AAA on the PIX Firewall

Creating a Server Group (Optional)

The following command creates a server group, assigns a name (server_tag) to the group, and—most important—specifies which protocol is used by the group. Use the clear aaa-server command to remove a named server group. The syntax is

Pix(config)# aaa-server server_tag protocol [tacacs+ | radius]
Pix(config)# clear aaa-server server_tag

This command is optional because three default server groups are defined on the PIX Firewall in v6.2 that can be used. The show aaa-server command shows the default groups.

Pix(config)# show aaa-server
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
Pix(config)#

Notice the group name (tag) is nothing more than the protocol name. This provides backward compatibility to older OS versions. Another group should only be created if several AAA servers exist and it would help to keep their functions straight. The LOCAL group was added in version 6.2, and can be used for authentication and command authorization. This new feature is covered in the next section.

The following output shows creating separate TACACS+ server groups for inbound and outbound traffic, plus a RADIUS group for accounting functions. The server tags are up to the administrator, but should be descriptive. The server tags are case sensitive.

Pix(config)# aaa-server TacIn protocol tacacs+
Pix(config)# aaa-server TacOut protocol tacacs+
Pix(config)# aaa-server RadAcctg protocol radius

The remaining AAA commands use the group tag to identify which group of servers will perform the AAA function.

Defining the Server Group

The next command defines the connecting PIX interface, server IP address, an optional encryption key shared with the AAA server, and an optional retransmit timer. The default interface is (inside). If more than one server is defined in the group, they’ll be used in order of entry. This command doesn’t verify the existence of the server(s). Use the no form of the command to remove the server from the group. The syntax is

Pix(config)# aaa-server server_tag [(if_name)] host server_ip [key] [timeout seconds]
Pix(config)# no aaa-server server_tag [(if_name)] host server_ip [key] [timeout seconds]

This example tries to demonstrate this case importance. The first command, show aaa-server, displays the default groups. Lines 5 and 6 show an attempt to assign a server to each of the default server groups (TACACS+ and RADIUS). The next show aaa-server command reveals that two new groups were created and they both use the tacacs+ protocol.

Pix(config)# show aaa-server
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
Pix(config)# aaa-server tacacs+ (inside) host 192.168.1.3 3key timeout 20
Pix(config)# aaa-server radius host 192.168.1.4 4key
Pix(config)# show aaa-server
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa-server tacacs+ protocol tacacs+
aaa-server tacacs+ (inside) host 192.168.1.3 3key timeout 20
aaa-server radius protocol tacacs+
aaa-server radius (inside) host 192.168.1.4 4key timeout 10
Pix(config)#

The following example creates the RadIn and TacOut server groups and defines two inside servers to each. From the previous example, you know Line 1 is necessary, but Line 4 could be omitted.

Pix(config)# aaa-server RadIn protocol radius
Pix(config)# aaa-server RadIn (inside) host 192.168.1.5 5key timeout 10
Pix(config)# aaa-server RadIn (inside) host 192.168.1.6 6key
Pix(config)# aaa-server TacOut protocol tacacs+
Pix(config)# aaa-server TacOut host 192.168.1.7 7key timeout 20
Pix(config)# aaa-server TacOut host 192.168.1.8 8key

The login Command

The login command can be used to log a user into the PIX Firewall, another privilege level, or another Command mode using the local user authentication database. This command is available in Unprivileged mode. The user can use the logout, exit, or quit commands to go back to Unprivileged mode. The following example shows the prompt after a login command.

Pix> login
Username:
Username: mike
Password: ****
Pix#

Local User Database and AAA

Cisco Secure ACS AAA services support using the local user database (LOCAL) as an alternative to TACACS+ or RADIUS servers for user authentication and command authorization tasks. The following output shows using the local user database with AAA commands. The details of these commands are reviewed in the next pages.

Pix(config)# aaa authentication telnet console LOCAL
Pix(config)# aaa authentication enable console LOCAL
Pix(config)# aaa authorization command LOCAL

Pix(config)# sho aaa
aaa authentication telnet console LOCAL
aaa authentication enable console LOCAL
aaa authorization command LOCAL
Pix(config)#

Server Group Case-Sensitivity Issues

Be aware that AAA does some strange things with case sensitivity. The local user database must be referred to as LOCAL or you get the error “bad auth-server groupname local.” The show aaa command returns an Ambiguous command if the aaa is in uppercase.

