RADIUS authentication and access lists

[katk]

We have Pix 515E firewall configured to use RADIUS authentication.
We need to be able to exclude one website from being authenticated. This website access is only allowed from one trusted source address (see access list below).

We use access group to allow access from outside to inside interface.
Then we use the same access group to enable RADIUS authentication.
Here is our PIX configuration (I have replaced real IP numbers with fake ones).

***Cisco Pix configuration****
access-list acl_outside permit tcp any host 10.0.0.5 eq www
access-list acl_outside permit tcp any host 10.0.0.6 eq www
access-list acl_outside permit tcp any host 10.0.0.7 eq www
access-list acl_outside permit tcp any host 10.0.0.8 eq www
access-list acl_outside permit tcp host 192.168.0.10 gt 1023 host 10.0.0.9 eq www

access-group acl_outside in interface outside

aaa-server RADIUS protocol radius

aaa authentication match acl_oustside outside RADIUS
****End***********************

We need to be able to exclude this source address from being authenticated:
access-list acl_outside permit tcp host 10.10.10.10 gt 1023 host 10.0.0.9 http

We tried using two separate access groups: one for the outside interface and another one for Radius authentication, but we could not make it work.
I found some examples on how to accomplish this with exclude command, but we don't want to use include command for the Radius authentication. Can we use exclude command
without include command?

I appreciate any suggestions regarding this question.

 

[yizhar]

HI.

You need 2 different access-list.
One list (acl_outside) will remain for access control and will match the access-group command,
while the other (aaalist) will be used only to define which traffic should be authenticated and will match the aaa command.

This or similar should do the trick:

access-list aaalist deny tcp host 192.168.0.10 host 10.0.0.9 eq www
access-list aaalist permit tcp any host 10.0.0.9 eq www

aaa authentication match aaalist outside RADIUS


Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar