Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

IOS SSL VPN WITH RADIUS Authorization

Hi

I'm trying to authenitcate and authorize  the users loggining into SSLVPN via ACS and although the ACS loggs and "TEST" command on the router shw succeeful authentication i receive the flollowing debug

*Jun  6 22:39:50.157: %SSLVPN-5-SSL_TLS_CONNECT_OK: vw_ctx: UNKNOWN vw_gw: SSLVPN i_vrf: 0 f_vrf: 0 status: SSL/TLS connection successful with remote at 10.0.0.100:4346

Rack1R1(config)#                          

*Jun  6 22:40:09.409: %SSLVPN-5-SSL_TLS_CONNECT_OK: vw_ctx: UNKNOWN vw_gw: SSLVPN i_vrf: 0 f_vrf: 0 status: SSL/TLS connection successful with remote at 10.0.0.100:4357

Rack1R1(config)#                          

*Jun  6 22:40:21.409: WV-AAA: AAA authentication request sent for user: "SSLUSER"

*Jun  6 22:40:21.409: RADIUS/ENCODE(00000000):Orig. component type = INVALID

*Jun  6 22:40:21.409: RADIUS/ENCODE(00000000): dropping service type, "radius-server attribute 6 on-for-login-auth" is off

*Jun  6 22:40:21.409: RADIUS(00000000): Config NAS IP: 150.1.1.1

*Jun  6 22:40:21.409: RADIUS(00000000): sending

*Jun  6 22:40:21.409: RADIUS(00000000): Send Access-Request to 10.0.0.100:1645 id 1645/27, len 60

*Jun  6 22:40:21.409: RADIUS:  authenticator AC 16 B3 54 46 72 37 05 - 4C 00 19 21 81 97 40 6E

*Jun  6 22:40:21.409: RADIUS:  User-Name           [1]   16  "SSLUSER@SSLVPN"

Rack1R1(config)#                          

*Jun  6 22:40:21.409: RADIUS:  User-Password       [2]   18  *

*Jun  6 22:40:21.409: RADIUS:  NAS-IP-Address      [4]   6   150.1.1.1                

*Jun  6 22:40:21.669: RADIUS: Received from id 1645/27 10.0.0.100:1645, Access-Accept, len 282

*Jun  6 22:40:21.669: RADIUS:  authenticator 2D 2C B0 39 89 4C 41 88 - 40 32 E2 09 0D 7F 6B 0C

*Jun  6 22:40:21.669: RADIUS:  Framed-IP-Address   [8]   6   255.255.255.255          

*Jun  6 22:40:21.669: RADIUS:  Vendor, Cisco       [26]  28 

*Jun  6 22:40:21.669: RADIUS:   Cisco AVpair       [1]   22  "webvpn:svc-enabled=1"

*Jun  6 22:40:21.669: RADIUS:  Vendor, Cisco       [26]  29 

*Jun  6 22:40:21.669: RADIUS:   Cisco AVpair       [1]   23  "webvpn:svc-required=1"

*Jun  6 22:40:21.669: RADIUS:  Vendor, Cisco       [26]  50 

*Jun  6 22:40:21.669: RADIUS:   Cisco AVpair       [1]   44  "webvpn:split-include=6.6.6.0 255.255.255.0"

*Jun  6 22:40:21.669: RADIUS:  Vendor, Cisco       [26]  35 

*Jun  6 22:40:21.669: RADIUS:   Cisco AVpair       [1]   29  "webvpn:keep-svc-installed=1"

*Jun  6 22:40:21.669: RADIUS:  Vendor, Cisco       [26]  31 

*Jun  6 22:40:21.669: RADIUS:   Cisco AVpair       [1]   25  "webvpn:addr-pool=SSLVPN"

*Jun  6 22:40:21.669: RADIUS:  Vendor, Cisco       [26]  41 

*Jun  6 22:40:21.669: RADIUS:  Service-Type        [6]   6   Outbound                  [5]

*Jun  6 22:40:21.669: RADIUS:  Class               [25]  36 

*Jun  6 22:40:21.669: RADIUS:   43 41 43 53 3A 30 2F 34 37 30 2F 39 36 30 31 30  [CACS:0/470/96010]

*Jun  6 22:40:21.669: RADIUS:   31 30 31 2F 53 53 4C 55 53 45 52 40 53 53 4C 56  [101/SSLUSER@SSLV]

*Jun  6 22:40:21.669: RADIUS:   50 4E                                            [PN]

*Jun  6 22:40:21.673: RADIUS(00000000): Received from id 1645/27

*Jun  6 22:40:21.673: RADIUS(00000000): Unique id not in use

Rack1R1(config)#                          

*Jun  6 22:40:21.673: RADIUS/DECODE(00000000): There is no RADIUS DB Some Radius attributes may not be stored

*Jun  6 22:40:21.673: AAA/AUTHOR (0x0): Pick method list 'RAD'

Rack1R1(config)#                          

*Jun  6 22:40:23.673: WV-AAA: AAA Authentication Failed!

