AAA Issues
AAA implementation on the FWSM is the same as on PIX Firewall. For Version 1.x, AAA implementation is based on PIX OS 6.0 and 6.2. However, for Version 2.x, AAA implementation is based on PIX 6.3.x. The implementation difference between the FWSM and PIX Firewall varies for where the authentication information caches. If there are new connection requests, and the cut-through proxy is turned on, the initial connection will be processed by the Control Plane. Once the user authentication is successful, it will be cached in the NP processors. So, subsequent requests will not go to the PC complex. For troubleshooting AAA on the FWSM, you can refer to Chapter 10, "Troubleshooting AAA on PIX Firewalls and FWSM."