Solved

PIX 6.3 VPN different AAA authentication

Posted on 2009-04-14
9
612 Views
Last Modified: 2012-05-06
I would like to know if I can use differnt Radius servers to authenticate different vpngroups...
I'm trying eliminating the "crypto map outside_map client authentication VPN-DESA-PIX"
and using a

vpngroup vpn1 authentication-server VPN-PROD-PIX
vpngroup vpn2 authentication-server VPN-DESA-PIX

but it didn't work...

any idea???
0
Comment
Question by:mahe2000
  • 5
  • 4
9 Comments
 
LVL 43

Expert Comment

by:JFrederick29
ID: 24144179
Sure.

aaa-server VPN-PROD-PIX protocol radius
aaa-server VPN-PROD-PIX max-failed-attempts 3
aaa-server VPN-PROD-PIX deadtime 10
aaa-server VPN-PROD-PIX (inside) host 10.1.1.100 timeout 10
aaa-server VPN-DESA-PIX protocol radius
aaa-server VPN-DESA-PIX max-failed-attempts 3
aaa-server VPN-DESA-PIX deadtime 10
aaa-server VPN-DESA-PIX (inside) host 10.2.2.100 timeout 10

vpngroup vpn1 authentication-server VPN-PROD-PIX
vpngroup vpn2 authentication-server VPN-DESA-PIX
0
 
LVL 3

Author Comment

by:mahe2000
ID: 24144230
I have already tried this but it didn't work this way... it keeps using the "crypto map ... authentication client..."
0
 
LVL 43

Expert Comment

by:JFrederick29
ID: 24144280
Have you tried removing the "crypto map ... authentication client..." command?
0
Now Available: Firebox Cloud for AWS and FireboxV

Firebox Cloud brings the protection of WatchGuard’s leading Firebox UTM appliances to public cloud environments. It enables organizations to extend their security perimeter to protect business-critical assets in Amazon Web Services (AWS).

 
LVL 3

Author Comment

by:mahe2000
ID: 24144330
yes, but it only allows one authentication server and I need two differnt user databases...
0
 
LVL 43

Expert Comment

by:JFrederick29
ID: 24147090
Just so we are clear.

You removed the crypto map auth command and added the two servers and binded them to the VPN group?

no crypto map outside_map client authentication VPN-DESA-PIX

aaa-server VPN-PROD-PIX protocol radius
aaa-server VPN-PROD-PIX max-failed-attempts 3
aaa-server VPN-PROD-PIX deadtime 10
aaa-server VPN-PROD-PIX (inside) host 10.1.1.100 timeout 10
aaa-server VPN-DESA-PIX protocol radius
aaa-server VPN-DESA-PIX max-failed-attempts 3
aaa-server VPN-DESA-PIX deadtime 10
aaa-server VPN-DESA-PIX (inside) host 10.2.2.100 timeout 10

vpngroup vpn1 authentication-server VPN-PROD-PIX
vpngroup vpn2 authentication-server VPN-DESA-PIX
0
 
LVL 3

Author Comment

by:mahe2000
ID: 24147138
if I remove the line
no crypto map outside_map client authentication VPN-DESA-PIX

no authentication is made. i don´t need to put a user and password in that case...
0
 
LVL 43

Expert Comment

by:JFrederick29
ID: 24147177
Really?  Nice functionality.  Let me take a look at some things...
0
 
LVL 43

Accepted Solution

by:
JFrederick29 earned 500 total points
ID: 24147545
Okay, so the "vpngroup vpn1 authentication-server <group>" command is not for xauth authentication so it won't work.

This is a limitation of the 6.3 code on the PIX.  You can only have one auth group for your VPN.

"crypto map outside_map client authentication VPN-DESA-PIX".

Is it a PIX 501 or 506? or a 515/525/535?  If a 501, you might want to look into replacing it with an ASA 5505 so you can run the latest and greatest software which provides the auth group per VPN group functionality.  If you have a 515/525/535, you can upgrade to 7.x/8.x to enable this functionality.
0
 
LVL 3

Author Closing Comment

by:mahe2000
ID: 31570203
I get to the same conclusion... thank you very much for the effort!!!
0

Featured Post

Surfing Is Meant To Be Done Outdoors

Featuring its rugged IP67 compliant exterior and delivering broad, fast, and reliable Wi-Fi coverage, the AP322 is the ideal solution for the outdoors. Manage this AP with either a Firebox as a gateway controller, or with the Wi-Fi Cloud for an expanded set of management features

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
assessing firewall rules 3 94
Failover and load Balancing WLB Resource Failed 2 484
sftp access 4 57
DDOS against DYN 9 143
If you are like regular user of computer nowadays, a good bet that your home computer is on right now, all exposed to world of Internet to be exploited by somebody you do not know and you never will. Internet security issues has been getting worse d…
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
How to Install VMware Tools in Red Hat Enterprise Linux 6.4 (RHEL 6.4) Step-by-Step Tutorial

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question