ASA VPN Authentication

Unanswered Question
Nov 6th, 2007
User Badges:

I'm setting up a new ASA with VPN access and am trying to decide which authentication method to use LDAP or RADIUS. I was wondering if there were any pros or cons to either way. I'm trying to control access by Active Directory Group.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
acomiskey Tue, 11/06/2007 - 10:42
User Badges:
  • Green, 3000 points or more

Not sure about any advantages/disadvantages to either but since you are authenticating against AD it would be simple for you to set up IAS on your domain controller.

John Patrick Lopez Wed, 11/07/2007 - 06:43
User Badges:

From my own opinion, the advantage of using AD as the authentication server is that, passwords can expire after a number of days. Well, it still really depends on the password policy of your domain. That is one of the disadvantage of using Cisco ACS, the password won't expire after few days or months.


Regards,

John

I am working with AD and testing out both the IAS RADIUS and the LDAP for SSL VPN, and there are a few differences.

SSL VPN in clientless mode allows for password management, so the end-user can update their pw from the login page.

LDAP allows you to notify the user X number of days before the pw expires and allow them to change it (# of days is configurable; secure LDAP is required, but not hard to set up).

RADIUS, again per the documentation, can only notify the user, and allow them to change the password, when it expires.


I am also trying to configure framed-ip-addresses, so that as users log in via the SSL VPN Client (AnyConnect), they will always get the same IP address. I can get the framed IP to work with RADIUS, but not LDAP.


LDAP also works very nicely with DAP in the SSL VPN, too, which allows you to add functionality to the profile assigned to a user a login based on AD group membership.


These are a few of the differences that I have found, so far.

gates1150 Wed, 11/21/2007 - 13:59
User Badges:

Can you control access by group with LDAP? I was able to get it to work but haven't gotten it working by AD group.

This seems to be doable, but I have not done it here (I am running SSL VPN and using DAP, which certainly works with AD groups).


It looks like you configure an LDAP attribute map to the IETF-Radius-Class, (and then map your AD groups to ASA groups if the group names do not already match). See page 13-15 and Appendix E in the CLI Config Guide.

gates1150 Wed, 11/21/2007 - 14:18
User Badges:

I've had it working just doesn't go by group. I'll keep digging thanks for the reply.

najeebsyed2 Mon, 01/07/2008 - 10:03
User Badges:

Hello,

I am in the same situation as you. I am currently using IAS on my Windows 2003 DC to authenticate remote users (IPSec VPN tunnel)via the Radius protocol. I was able to sucessfully authenticate users against Active Directory.


Now, the real issue is that we have a lot of remote users and they need to be able to change their Domain Passwords if they expire, or get notifications when their passwords are about to expire.


I was confused on what you posted: " RADIUS, again per the documentation, can only notify the user, and allow them to change the password, when it expires."


When using the RADIUS protocol over an IPSec VPN tunnel, are remote users able to change their passwords? Or only get notified when the password expires ? Thanks in advance.

boschrexroth Tue, 01/15/2008 - 06:52
User Badges:

Same here.


Am using IAS and PIX and need my users to be able to be notified and allowed to change there password in AD.


Thanks.

gates1150 Tue, 01/15/2008 - 07:00
User Badges:

I don't think you can do it with a PIX. You have to be on an ASA.

najeebsyed2 Tue, 01/15/2008 - 07:06
User Badges:

Check the documentation for the version of PIX you are running. I don't believe what you are trying to do is possible with a PIX.

gates1150 Tue, 01/15/2008 - 07:08
User Badges:

If you look in the ASDM under your connection profile for your Remote Access users. Look under Advanced there's an option "Enable notification upon password expiration to allow user to change password".


