Adding another username and password to Cisco VPN

Hi,

Go to the global configuration mode (conf t [enter])

username jack1 password sarah--created one user
username jack2 passwrod jacky--creates another one.

To delete:
no username jack1
no username jack2

To edit:
username jack1 password jack1
username jack2 password jacqueline.

A/

see this:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_example09186a00800946b9.shtml

HI,

Dont forget to us this user privilege 2 security level, becouse, they no able to do anything:


for example:

username bambauser password bambauser privilege 2
username bambauser2 password bambauser2 privilege 2

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00800949d6.shtml

username bambauser password bambauser privilege 2

So does this only affect the VPN user names and passwords?

Is this the same for the ASA?

I have a PIX at home and ASA at work and I am trying to change the user names and passwords for remote access VPNs on both.

We don't use RADIUS server.

If I already have another user name on the PIX does this mean it will authenticate VPN users or is that a different database? This is what I have now.

username example1 password example1 encrypted privilege 15
username example2 password example 2 encrypted privilege 15

I also see this in the VPN section of the config

vpngroup vpnremote address-pool vpnpool
vpngroup vpnremote split-tunnel SPLIT_TUNNEL
vpngroup vpnremote idle-time 1800
vpngroup vpnremote password ********

Please put it to PIX, and you able to authenticate (after group authentication)

aaa-server AuthInbound protocol local
crypto map mymap client authentication AuthInbound

ok so I understand these are my steps on the PIX?

username bambauser password bambauser privilege 2
aaa-server AuthInbound protocol local
crypto map mymap client authentication AuthInbound

What does this add?

aaa-server AuthInbound protocol local
crypto map mymap client authentication AuthInbound

this is a secondary authentications, that uses local database!

Ok so once I do this then I will be add new users with your first command then it will authenicate with the local user database?

Yup, try it....:)

It took the user name and password but gave this error on the other part


pix501(config)# aaa-server AuthInbound protocol local
Protocol "local" is not available for user configuration.
Group LOCAL is predefined with this protocol. Please use
group LOCAL for the purpose.
Usage:  [no] aaa-server <tag> [<(if_name)>] host <ip_address> [<key>] [timeout <seconds>]
       [no] aaa-server <tag> protocol tacacs+|radius
       [no] aaa-server <tag> max-failed-attempts <tries>
       [no] aaa-server <tag> deadtime <deadtimeout>
       clear aaa-server [<tag>]
       [no] aaa-server radius-authport [<auth_port>]
       [no] aaa-server radius-acctport [<acct_port>]

Also what is the difference in this after a user name and password? I have both now.

encrypted privilege 15
encrypted privilege 2

any ideas on getting past the last cmd it did not take? Also what is the difference between these two privileges?

Here is the config, right now VPN users login with vpnremote user but I have other accounts added as well. Should all user accounts have the same encrypted privilege level. Again the goal is to have VPN users using different accounts. I am confused on which accounts are for VPN and which are for logging into device.

PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password **** encrypted
passwd **** encrypted
hostname pix501
domain-name ciscopix
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list outside_access_in permit esp any any
access-list inside_outbound_nat0_acl permit ip any 192.168.150.0 255.255.255.252
access-list outside_cryptomap_dyn_20 permit ip any 192.168.150.0 255.255.255.252
access-list SPLIT_TUNNEL permit ip 192.168.2.0 255.255.255.0 192.168.150.0 255.255.255.252
pager lines 24
logging on
logging timestamp
logging trap debugging
logging history debugging
logging facility 23
logging host inside 192.168.2.22
icmp deny any outside
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 192.168.2.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool vpnpool 192.168.150.1-192.168.150.3
pdm location 192.168.2.2 255.255.255.255 inside
pdm location 192.168.2.9 255.255.255.255 inside
pdm location 192.168.2.22 255.255.255.255 inside
pdm location 0.0.0.0 255.255.255.255 outside
pdm logging debugging 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa-server AuthInbound protocol tacacs+
aaa-server AuthInbound max-failed-attempts 3
aaa-server AuthInbound deadtime 10
aaa authentication enable console LOCAL
aaa authentication ssh console LOCAL
http server enable
http 0.0.0.0 0.0.0.0 inside
snmp-server host inside 192.168.2.9
snmp-server location ****
snmp-server contact ****
snmp-server community ****
snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup vpnremote address-pool vpnpool
vpngroup vpnremote split-tunnel SPLIT_TUNNEL
vpngroup vpnremote idle-time 1800
vpngroup vpnremote password ********
telnet 192.168.2.9 255.255.255.255 inside
telnet 192.168.2.2 255.255.255.255 inside
telnet 192.168.2.22 255.255.255.255 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
dhcpd address 192.168.2.2-192.168.2.33 inside
dhcpd dns 208.67.222.222 208.67.220.220
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
username user1 password **** encrypted privilege 2
username user2 password **** encrypted privilege 15
username user3 password **** encrypted privilege 15
terminal width 80

ikalmar  any more ideas on this one?

HI,

Please make same level 2 account for all vpn users!!!!

username user1 password **** encrypted privilege 2
username user2 password **** encrypted privilege 2
username user3 password **** encrypted privilege 2

and level 15 for you:

username example2 password example 2 encrypted privilege 15

I tried this and it does not let me add any user to this level. It says incorrect password length no mater what I do.If I understand correctly a level 2 user can connect to vpn and level 15 to the device to administer. In the config I already had a level 2 user that cannot authenticate to the vpn??

this is at the end of config already

username user1 password **** encrypted privilege 2

user1 cannot connect to vpn.

I figured this out, you have to do this.
(config)# group-policy VPNREMOTEGrpPOLICY internal
(config)# group-policy VPNREMOTEGrpPOLICY attributes
(config-group-policy)# username user1 password user1 priv 0

Thanks

I think ATT gave me this since I said PIX/ASA. I guess only on ASA it works.