Chapter 5. Managing Firewall Users

Refer to the following sections for information about these topics:

• 5-1: Managing Generic Users— Covers how default “generic” or ambiguous users can be allowed to connect to a firewall and execute commands or make configuration changes.

• 5-2: Managing Users with a Local Database— Presents methods to configure unique usernames locally on the firewall. You can then manage these users' privileges and monitor their activity.

• 5-3: Defining AAA Servers for User Management— Discusses external servers that can be used to authenticate, authorize, and keep accounting records about user activity on and through a firewall.

• 5-4: Configuring AAA to Manage Administrative Users— Explains the configuration steps needed to offload user management functions when administrative users connect to a firewall.

• 5-5: Configuring AAA for End-User Cut-Through Proxy— Covers the methods that can be used to authenticate users initiating connections through a firewall and to authorize their ability to do so.

• 5-6: Firewall Password Recovery— Discusses procedures that can be used to recover or bypass a firewall's privileged user password when it is lost or forgotten.

Although its primary function is to provide and enforce security policies at the boundaries of networks, a Cisco firewall also supports several methods to manage users who interact with it. Firewall users fall into the following general categories: