Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

PIX cannot authenticate VPN users using RSA tokens and Radius server

How would you configure the pix to to work with the rsa's radius server to authenticate vpn 3.x or 4.x users using keyfobs without the use of a vpn3000 or an acs/tacas server? Do you have to have a AAA server pointing to the RSA's server as an external database to authenticate users? Is this the only way to make authentication work with RSA keyfobs?

I just can't get the pix to talk directly to the RSA radius server. Please help

Thanks

4 REPLIES
New Member

Re: PIX cannot authenticate VPN users using RSA tokens and Radiu

Make sure you have the following RADIUS related commands in your PIX config:

aaa-server RADIUS protocol radius

aaa-server protocol radius

aaa-server (inside) host a.b.c.d crypto map remaccess client authentication

Make sure you add the PIX as an agent host communication server

Verify that the is the same on the PIX and the agent host for the PIX

I had the same problem as you, what ended up working in the end was I had to configure the legacy agent server identification field in the configuration management editor with the address of the ace server. I also manually added the ace server in the assign acting servers menue on the PIX agent host

hope this helps

-Patrick

New Member

Re: PIX cannot authenticate VPN users using RSA tokens and Radiu

forgot to add...

check and make sure you have entries on the ace server box in the /win32/drivers/etc/services file that have the 2 RADIUS fields showing ports 1645 & 1646. These are not the defaults and usually need to be changed as such.

New Member

Re: PIX cannot authenticate VPN users using RSA tokens and Radiu

Patrick,

Thank you for your help. I already had the radius protocol settings on the nt box and the pix aaa commands you previously mention. But how do you configure the legacy agent and the activity server settings on the pix?

I had the same problem as you, what ended up working in the end was I had to configure the legacy agent server identification field in the configuration management editor with the address of the ace server. I also manually added the ace server in the assign acting servers menue on the PIX agent host

New Member

Re: PIX cannot authenticate VPN users using RSA tokens and Radiu

these settings are on the RSA ACE server. One is located in the configuration manager and the other is located in the database manager>agenthost menu. Go to where you added the pix as an agent host and there is a sub menu for assigning an active server. Select the ace sever as the active server.

I have also found the support area of RSA's website very useful. You will need to create an account to access the technical doc's. You can create a guest account that will allow you access to support doc's.

304
Views
0
Helpful
4
Replies