Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

PPTP and RADIUS on remote site

I have two PIXs and one RADIUS (Windows) server on a site. Both sites are connected by PIX-PIX IPSEC tunnel. I have configured both PIXs for PPTP access using RADIUS to authenticate. On the site with the RADIUS server is local this works ok. When I try to authenticate against the PIX from the other site over the VPN it fails. Any ideas?

Cisco Employee

Re: PPTP and RADIUS on remote site

When the PIX sends out the authentication request to the remote Radius server it will source the packet from its outside interface. Your crypto ACL will have to include traffic from this outside IP address to the subnet with the Radius server on it (or just to the Radius server itself if you want to be more specific). Similarly the crypto ACL on the PIX with the local Radius server will have to include traffic from its local subnet (or again just from the Radius server) to the other PIX's outside interface. This will ensure that Radius requests from the remote PIX will go over the VPN tunnel.

Also make sure on your Radius server that when you add the remote PIX is as a AAA Client, you use it's outside IP address because that is the IP address that the Radius server will see the requests coming from.