Clearing the
auth-proxy Cache
To clear authentication cache entries manually from the
firewall before they time out, use the clear ip auth-proxy
cache command in privileged EXEC mode. Use the Asterisk option to delete all
authentication cache entries. Enter a specific IP address to delete an entry for
a single host. The syntax is
Rtr1#clear ip auth-proxy cache {* | host-ip-address}
Displaying Dynamic ACL Entries
When the authentication proxy is in use, dynamic access list
entries are added and removed as temporary authentication sessions are added and
deleted. When no open sessions exist, there won’t be any dynamic entries. To
display any dynamic access list entries, use the show ip
access-lists command in privileged EXEC mode. The number of matches
displayed in parentheses indicates the number of times the access list entry was
used.
Both the idle timeout parameter and the clear ip
auth-proxy cache command from the last section can cause no dynamic entries to occur in
the display. The syntax to display any access lists configured on the firewall,
including dynamic ACL entries, is
Rtr1# show ip access-lists
This following shows the ACL entries prior to any authentication
proxy sessions.
Rtr1#show ip access-lists
Extended IP access list 160
deny tcp any any eq telnet
deny udp any any
permit tcp any any (41 matches)
permit ip any any
This next output shows the same ACL following user authentication.
The first six lines represent the downloaded user profile enabling the specified
features for the authenticated user. The last four lines are the same lines as
in the previous example after more traffic.
Rtr1#show ip access-lists
Extended IP access list 160
permit tcp host 192.168.1.10 any eq 69
permit icmp host 192.168.1.10 host 192.168.4.2
permit tcp host 192.168.1.10 any eq telnet
permit tcp host 192.168.1.10 any eq ftp
permit tcp host 192.168.1.10 any eq ftp-data
permit tcp host 192.168.1.10 any eq smtp
deny tcp any any eq telnet
deny udp any any
permit tcp any any (76 matches)
permit ip any any
For more information, go to the Cisco web site www.cisoarrticles.com and search for
authentication proxy. No CCO account is required.
Sections
Comments (0 posted)
Syndication