The first seven lines of the following output you saw earlier created a new server group called tacacs+ because of the case difference between Line 1 and the default group name.

Pix(config)# aaa-server tacacs+ (inside) host 192.168.1.4 4key timeout 20
Pix(config)# sho aaa-server
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa-server tacacs+ protocol tacacs+
aaa-server tacacs+ (inside) host 192.168.1.4 4key timeout 20
Pix(config)#
Pix(config)# aaa authentication telnet console TACACS+
No authentication servers found!
Pix(config)# aaa authentication telnet console Tacacs+
bad auth-server groupname Tacacs+
Pix(config)# aaa authentication telnet console tacacs+
Pix(config)#

Line 9 shows that if you revert back to TACACS+ in the aaa authentication command, you’re notified that no servers are in that group name. They were assigned to tacacs+.

Line 11 shows a straight case mismatch issue and the resulting “bad auth-server groupname Tacacs+” message.

The last two lines confirm that once the case is correct, the command will be accepted.

Authenticating Console Sessions

AAA can be used to authenticate the four types of console connections, plus allowing for unique enable passwords. The configuration mode aaa authentication console command requires authentication verification to access the PIX Firewall unit’s console features. Use the no form of the command to remove the authentication. The syntax is

Pix(config)# aaa authentication [serial | enable | telnet | ssh | http] console group_tag
Pix(config)# no aaa authentication [serial | enable | telnet | ssh | http] console group_tag

The group_tag can include any server_tag or the local user database (LOCAL). Examples of each of these might look like this:

Pix(config)# aaa authentication serial console LOCAL
Pix(config)# aaa authentication enable console LOCAL
Pix(config)# aaa authentication telnet console TACACS+
Pix(config)# aaa authentication ssh console TACACS+
Pix(config)# aaa authentication http console MyRadius

The Serial Connection and Enable Privilege mode access will be authenticated by the local user database. Telnet and SSH connections are authenticated by the default TACACS+ group, while HTTP connections are authenticated by a named group of RADIUS servers.

Pix# exit
Logoff

Username: bill
Password: ******* ?????????????????(pearson from earlier example)
Type help or '?' for a list of available commands.
Pix> en
Password: **** ????????????????????(chow entered)
Password: ******* ?????????????????(pearson entered)
Pix#

Authenticating User Sessions

The PIX Firewall interacts with FTP, HTTP (Web access), and Telnet protocols to display the correct prompts for logging in to the network or logging in to exit the network. For each IP address, one aaa authentication command is permitted for inbound connections and one for outbound connections. The no form of the command removes the entry from the configuration. The syntax is

Pix(config)# aaa authentication {include | exclude} authen_service if_name local_ip local_mask [foreign_ip foreign_mask] server_tag Pix(config)# no aaa authentication {include | exclude} authen_service if_name local_ip local_mask [foreign_ip foreign_mask] server_tag

Outbound connections will need a NAT translation pass through the PIX Firewall. Inbound connections still need static and access-list command statements to allow access to inside IP addresses through the PIX Firewall from the outside network.

If both the optional foreign_ip and foreign_mask are omitted, then the default 0 0 is assumed allowing all other hosts. There are no other defaults.

Pix(config)# aaa-server tacacs+ (inside) host 192.168.1.3 3key timeout 20
Pix(config)# aaa authentication include any inside 192.168.1.0 255.255.255.0
 1.10.1.0 255.255.255.0 tacacs+
Pix(config)# aaa authentication include any outside 0 0 tacacs+
Pix(config)# aaa authentication exclude ftp outside 0 0 tacacs+
Pix(config)# show aaa
aaa authentication exclude ftp outside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 tacacs+
aaa authentication include tcp/0 inside 192.168.1.0 255.255.255.0 1.10.1.0
 255.255.255.0 tacacs+
aaa authentication include tcp/0 outside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 tacacs+
Pix(config)#

Authorizing Access

Except for its use with command authorization, the aaa authorization command can’t function alone: it requires a previous aaa authentication command. Current PIX OS versions support only TACACS+ servers for this command. RADIUS servers and LOCAL aren’t supported. For each IP address, only one aaa authorization command is permitted. To authorize more than one service, use the any parameter for the service type. The no form of the command removes the entry from the configuration. The syntax is

Pix(config)# aaa authorization {include | exclude} author_service if_name local_ip local_mask [foreign_ip foreign_mask] server_tag Pix(config)# no aaa authorization {include | exclude} author_service if_name local_ip local_mask [foreign_ip foreign_mask] server_tag

To use Protocol/Port option, use a format like udp/53. The details are as follows:

Outbound connections need a NAT translation to pass through the PIX Firewall. Inbound connections still need static and access-list command statements to allow access to inside IP addresses through the PIX Firewall from the outside network.