That's the only place I can see to try and make it work.

najeebsyed2 Tue, 01/15/2008 - 07:11
User Badges:

I have read posts that say that using RADIUS it is NOT possible to use the password managment feature. Is that true?

gates1150 Tue, 01/15/2008 - 07:14
User Badges:

I don't know I haven't tried to enable the feature. Are you running the latest ASA version?

najeebsyed2 Tue, 01/15/2008 - 07:23
User Badges:

My ASA is running 7.2(2). If you run across any documentation regarding password managment via Radius, please share. I've come across LDAP Authorization that allows this, but not RADIUS. Thanks.

gates1150 Tue, 01/15/2008 - 07:24
User Badges:

I'm on 8.02. I'll pass it along if I find anything.

acomiskey Tue, 01/15/2008 - 08:09
User Badges:
  • Green, 3000 points or more

Password-management will work with Radius and LDAP. When using radius you will not be notified a certain number of days before password expiration, but you will be notified when it expires and will be able to change it.

boschrexroth Tue, 01/15/2008 - 08:13
User Badges:


When my client connects to our PIX then he is prompted for his AD username and password. If the password has expired it just keeps asking him for his password and then locks his account.


What have I do wrong or maybe better how do you properly set this up on a radius server.


Thanks.

acomiskey Tue, 01/15/2008 - 08:15
User Badges:
  • Green, 3000 points or more

This is the command you are looking for.


password-management


http://cisco.com/en/US/docs/security/asa/asa71/command/reference/p_711.html#wp1643267


Once enabled on the firewall all you have to do is make sure you are allowing mschap v2 in your remote access policy on IAS server.


When the user connects to the vpn and their password has expired, it will prompt them to change their password.


hostname(config)# tunnel-group group-name general-attributes

hostname(config-tunnel-general)# password-management


edit: There is also a checkbox in the remote access policy in IAS to "allow user to change password after it expires"...check it.

It sounds like you are using LDAP right now. In order to enable password management with LDAP you must use Secure LDAP. At the command line it is "ladp-over-ssl", in ASDM it is a check box on the LDAP server page. (LDAP configuration starts at page 13-12 in the 8.0 CLI Config Guide; the requirement for LDAP over SSL to enable password management is mentioned on page 30-10).


To enable LDAP over SSL on the AD LDAP server you will need to install a certificate on the server. Once the certificate is installed no other configuration is required on the AD server.

STEVE DUE Wed, 01/16/2008 - 16:27
User Badges:

HI I am trying to get my asa to use a radius server and authenticate with the domain, i just cant seem to get it to work. when i do the test in the asa it always fails. i do get an error on the server about wrong password but i still cant figure it out, any direction would be appreciated

najeebsyed2 Thu, 01/17/2008 - 08:32
User Badges:

Hello,

Verify the you are using MS-CHAPv2 on your radius server under IAS and Routing and Remote Access services and on your ASA. It would help if you have more details about your configurations. Thanks.

gates1150 Thu, 01/17/2008 - 09:24
User Badges:

Sounds like your Radius Shared Secret doesn't match what's on the ASA.

acomiskey Thu, 01/17/2008 - 09:48
User Badges:
  • Green, 3000 points or more

Steve,


The "test" feature in the ASA uses PAP. If PAP is not enabled on your radius server it will fail with invalid password.


If you are running IAS, enable PAP in the remote access policy or test from a vpn client, not from the "test" function in the ASA.

STEVE DUE Thu, 01/17/2008 - 10:21
User Badges:

thanks i will try it, i also tried the vpn client and was able to connect however it used local authentication rather than the AD.

STEVE DUE Thu, 01/17/2008 - 10:26
User Badges:

yep tried it still get user rejected the reason it says in windows is The connection attempt did not match any connection request policy.

but i do have a policy setup.

acomiskey Thu, 01/17/2008 - 10:29
User Badges:
  • Green, 3000 points or more

What is defined in your connection request policy?

STEVE DUE Thu, 01/17/2008 - 10:34
User Badges:

i have match username to wildcard and then have tried authenticate requests on this server and also without credentials

acomiskey Thu, 01/17/2008 - 11:12
User Badges:
  • Green, 3000 points or more

Try it without the username value. By default the policy "use windows authentication for all users" is only set to day and time restriction permit all. I would try that.

najeebsyed2 Thu, 01/17/2008 - 11:23
User Badges:

Actions

This Discussion