Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Active Directory Authentication Using a RADIUS server

I have a Cisco ASA 5505 device deployed at a client office. I am trying to set it up so that the VPN connections are authenticated to Active Directory. I have successfully setup IAS and the users can connect using the Cisco VPN client, but when they try to access file shares or Exchange server after connecting, they are prompted for domain username and password. Is there any way to configure it so that when connected to the ASA, they are authenticated to the domain as well?

5 REPLIES

Re: Active Directory Authentication Using a RADIUS server

This is expected behavior, and it is caused since the authentication performed by the ASA is only performing user authenticaiton and not domain login, to achieve domain login your users will have to enable "start before login" on their vpn client. What this will do is that after the user turns on the computer the vpn client then is launched and will establish a vpn connection, then they will enter the normal username and password, after the vpn is connected then they will be login into their workstation with the windows login, in that step domain login occurs

Re: Active Directory Authentication Using a RADIUS server

forgot to specify, this feature is only available for WindowsXP or lower OS, windows VISTA does not support this feature.

New Member

Re: Active Directory Authentication Using a RADIUS server

Ya, the problem with that is the PC is not a member of the domain. It's like this because the user is a remote employee who is rarely in the office and wants to work off of a local profile. We used to have him set up with the Microsoft VPN client which would authenticate him to the domain even if his PC didn't have a computer account in Active Directory. Since switching to the VPN client, he is no longer able to access anything once connected, without supplying AD credentials. Will this suggested remody work even if the PC has not been added to the domain?

Re: Active Directory Authentication Using a RADIUS server

There is no other way around this, VPN Client does not register users into domains once they log in, the only purpose of the Xauth, user authentication is to give one extra layer of security

New Member

Re: Active Directory Authentication Using a RADIUS server

I think you're right about not adding the PC to the domain. I normally build the PC at the office, got the user to actually log on inside the internal network so that the account is cached onto the PC. Then take the PC out and VPN in. Start before logon would only work once the PC is on the domain and the user account is cached on the computer.

445
Views
0
Helpful
5
Replies
CreatePlease to create content