Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Cisco VPN client and RSA soft token


I just setup a RSA to our Cisco 3030. I was under the impression after the setup of the RSA that my VPN client will prompt me for my network password and token.

If it can be done. What do I need to do to get prompted for both network password and rsa passcode. Currently I am only get prompted for rsa passcode.



Re: Cisco VPN client and RSA soft token

The AnyConnect SSL VPN Client has to be 'aware' that the RSA Software Token is installed and it needs to communicate with it via the RSA API. It is possible to authenticate Remote Access VPN Clients using RSA. RSA has an inbuilt RADIUS server (you may need to enable it). So configure aaa server and authentication on the router and set the client authentication to this radius server.

You need the following:

1) in the ACS Server, make sure you install the RSA agent and configure it properly.

2) Create external users database for certain group/users. When user is unknown, forward it to the RSA SecurID server.

3) on the RSA SecurID, make sure you create the ACS server as an agent. you need to create a sdconf.rec file and place it in the ACS server.

The ACS server SecurID agent has a tool for you to verify the connectivity. The setup is actually very simple.

Hall of Fame Super Silver

Re: Cisco VPN client and RSA soft token


Your comments about what to do on the ACS server may or may not be needed. I have set up Remote Access VPN on the 3000 series concentrator which the original poster is asking about and the concentrator communicated directly with the RSA server (not the Radius server) for authentication.

Also your comments about the AnyConnect client would be appropriate if the original poster were asking about Remote Access VPN on the ASA. But clearly he is asking about the 3030 concentrator and as far as I know the AnyConnect client is not supported on the 3000 series concentrator.


I am not aware of any option that will prompt for both the group password (which I assume is what you mean when you say network password) in addition to prompting for the user password (RSA password).



CreatePlease login to create content