editing the PIX config everytime a special circumstance arises. IS there a better way to provide these services to the clients without having to edit the PIX over and over.

[nkhawaja]

Hi,

For Telnet/FTP, you can have user level authentication, so users will be prompted for username/password and based on this, they can be allowed or denied.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094ea9.shtml

Thanks

Nadeem

[amancuso]

Would i use a radius server for this. Or is this feature bulit in to the PIX?

Would this have an effect on users trying to access the web. Would they be prompted as well. The web clients are already configured to use PRXY. I would not wan to add another login for these users.

Thank you for your help.

Anthony

[nkhawaja]

it is all there in the link i gave you.

yes radius server is required.

no it wont effect any other service

[amancuso]

Thank You for advice.