Authentication Proxy

Problem

You want the router to separately authenticate and authorize individual users as they access restricted resources.

Solution

To enable an IOS-based authentication proxy, use the following commands:

Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#aaa new-model Router1(config)#aaa authorization auth-proxy default local Router1(config)#ip auth-proxy auth-proxy-banner http Router1(config)#ip auth-proxy name HTTPPROXY http Router1(config)#ip admission auth-proxy-banner http Router1(config)#interface FastEthernet0/0 Router1(config-if)#ip auth-proxy HTTPPROXY Router1(config-if)#ip http server Router1(config)#ip http authentication local Router1(config)#end Router1#

Discussion

Cisco authentication proxy is an intercepting proxy that requires users to authenticate before being allowed to access resources behind the proxy. Because it operates as an intercepting proxy, it means that placement of the router is vital, since it can only authenticate sessions that transverse the router. Generally, this means that the proxy must be placed at a network choke point, such as the link to the Internet, for instance.

Since Cisco authentication proxy is designed to act as an intercepting proxy, there is no need for end users to configure their browsers to point to the proxy server. The router will automatically intercept all sessions and force the end users to authenticate before they can access resources behind the proxy. The first time a user attempts to access a web site the router will present them with an authentication screen. After the user submits his correct username and password then he is free to surf as normal.

General uses for authentication proxies are Internet cafes, public wireless access providers, and organizations that wish to control access to the Internet. In all instances, users will be forced to authenticate before they'll be allowed to surf beyond the proxy. This allows an organization to tightly control network access. In addition, authentication proxies can be used to secure Intranet servers that don't have the capability to enforce authentication themselves.

To view the current proxy cache, use the following show command:

Router1#show ip auth-proxy cache Authentication Proxy Cache Client Name ijbrown, Client IP 172.25.1.52, Port 4224, timeout 60, Time Remaining 53, state ESTAB Router1#

In this example, we can see that one user, ijbrown, has been authenticated successfully and is currently active. We can also see that the default inactivity timer is set to 60 minutes, and that our user currently has 53 minutes remaining until he'll be forced to authenticate again.

To manually force all users to authenticate again, use the following clear command:

Router1#clear ip auth-proxy cache * Router1#

You can view the authentication proxy's configuration by using the following show command:

Router1#show ip auth-proxy configuration Authentication global cache time is 60 minutes Authentication global absolute time is 0 minutes Authentication Proxy Watch-list is disabled Authentication Proxy Rule Configuration Auth-proxy name HTTPPROXY http list not specified inactivity-timer 60 minutes Router1#

For our example, we used local authentication, which is sufficient for a small company or installation; however, for larger organizations you can also configure the authentication server to use either RADIUS or TACACS to authenticate users.

To configure an authentication proxy server with TACACS support, use the following set of commands:

Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#aaa new-model Router1(config)#aaa authorization auth-proxy default group tacacs Router1(config)#tacacs-server host 172.25.5.5 Router1(config)#tacacs-server key cisco Router1(config)#ip http server Router1(config)#ip http authentication aaa Router1(config)#ip auth-proxy name TESTPROXY http Router1(config)#interface FastEthernet0/0 Router1(config-if)#ip auth-proxy TESTPROXY Router1(config-if)#end Router1#

In this example, authentication will be performed by the TACACS server. Please see Chapter 4 for more information on TACACS.

See Also

Chapter 4