Cisco VPN not asking for UN or PW

[nickbarber]

I have taken over a cleint that has a Cisco Pix. When I connect to the VPN with the Cisco VP client and the PCF they gave me...it just connects, no prompt for User Name or Password. The first question is how is that configured? And how do I change that? Seems like a security breach waiting to happen.

Thansk

Nick                  

[Marius Gunnerud]

Sounds like the username and password is predefined in the PCF file.  I would have originally though it was certificate authentication, but if they have not given you a certificate to install on your PC then i doubt that is the case.

Other than that, we would need to see the full running config (remember to remove public IPs and passwords) to get an idea of what is going on.

--
Please remember to rate and select a correct answer

[nickbarber]

Isn't there a command that tells the VPN which type of authentication to use?


Sent from Cisco Technical Support iPad App

[Marius Gunnerud]

The configuration would normally be unter the tunnel group for the RA VPN.  If a certificate is used you should see the command trust-point , if an authentication group such as RADIUS or TACACS is used you should see the command (for example) authentication-server-group RADIUS.

If there is nothing special configured under the tunnel group the local user database is used.

--
Please remember to rate and select a correct answer

[nickbarber]

Here is the Config. Thanks for looking at it. I would like to authenticate from a local database...not RADIUS at this time.

: Saved
: Written by enable_15 at 20:23:58.566 CST Fri Feb 28 2014
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password NbJ7Q encrypted
passwd NbJ7Qu encrypted
hostname smvpix
domain-name mydomain.org
clock timezone CST -6
clock summer-time CDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.10.0 vpnpool
access-list inside_outbound_nat0_acl permit ip any vpnpool 255.255.255.0
access-list inside_outbound_nat0_acl permit ip vpnpool 255.255.255.0 192.168.10.144 255.255.255.240
access-list outside_cryptomap_dyn_20 permit ip any vpnpool 255.255.255.0
access-list smvvpn_splitTunnelAcl permit ip vpnpool 255.255.255.0 any
access-list outside_cryptomap_dyn_40 permit ip any vpnpool 255.255.255.0
access-list outside_access_in remark edi
access-list outside_access_in permit tcp host xxx.xxx.xxx.xxx eq ftp-data any eq ftp-data log 3
access-list outside_access_in remark edi
access-list outside_access_in permit tcp host xxx.xxx.xxx.xxx eq ftp any eq ftp log 3
access-list outside_access_in remark edi
access-list outside_access_in permit tcp host xxx.xxx.xxx.xxx eq www any eq www log 3
access-list outside_access_in remark edi
access-list outside_access_in permit tcp host xxx.xxx.xxx.xxx eq 1433 any eq 1433 log 3
access-list outside_access_in permit tcp any interface outside eq 5080
access-list outside_access_in permit tcp any interface outside eq 2080
access-list outside_access_in permit tcp any interface outside eq 3389
access-list outside_access_in remark ftp
access-list outside_access_in permit tcp any any eq ftp
access-list outside_access_in remark ftp
access-list outside_access_in permit tcp any any eq ftp-data
access-list extended permit tcp any host xxx.xxx.xxx.xxx eq 2147
access-list extended permit tcp any host 192.168.10.254 eq 2147
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
ip address outside xxx.xxx.xxx.xxx 255.255.255.224
ip address inside 192.168.10.254 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool smvvpnpool 192.168.10.151-192.168.10.155
pdm location vpnpool 255.255.255.0 inside
pdm location vpnpool 255.255.255.0 outside
pdm location 192.168.10.5 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface 5080 192.168.10.5 5080 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface 2080 192.168.10.5 2080 netmask 255.255.255.255 0 0
static (inside,outside) tcp interface 3389 192.168.10.5 3389 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.10.7 xxx.xxx.xxx.xxx netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa authentication ssh console LOCAL
http server enable
http vpnpool 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto dynamic-map outside_dyn_map 40 match address outside_cryptomap_dyn_40
crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp identity address
isakmp keepalive 1500 60
isakmp nat-traversal 30
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup smvvpn address-pool smvvpnpool
vpngroup smvvpn default-domain mydomain.org
vpngroup smvvpn split-tunnel smvvpn_splitTunnelAcl
vpngroup smvvpn idle-time 1800
vpngroup smvvpn password ********
telnet timeout 5
ssh xxx.xxx.xxx.xxx 255.255.255.0 outside
ssh 192.168.10.5 255.255.255.255 inside
ssh timeout 5
console timeout 0
dhcpd address 192.168.10.100-192.168.10.150 inside
dhcpd dns 192.168.10.5 205.171.2.65
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain smvind.com
dhcpd enable inside
username admin password 9APvWcgR encrypted privilege 15
username softsol password nVVfH encrypted privilege 2
terminal width 80

[Marius Gunnerud]

There is nothing that stands out in the configuration at first glance.  I am guessing that there is a setting in the PCF file that sends the username and password automatically.

--
Please remember to rate and select a correct answer

[Javier Portuguez · Accepted solution]

Hello Nick,

I think you are missing the following command:

crypto map outside_map client authentication LOCAL

Unfortunately I don't have a PIX right now, but I think it should do the trick.

HTH.

Please rate helpful posts.

[nickbarber]

Javier, Thanks that was exaclty the command I needed, it is prompting me for the UN and PW!!

[Javier Portuguez]

Great! Have a nice week! :)


Sent from Cisco Technical Support Android App