Resolution
You can configure the PIX Firewall with a backup ACS server for VPN Clients if the primary server goes down.
In order to accomplish this, complete these steps:
- Configure the primary ACS server with the host name and key.
- Configure the secondary ACS server with the host name and key.
- Bind the authentication server with crypto map.
- Use these commands in order to complete the configuration:
aaa-server ACS-RADIUS (inside) host X.X.X.X (key) timeout 5
aaa-server ACS-RADIUS (inside) host Y.Y.Y.Y (key) timeout 5
crypto map vpnmap client authentication ACS-RADIUS LOCAL
Note: Within the crypto map, you can only enter one external authentication server group. The failover or backup authentication method can only be set to LOCAL. The second server in the list is only queried if the primary server is unresponsive. If the primary server is queried and issues a failed response, then the secondary server is not queried.