If both the optional foreign_ip and foreign_mask are omitted, then the default 0 0 is assumed and allows all other hosts. No other defaults exist.

The following example shows a variety of protocol/port specifications and the resulting configuration statements. Notice icmp is replaced by the number 1, while tcp/23 is replaced by telnet. The exclude statements move to the top of the configuration.

Pix(config)# aaa authorization include udp/53 inside 0 0 0 0 tacacs+
Pix(config)# aaa authorization include tcp/0 inside 0 0 0 0 tacacs+
Pix(config)# aaa authorization include icmp/0 inside 0 0 0 0 tacacs+
Pix(config)# aaa authorization exclude tcp/23 inside 0 0 0 0 tacacs+
Pix(config)# aaa authorization exclude udp/23 inside 0 0 0 0 tacacs+
Pix(config)# show aaa
aaa authorization exclude udp/23 inside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 tacacs+
aaa authorization exclude telnet inside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 tacacs+
aaa authorization include udp/53 inside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 tacacs+
aaa authorization include tcp/0 inside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 tacacs+
aaa authorization include 1/0 inside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 tacacs+
Pix(config)#

Accounting for Resource Usage

User accounting services keep a record of which network services a user has accessed, and these records are stored on the designated AAA server. Accounting information is only sent to the active server in a server group. The aaa accounting command always follows the aaa authentication command. The no form of the command removes the entry from the configuration. The syntax is

Pix(config)#aaa accounting {include | exclude} acct_service if_name local_ip local_mask [foreign_ip foreign_mask] server_tag Pix(config)#no aaa accounting {include | exclude} acct_service if_name local_ip local_mask [foreign_ip foreign_mask] server_tag

Outbound connections need a NAT translation pass through the PIX Firewall. Inbound connections still need static and access-list command statements to allow access to inside IP addresses through the PIX Firewall from the outside network.

If both the optional foreign_ip and foreign_mask are omitted, then the default 0 0 is assumed and allows all other hosts. No other defaults exist.

The following example demonstrates the aaa accounting commands.

Pix(config)# aaa accounting include any outside 0 0 0 0 tacacs+
Pix(config)# aaa accounting include udp/0 outside 0 0 0 0 tacacs+
Pix(config)# show aaa
aaa accounting include tcp/0 outside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 tacacs+
aaa accounting include udp/0 outside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 tacacs+
Pix(config)#

Remote Command Authorization

As seen earlier in this chapter, PIX Firewall users can authenticate using an AAA TACACS+ or RADIUS server, or by using the LOCAL user database. Command authorization can be implemented using the LOCAL database or a TACACS+ server. Implementing command authorization assumes the following software and hardware versions:

• PIX Software version 6.2

• CiscoSecure Access Control Server (ACS) for Windows version 3.0 (CSNT)

• CiscoSecure ACS for UNIX (CSUnix) version 2.3.6

  Note?

  Command-level authorization sets work correctly with Cisco Secure ACS for Windows Version 3.0.2 or higher. Other 3.0 users should look for the patch available on the PIX Software download page.

Use the Configuration mode aaa authorization command command to enable command authorization. Only one command authorization method can be defined at a time. Use the no form of the command to remove the entry. The syntax is as follows:

Pix(config)# aaa authorization command {LOCAL | tacacs_server_tag}
Pix(config)# no aaa authorization command {LOCAL | tacacs_server_tag}

The following example shows defining the LOCAL database to perform command authorization:

Pix(config)# aaa authorization command LOCAL
Pix(config)# show aaa
aaa authorization command LOCAL
Pix(config)#

The next section looks at the privilege-level features incorporated into the PIX Firewall to facilitate command-level authorization.