Cisco FirePOWER ASA 5500 series Configuration Manual page 599

Chapter 30 Configuring Tunnel Groups, Group Policies, and Users
To disable user authentication, enter the disable keyword. To remove the user authentication attribute
from the running configuration, enter the no form of this command. This option allows inheritance of a
value for user authentication from another group policy.
If you require user authentication on the primary security appliance, be sure to configure it on any
backup servers as well.
The following example shows how to enable user authentication for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)# user-authentication enable
Configuring an Idle Timeout
Set an idle timeout for individual users behind hardware clients by entering the
user-authentication-idle-timeout command in group-policy configuration mode. If there is no
communication activity by a user behind a hardware client in the idle timeout period, the security
appliance terminates the client's access:
hostname(config-group-policy)# user-authentication-idle-timeout {minutes | none}
hostname(config-group-policy)# no user-authentication-idle-timeout
Note The user-authentication-idle-timeout command terminates only the client's access through the VPN
tunnel, not the VPN tunnel itself.
The minutes parameter specifies the number of minutes in the idle timeout period. The minimum is 1
minute, the default is 30 minutes, and the maximum is 35791394 minutes.
To delete the idle timeout value, enter the no form of this command. This option allows inheritance of
an idle timeout value from another group policy.
To prevent inheriting an idle timeout value, enter the user-authentication-idle-timeout command with
the none keyword. This command sets the idle timeout with a null value, which disallows an idle timeout
and prevents inheriting an user authentication idle timeout value from a default or specified group policy.
The following example shows how to set an idle timeout value of 45 minutes for the group policy named
FirstGroup:
hostname(config)# group-policy FirstGroup attributes
hostname(config-group-policy)# user-authentication-idle-timeout 45
Configuring IP Phone Bypass
You can allow Cisco IP phones to bypass individual user authentication behind a hardware client. To
enable IP Phone Bypass, enter the ip-phone-bypass command with the enable keyword in group-policy
configuration mode. IP Phone Bypass lets IP phones behind hardware clients connect without
undergoing user authentication processes. IP Phone Bypass is disabled by default. If enabled, secure unit
authentication remains in effect.
To disable IP Phone Bypass, enter the disable keyword. To remove the IP phone Bypass attribute from
the running configuration, enter the no form of this command. This option allows inheritance of a value
for IP Phone Bypass from another group policy:
hostname(config-group-policy)# ip-phone-bypass {enable | disable}
hostname(config-group-policy)# no ip-phone-bypass
OL-10088-01
Cisco Security Appliance Command Line Configuration Guide
Group Policies
30-45