Pix Access for Vendors

[needalife]

I'm not a cisco guru: I have a pix 515e with vpn access to only internal IT staff. We have software support vendors asking if they can have access inside our network. How or what should be done to allow inside access to vendors? I do not want to give them our authentication passwords. Is there some else we could do through the pix?

 

[jpm121]

Set up a different group password for them? Or allow remote desktop access to a single machine with an ACL that permits port 3389 TCP?

 

[wybnormal]

setup AAA and use the internal database to hold the usernames and passwords. Give them level 15 (or whatever). This way your password is encrypted.

Go here for an excellent reference page for this and other items.

http://www.cisco.com/en/US/products...figuration_guide_chapter09186a0080172797.html

MikeS

http://www.packetattack.com

http://www.packetpress.net

Home of the book "Network Security Using Linux"

 

[NetworkGhost]

what kind of access are they requesting? You could always set up a terminal server on a windows box and lock it down with ACLs. Then create local windows account on the box for them. Throw in on one of the DMZs of the pix. Could be as simple as a Windows XP box or a Windows 2000 Server Box.

 

[needalife]

The vendors are requesting access to various servers we have. At this point, we have 3 vendors looking for support access to their software servers.

Reading these suggestions, I need to find the Pix for dummies book regarding AAA and Group passwords. If I setup AAA's, do the vendor need any special clients software loaded onto their PC's?

wybnormal: I'll flip through the cisco site again. I just didn't know what to look for.

 

[wybnormal]

No, AAA in this case is local to the PIX. It only allows access THROUGH the pix to the network resources. You can use the normal NT authentication the servers to handle the local access. But you can get very creative with ACLs to lock the vendor to specific IP addresses on the network.

the link I gave you has all the details for AAA

MikeS

http://www.packetattack.com

http://www.packetpress.net

Home of the book "Network Security Using Linux"

 

[needalife]

Thx Mr. wybnormal ... I think I've got it. AAA is what I want to do by locking the vendor to only access a server with ACL's. At least now I know where to start my homework.