Identity on Cisco Firewalls : ASA User-Level Control with Cut-Through Proxy (part 2) - Simple Cut-Through Proxy

Scenario 1: Simple Cut-Through Proxy (No Authorization)

Example 2 depicts the operation of Cut-Through Proxy for HTTP, according to the configuration in Example 1. Authorization is analyzed starting on Scenario 2.

Note

For the examples covered in this article “user1” and “user2”, respectively belonging to groups “GROUP1” and “GROUP2” on CS-ACS, are always the reference usernames.

Example 2. HTTP Connection Is Intercepted by Cut-Through Proxy

! HTTP to 172.16.200.200 is intercepted by Cut-Through Proxy (first prompt appears) %ASA-6-302013: Built outbound TCP connection 26 for outside:172.16.200.200/80 (172.16.200.200/80) to dmz:172.21.21.101/1148 (172.21.21.101/1148) %ASA-6-109001: Auth start for user '???' from 172.21.21.101/1148 to 172.16.200.200/80 ! ! User enters credentials and ASA sends them to the RADIUS server (UDP/1812) %ASA-6-302015: Built outbound UDP connection 27 for dmz:172.21.21.250/1812 (172.21.21.250/1812) to identity:172.16.201.2/1025 (172.16.201.2/1025) %ASA-6-113004: AAA user authentication Successful : server = 172.21.21.250 : user =user1 %ASA-7-734003: DAP: User user1, Addr 172.21.21.101: Session Attribute aaa.radius["25"]["1"] = CACS:0/13e/ac10c902/4 %ASA-7-734003: DAP: User user1, Addr 172.21.21.101: Session Attribute aaa.cisco.grouppolicy = DfltGrpPolicy %ASA-7-734003: DAP: User user1, Addr 172.21.21.101: Session Attribute aaa.cisco.username = user1 %ASA-6-734001: DAP: User user1, Addr 172.21.21.101, Connection Cut-Through-Proxy: The following DAP records were selected for this connection: DfltAccessPolicy %ASA-2-109011: Authen Session Start: user 'user1', sid 4 %ASA-6-109005: Authentication succeeded for user 'user1' from 172.21.21.101/1148 to 172.16.200.200/80 on interface dmz ! ASA starts RADIUS Accounting connection (UDP/1813) %ASA-6-302015: Built outbound UDP connection 28 for dmz:172.21.21.250/1813 (172.21.21.250/1813) to identity:172.16.201.2/1026 (172.16.201.2/1026) %ASA-6-113004: AAA user accounting Successful : server = 172.21.21.250 : user = user1 ! !Displaying the authenticated users ASA1# show uauth Current Most Seen Authenticated Users 1 1 Authen In Progress 0 1 user 'user1' at 172.21.21.101, authenticated absolute timeout: 0:05:00 inactivity timeout: 0:00:00

Figure 3 presents a sample RADIUS accounting record in CS-ACS. In this particular example, you can see in the “cisco-av-pair” column that both HTTP and HTTPS activities are registered.

Figure 3. Example of RADIUS Accounting Session on CS-ACS (Reports and Activity)