?
Solved

Cisco Router with Radius authentication for VPN with ASA in the middle

Posted on 2014-02-18
1
Medium Priority
?
66 Views
Last Modified: 2015-12-10
Hello,

I have an interesting situation which I have not seen before. Maybe someone can help. We have a Cisco 2921 with IOS 15.1 connected to the internet on Gi0/0. The 2921 is doing NAT as that is the border router.

Gi0/1 of the 2921 is connected to a Cisco ASA 5505 on Eth0/0 (outside). Eth0/1 of ASA is connected to a Layer 3 switch (3750).

This is a very common deployment scenario. Now the problem:

We are using a radius server behind the ASA on the inside interface to authenticate our VPN users. VPN termination is NOT done on the ASA instead on the 2921. ASA is running in routed mode.

The interesting thing I am noticing is when Windows Server 2008 receives an authentication request from the router, the source address in the packet capture is the ASA's inside address. So obviously the server responds back to that address with success however that request never reaches the router. The 2921 keeps waiting for a response from Radius and then times out.

However if i ping from the 2921 to this Radius server and check the packet capture using Wireshark, the source ip on the packet is correct (2921's gi0/1). Since the ASA is not doing NAT (no nat-control) looks like somewhere on the ASA there is a problem.

We don't have any outbound ACL's on the ASA and for testing I opened up everything using permit ip any any and still the same result. Since ping's can reach from the 2921 to the radius server, i did rule out ACL.

Thoughts?
0
Comment
Question by:bbwonders
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 12

Accepted Solution

by:
Henk van Achterberg earned 2000 total points
ID: 39872519
This is indeed weird behaviour. When you run the packet capture on the ASA itself do you see if the packets are sent back?

Can you post a sanitized config of your ASA?

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/110117-asa-capture-asdm-config.html

https://supportforums.cisco.com/docs/DOC-17814
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many of the companies I’ve worked with have embraced cloud solutions due to their desire to “get out of the datacenter business.” The ability to achieve better security and availability, and the speed with which they are able to deploy, is far grea…
When speed and performance are vital to revenue, companies must have complete confidence in their cloud environment.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses

801 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question