Somphol Boonjing's Bookmarks

Security Assertion Markup Language (SAML) is an XML-based standard for exchanging authentication and authorization data between security domains,
that is, between an identity provider (a producer of assertions) and a
service provider (a consumer of assertions). SAML is a product of the OASIS
Security Services Technical Committee.

Attribute[8]

Framed-IP-Address

Never

Sometimes¹

Sometimes¹

You can view the AV pairs that are being sent by the switch
by entering the debug radius privileged EXEC command. For
more information about these commands, see the Cisco IOS
Debug Command Reference, Release 12.1 at this URL:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121sup/121debug/index.htm

See RFC 3580, "IEEE 802.1X Remote Authentication Dial In User
Service (RADIUS) Usage Guidelines," for more information about AV pairs.

Thu Feb  7 01:01:00 2008
        User-Name = "md5user01"
        NAS-Port = 4325376
        Acct-Status-Type = Start
        Acct-Session-Id = "8O2.1x80101b"
        NAS-Identifier = "sys-java97"
        NAS-Port-Type = Virtual
        NAS-IP-Address = 10.93.15.197
        Client-IP-Address = 10.93.15.197
        Acct-Unique-Session-Id = "b0a382acdc4387a5"
        Timestamp = 1202374860
 
Thu Feb  7 02:34:47 2008
        User-Name = "md5user01"
        NAS-Port = 4325376
        Acct-Status-Type = Stop
        Acct-Session-Id = "8O2.1x8011b"
        Acct-Input-Octets = 0
        Acct-Output-Octets = 72
        Acct-Session-Time = 1202349593
        Acct-Input-Packets = 0
        Acct-Output-Packets = 1
        Acct-Terminate-Cause = Lost-Carrier
        Acct-Input-Gigawords = 0
        Acct-Output-Gigawords = 0
        NAS-Identifier = "sys-java97"
        NAS-Port-Type = Virtual
        NAS-IP-Address = 10.93.15.197
        Client-IP-Address = 10.93.15.197
        Acct-Unique-Session-Id = "eb4e171ae562daf5"
        Timestamp = 1202380487

IEEE 802.1x Accounting

The IEEE 802.1x standard defines how users are authorized and
authenticated for network access but does not keep track of network usage. IEEE
802.1x accounting is disabled by default. You can enable IEEE 802.1x accounting
to monitor this activity on IEEE 802.1x-enabled ports:

•User
successfully authenticates.

•User
logs off.

•Link-down occurs.

•Re-authentication successfully occurs.

•Re-authentication fails.

IEEE 802.1x Accounting Attribute-Value Pairs

The information sent to the RADIUS server is represented in
the form of Attribute-Value (AV) pairs. These AV pairs provide data for
different applications. (For example, a billing application might require
information that is in the Acct-Input-Octets or the Acct-Output-Octets
attributes of a RADIUS packet.)

AV pairs are automatically sent by a switch that is
configured for IEEE 802.1x accounting. Three types of RADIUS accounting packets
are sent by a switch:

•START-sent when a new user session starts

•INTERIM-sent during an existing session for updates

•STOP-sent when a session terminates

Table 10-1 lists the AV pairs
and when they are sent are sent by the switch:

• The accounting server sends an accounting-response packet back to the
  switch confirming it has received the accounting request.
  
• If the switch does not receive a response from the server, it continues to
  send accounting requests until an accounting response is returned from the
  accounting server.

Proactive filter technology - Provides immediate protection by blocking unknown malicious code, day-zero attacks, and exploits already at the gateway and neutralizes suspicious script code. This is critical for organizations targeted by small-scale malicious attacks that would not garner the attention of traditional anti-virus vendors.

Reputation based filtering - Provides immediate protection by blocking connections  to and from sites with known bad or unknown/undefined repuation.

Signature-based blocking - Webwasher Anti-Malware provides fast signature- based blocking of known viruses and other potentially unwanted applications/programs, many of which turn out to be spyware or adware-related programs such as keystroke loggers.

With a constantly updated database of over 95 million URLs, over 3 billion pages,
and over 60 categories, eSafe Advanced URL Filtering
delivers the industry's broadest and deepest URL filtering database. You also get:










• Total protection
  from the world's largest URL database -- over 95 million indexed URLs and over 3
  billion pages


• Constantly updated
  databases and categories -- 100,000 new pages added daily

TrustedSource Critical Component

TrustedSource analyzes global real-time data to filter messages based on reputations assigned for multiple identities (IP, domain, URL and Message), adding a necessary layer of security that content-based inspection cannot provide, such as protection against image-based spam and an exploding zombie population. Because BIG-IP MSM runs on F5's unique TMOS architecture, it is easy to install as an add-on module to existing BIG-IP version 9.x systems. Best of all, customers can benefit from this BIG-IP capability to reduce the load on any type of second tier anti-spam inspection, providing more diversity for filtering and reducing the number of devices required.

Load-Distributing Applications





WCCP Version 2 has the capability to adjust the load being offered to individual Content Engines to provide more effective use of the resources available and at the same time help to ensure high quality of service to the clients. It uses three techniques to perform this task:






• Hot spot handling allows an individual hash bucket, or a pool of IP addresses to which routers are mapped, to be distributed across all the Content Engines.
  
  



• Load balancing allows the set of hash buckets assigned to a Content Engine to be adjusted so that the load can be shifted from an overwhelmed Content Engine to other Content Engines that have available capacity.
  
  



• Load shedding enables the router to selectively redirect the load to avoid exceeding the capacity of the Content Engines.