PIX 6.3 VPN different AAA authentication

I would like to know if I can use differnt Radius servers to authenticate different vpngroups...
I'm trying eliminating the "crypto map outside_map client authentication VPN-DESA-PIX"
and using a

vpngroup vpn1 authentication-server VPN-PROD-PIX
vpngroup vpn2 authentication-server VPN-DESA-PIX

but it didn't work...

any idea???
LVL 3
mahe2000Asked:
Who is Participating?
 
JFrederick29Connect With a Mentor Commented:
Okay, so the "vpngroup vpn1 authentication-server <group>" command is not for xauth authentication so it won't work.

This is a limitation of the 6.3 code on the PIX.  You can only have one auth group for your VPN.

"crypto map outside_map client authentication VPN-DESA-PIX".

Is it a PIX 501 or 506? or a 515/525/535?  If a 501, you might want to look into replacing it with an ASA 5505 so you can run the latest and greatest software which provides the auth group per VPN group functionality.  If you have a 515/525/535, you can upgrade to 7.x/8.x to enable this functionality.
0
 
JFrederick29Commented:
Sure.

aaa-server VPN-PROD-PIX protocol radius
aaa-server VPN-PROD-PIX max-failed-attempts 3
aaa-server VPN-PROD-PIX deadtime 10
aaa-server VPN-PROD-PIX (inside) host 10.1.1.100 timeout 10
aaa-server VPN-DESA-PIX protocol radius
aaa-server VPN-DESA-PIX max-failed-attempts 3
aaa-server VPN-DESA-PIX deadtime 10
aaa-server VPN-DESA-PIX (inside) host 10.2.2.100 timeout 10

vpngroup vpn1 authentication-server VPN-PROD-PIX
vpngroup vpn2 authentication-server VPN-DESA-PIX
0
 
mahe2000Author Commented:
I have already tried this but it didn't work this way... it keeps using the "crypto map ... authentication client..."
0
KuppingerCole Reviews AlgoSec in Executive Report

Leading analyst firm, KuppingerCole reviews AlgoSec's Security Policy Management Solution, and the security challenges faced by companies today in their Executive View report.

 
JFrederick29Commented:
Have you tried removing the "crypto map ... authentication client..." command?
0
 
mahe2000Author Commented:
yes, but it only allows one authentication server and I need two differnt user databases...
0
 
JFrederick29Commented:
Just so we are clear.

You removed the crypto map auth command and added the two servers and binded them to the VPN group?

no crypto map outside_map client authentication VPN-DESA-PIX

aaa-server VPN-PROD-PIX protocol radius
aaa-server VPN-PROD-PIX max-failed-attempts 3
aaa-server VPN-PROD-PIX deadtime 10
aaa-server VPN-PROD-PIX (inside) host 10.1.1.100 timeout 10
aaa-server VPN-DESA-PIX protocol radius
aaa-server VPN-DESA-PIX max-failed-attempts 3
aaa-server VPN-DESA-PIX deadtime 10
aaa-server VPN-DESA-PIX (inside) host 10.2.2.100 timeout 10

vpngroup vpn1 authentication-server VPN-PROD-PIX
vpngroup vpn2 authentication-server VPN-DESA-PIX
0
 
mahe2000Author Commented:
if I remove the line
no crypto map outside_map client authentication VPN-DESA-PIX

no authentication is made. i don´t need to put a user and password in that case...
0
 
JFrederick29Commented:
Really?  Nice functionality.  Let me take a look at some things...
0
 
mahe2000Author Commented:
I get to the same conclusion... thank you very much for the effort!!!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.