Cut Through Proxy Operation

1 The user makes a request to access the web server.

1 The user makes a request to access the web server.

(7) The user is prompted by the PIX Firewall.

® PIX Firewall queries CSACS for the remote username and password.

© If CSACS authenticates, the user is "cut-through" the PIX Firewall, and the local username and password are passed to the web server to authenticate.

(7) The user is prompted by the PIX Firewall.

Cisco Secure ACS

® PIX Firewall queries CSACS for the remote username and password.

© If CSACS authenticates, the user is "cut-through" the PIX Firewall, and the local username and password are passed to the web server to authenticate.

Cisco Secure ACS

The PIX Firewall gains dramatic performance advantages because of cut-through proxy, a patent-pending method of transparently verifying the identity of users at the firewall and permitting or denying access to any TCP- or UDP-based application. This method eliminates the price and performance impact that UNIX system-based firewalls impose in similar configurations, and leverages the authentication and authorization services of the Cisco Secure Asynchronous Communications Server (ACS).

The PIX Firewall's cut-through proxy challenges a user initially at the application layer, then authenticates against standard TACACS or RADIUS+ databases. After the policy is checked, the PIX Firewall shifts the session flow, and all traffic flows directly and quickly between the server and the client while maintaining session state information.

Supported AAA Servers j

TACACS+

RADIUS

2000, Cisco Systems, Inc. WWW.CiSC

m cd jo.com CSPFA1.01—4-7

The PIX Firewall supports the following AAA protocols and servers:

■ Terminal Access Controller Access Control System Plus (TACACS+)

< Cisco Secure Asynchronous Communications Server (CSACS) for Windows NT (CSACS-NT)

< Cisco Secure ACS for UNIX (CSACS-UNIX)

< TACACS+ Freeware

■ Remote Authentication Dial-In User Service (RADIUS)

< Cisco Secure ACS for Windows NT (CSACS-NT)

< Cisco Secure ACS for UNIX (CSACS-UNIX)

< Livingston

< Merit

0 0

Post a comment