This example enables the SASL digest-md5 authentication mechanism:Ĭiscoasa(config)# aaa-server ldapsvr1 protocol ldapĬiscoasa(config-aaa-server-group)# aaa-server ldapsvr1 host 10.10.0.1Ĭiscoasa(config-aaa-server-host)# sasl-mechanism digest-md5 LDAP server named ldapsvr1 with an IP address of 10.10.0.1. The following examples, entered in aaa-server host configuration mode, enable the SASL mechanisms for authentication to an No sasl-mechanism kerberos server-group-name Examples
For example, you must enter both of the following commands to disable both SASL mechanisms: Mechanisms that you do not specificallyĭisable remain in effect. When disabling the SASL mechanisms, you must enter a separate no command for each mechanism you want to disable because they are configured independently. Illustrate, if both the LDAP server and the ASA support both mechanisms, the ASA selects Kerberos, the stronger of the mechanisms. The Kerberos mechanism is stronger than the Digest-MD5 mechanism. Mechanism configured on both the ASA and the server. The ASA retrieves the list of SASL mechanisms configured on the server and sets the authentication mechanism to the strongest Use this command to specify ASA authentication to an LDAP server using SASL mechanisms.īoth the ASA and the LDAP server can support multiple SASL authentication mechanisms. The following table shows the modes in which you can enter the command: We recommend that you secure LDAP communications with SSL using the ldap-over-ssl command if you have not configured SASL. The ASA passes the authentication parameters to the LDAP server in plain text. Specifies the Kerberos aaa-server group, up to 64 characters. The ASA responds by sending the username and realm using the GSSAPI (Generic Security Services Application Programming Interface) The ASA responds with an MD5 value computed from the username and password. Same-security-traffic permit īecause the ASA serves as a client proxy to the LDAP server for VPN users, the LDAP client referred to here is the ASA. To disable the same-security traffic, use the no form of this command. Use the same-security-trafficcommand in global configuration mode. To permit communication between interfaces with equal security levels, or to allow traffic to enter and exit the same interface, server-separator (pop3s, imap4s, smtps) (Deprecated).server (pop3s, imap4s, smtps) (Deprecated).secondary-username-from-certificate-choice.
0 kommentar(er)
