Assigning static IPs to incoming VPN sessions, using a PIX in conjunction with IAS/RADIUS

Posted on 2005-05-05
Last Modified: 2013-11-16
I have a Cisco PIX 515e (software v. 6.3), with two Windows 2000 domain controllers behind it, providing authentication for incoming VPN connections, via IAS/RADIUS.  This works well for general users.

However, I have a group of users who need to be assigned static IPs when they VPN into the network.  By using static IPs, we can easily send audio/video streams to a large number of these users.  Dynamic IPs cause a lot of problems.

I have this configured in a Cisco 3015 VPN Concentrator, but I'm looking to take that device out of production.

I've tried assigning static IPs to users within Active Directory, but the PIX still assigns IPs based on its configured address pool.  Is there some sort of RADIUS attribute that I need to define, in order for the AD static IP to be passed back to the PIX?  Is this in any way possible?  Thanks.
Question by:sloth10k
    LVL 79

    Expert Comment

    >I have this configured in a Cisco 3015 VPN Concentrator, but I'm looking to take that device out of production
    My advice - don't. The 3015 gives you such a fine grain of control over your VPN clients that the PIX cannot possibly match. The VPN capabilities of the PIX are basic.

    You could create a kludge by using multiple pools of 1 IP address and multiple groups. Each individual has their own pool and their own group, i.e.

    ip local pool SAM
    ip local pool MIKE
    ip local pool BOB
    ip local pool ANN
    vpngroup SAM address-pool SAM
    vpngroup MIKE address-pool MIKE
    vpngroup BOB address-pool BOB

    Author Comment

    According to Cisco, this feature is supported in the newer 7.0(1) software.

    Version 7.0 command reference:

    Look for the vpn-addr command on page 1734.

    Of course, version 7.0 necessitates increasing the 515e's RAM from 64 MB to 128 MB.
    LVL 79

    Expert Comment

    Are you still working on this?
    Have you found a solution?
    Do you need more information?

    This question will be classified as abandoned soon if we don't get some feedback from you.

    Can you close out this question? See here for details:

    Thanks for your attention!

    Author Comment

    Version 7.0(1) software did the trick.  The PIX now responds correctly to the RADIUS reply, including information on the IP to be assigned.
    LVL 1

    Accepted Solution

    PAQed with points (500) refunded

    Community Support Moderator

    Featured Post

    How to improve team productivity

    Quip adds documents, spreadsheets, and tasklists to your Slack experience
    - Elevate ideas to Quip docs
    - Share Quip docs in Slack
    - Get notified of changes to your docs
    - Available on iOS/Android/Desktop/Web
    - Online/Offline

    Join & Write a Comment

    How to configure Site to Site VPN on a Cisco ASA.     (version: 1.1 - updated August 6, 2009) Index          [Preface]   1.    [Introduction]   2.    [The situation]   3.    [Getting started]   4.    [Interesting traffic]   5.    [NAT0]   6.…
    This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
    Hi everyone! This is Experts Exchange customer support.  This quick video will show you how to change your primary email address.  If you have any questions, then please Write a Comment below!
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    734 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    24 Experts available now in Live!

    Get 1:1 Help Now