Cisco Support Community
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Remote Access- ASA


Moving from VPN Concentrator to ASA for Remote Access.

I tested the following configuration but no luck, user accounts are created on ACS and cannot get authenticated.... I am missing something still....


ip local pool JK mask

group-policy PAK-TEL internal

group-policy PAK-TEL attributes

wins-server value

dns-server value

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

tunnel-group PAK-TEL type ipsec-ra

tunnel-group PAK-TEL general-attributes

address-pool JK

default-group-policy PAK-TEL

tunnel-group PAK-TEL ipsec-attributes

pre-shared-key *

telnet timeout 1440


Re: Remote Access- ASA

Do you have something like?

access-list inside_nat0_outbound extended permit ip

nat (inside) 0 access-list inside_nat0_outbound

Community Member

Re: Remote Access- ASA

Yes, I have this...

when I have local-user on ASA ; it works.

But how could the traffic forward to ACS Server...

Re: Remote Access- ASA

Are you sure, you have something like this on configuration,

aaa-server RADIUS-SERVER protocol radius

aaa-server RADIUS-SERVER () host

tunnel-group PAK-TEL general-attributes

authentication-server-group RADIUS-SERVER

Assuming that you are using Radius protocol for authentication and ACS is configured accordingly.

Try to use following test command to ensure that authentication is working against the ACS server,

test aaa-server authentication host


test aaa-server authentication RADIUS host



Community Member

Re: Remote Access- ASA


I dont see any failed/passed info under Reports-logging on ACS..

On ACS the following is done

ASA added under AAA client with shared key

Radius authentication

rename group5 on ACS as PAK-TEL

No Luck so far...

Re: Remote Access- ASA

Renaming Group to PAK-TEL is not required, its only for your management comfort only.

One question, are you able to authentication using the current ACS against any other device ? Or is ASA is the only one that you are trying to authenticate. Could be that ACS is not configured properly, by that I mean "Proxy Distribution Table" is not configured properly.

If this is the first time you are trying to authenticate on ACS, then please enable Passed Reports as it is disabled by default.

The very first thing that should be successful, in order to get VPN users authenticated is, to ensure that the "test aaa...." command is successful from the ASA, if that does not succeed, then no point in testing using VPN client.

Make sure that nothing is blocking the Radius traffic in between i.e b/w ASA and ACS.

What is the result of the test command, is it,

"ERROR: Authentication Server not responding: No error" ?

Or something else ?



Please rate if it helps!

CreatePlease to create content