Cisco Cisco ASA 5555-X Adaptive Security Appliance 产品宣传页

Authorize-Only 

요청에는 Authorize-Only(17) 값을 포함하는 Service-Type 특성 및 

Access-Request 

내 메시지 인증자가 포함됩니다.

authorize-only 

전용 모드의 지원은 Access-Request에서 RADIUS 공통 비밀번호를 포함해야 할 

필요가 없습니다. 따라서 aaa-server-host 모드에서 radius-common-pw CLI를 사용하여 공통 비

밀번호를 구성하지 않아도 됩니다.

authorize-only 

모드는 서버 그룹에 대해 구성되지만 공통 비밀번호는 호스트에 특정합니

다. 따라서 authorize-only 모드를 구성하면 개별 AAA 서버에 대해 구성된 공통 비밀번호

가 무시됩니다.

특정 터널 그룹과의 연결에 대해 호스트 스캔 처리를 끕니다. 

{anyconnect}

예:

ciscoasa(config-tunnel-webvpn)# without-csd anyconnect

현재 이 설정은 클라이언트리스 및 계층 3 연결에 적용됩니다. 이 명령은 해당 설정이 AnyConnect 

연결에만 적용될 수 있도록 수정되었습니다.

다음 예에서 단일 서버로 RADIUS 그룹 1개를 추가하는 방법을 보여 줍니다.

ciscoasa(config)# aaa-server AuthOutbound protocol radius

ciscoasa(config-aaa-server-group)# exit

ciscoasa(config)# aaa-server AuthOutbound (inside) host 10.1.1.3

ciscoasa(config-aaa-server-host)# key RadUauthKey

ciscoasa(config-aaa-server-host)# exit

다음 예는 권한 부여 전용, 동적 권한 부여(CoA) 업데이트 및 시간별 주기적 어카운트 관리를 위

해 ISE 서버 객체를 구성하는 방법을 보여 줍니다.

ciscoasa(config)# aaa-server ise protocol radius

ciscoasa(config-aaa-server-group)# authorize-only

ciscoasa(config-aaa-server-group)# interim-accounting-update periodic 1

ciscoasa(config-aaa-server-group)# dynamic-authorization

ciscoasa(config-aaa-server-group)# exit

ciscoasa(config-aaa-server-group)# authorize-only

ciscoasa(config)# aaa-server ise (inside) host 10.1.1.3

ciscoasa(config-aaa-server-host)# key sharedsecret

ciscoasa(config-aaa-server-host)# exit

다음 예는 ISE를 사용하여 비밀번호 인증을 위한 터널 그룹을 구성하는 방법을 보여 줍니다.

ciscoasa(config)# tunnel-group aaa-coa general-attributes

ciscoasa(config-tunnel-general)# address-pool vpn

ciscoasa(config-tunnel-general)# authentication-server-group ise

ciscoasa(config-tunnel-general)# accounting-server-group ise

ciscoasa(config-tunnel-general)# exit

다음 예는 ISE를 사용하여 로컬 인증서 검증 및 권한 부여를 위한 터널 그룹을 구성하는 방법을 

보여 줍니다.

ciscoasa(config)# tunnel-group aaa-coa general-attributes

ciscoasa(config-tunnel-general)# address-pool vpn

ciscoasa(config-tunnel-general)# authentication certificate

ciscoasa(config-tunnel-general)# authorization-server-group ise