Rack1R1(config)#                          

*Jun  6 22:40:24.069: %SSLVPN-5-SSL_TLS_CONNECT_OK: vw_ctx: UNKNOWN vw_gw: SSLVPN i_vrf: 0 f_vrf: 0 status: SSL/TLS connection successful with remote at 10.0.0.100:4359

Rack1R1(config)# 

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

router Configuration

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname Rack1R1

!

boot-start-marker

boot-end-marker

!

! card type command needed for slot/vwic-slot 0/1

logging message-counter syslog

enable password cisco

!

aaa new-model

!

!

aaa authentication login RAD group radius

aaa authorization network RAD group radius

!

!        

aaa session-id common

dot11 syslog

ip source-route

!

!

!

!

ip cef

no ip domain lookup

ip domain name INE.com

ip host cisco.com 136.1.121.1

ip host www.cisco.com 136.1.121.1

ip host www.google.com 136.1.121.1

ip host www.ripe.net 136.1.121.1

no ipv6 cef

!

multilink bundle-name authenticated

!

!

crypto pki trustpoint TP-self-signed-3354934498

enrollment selfsigned

subject-name cn=IOS-Self-Signed-Certificate-3354934498

revocation-check none

rsakeypair TP-self-signed-3354934498

!

!

crypto pki certificate chain TP-self-signed-3354934498

certificate self-signed 01

  30820247 308201B0 A0030201 02020101 300D0609 2A864886 F70D0101 04050030

  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274

  69666963 6174652D 33333534 39333434 3938301E 170D3132 30363036 31333030

  32375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649

  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 33353439

  33343439 3830819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281

  8100B1E5 889BEB9A 31DFC0D4 7C7F698F 0F52E404 0849263A BD443A96 13C6A440

  DCBD4345 EF301E91 0D4AADD9 3C2A17F2 E26E5E96 90F96809 D8FCCF32 7EB58100

  74E4772C 6395E03C 1B7F1AF5 482F861F DD62D079 F9977FE2 0E544E18 5FAAF290

  DF665B45 EF10D3EC D924E87A 5F827F07 06DE8961 F361C3FA EDBE5F68 452221C8

  B9570203 010001A3 6F306D30 0F060355 1D130101 FF040530 030101FF 301A0603

  551D1104 13301182 0F526163 6B315231 2E494E45 2E636F6D 301F0603 551D2304

  18301680 140B00B8 FD9B58CF 8A6F51BE 25DEC6C5 85E14495 05301D06 03551D0E

  04160414 0B00B8FD 9B58CF8A 6F51BE25 DEC6C585 E1449505 300D0609 2A864886

  F70D0101 04050003 81810006 4192E2DB ABAF533E 9C4BF24E DF6BFD45 144A6AE9

  C874E311 27B23E7B E8DB18C3 4FFB4ACA 4B09F63E 62501578 D8F58D73 D08F016F

  49C99B8D DA1073E5 A141C1C7 505BD191 FC58EA7F 54BD9B98 579E1726 7C1CA619

  A45DDABC 8F315EE9 D20A30A8 2BD5D67D B744BD69 353B4670 E5BA4540 47059E60

  9DC4C940 E91AACBB 4EAFFA

        quit

!

!

username admin privilege 15 password 0 admin

username SSLUSER@SSLVPN password 0 cisco

archive

log config

  hidekeys

!

!

!

!

crypto ipsec client ezvpn EZVPN_CLIENT

connect auto

mode client

xauth userid mode interactive

!

!

!

ip tcp synwait-time 5

!

!        

!

interface Loopback0

ip address 150.1.1.1 255.255.255.0

!

interface Loopback6

ip address 6.6.6.6 255.255.255.0

!

interface FastEthernet0/0

no ip address

shutdown

duplex auto

speed auto

!

interface FastEthernet0/1

no ip address

duplex auto

speed auto

!

interface FastEthernet0/1.11

encapsulation dot1Q 12

ip address 136.1.11.1 255.255.255.0

!

interface FastEthernet0/1.121

encapsulation dot1Q 121

ip address 136.1.121.1 255.255.255.0

!

interface FastEthernet0/0/0

!

interface FastEthernet0/0/1

!

interface FastEthernet0/0/2

!

interface FastEthernet0/0/3

!

interface Virtual-Template1 type tunnel

no ip address

tunnel mode ipsec ipv4

!

interface Vlan1

no ip address

!

router rip

version 2

passive-interface FastEthernet0/1.11

network 136.1.0.0

network 150.1.0.0

no auto-summary

!

ip local pool SSLVPN 40.0.0.1 40.0.0.254

ip forward-protocol nd

ip route 10.0.0.0 255.255.255.0 136.1.121.12

ip http server

ip http secure-server

!

!

ip dns server

!

ip access-list extended SPLIT

permit ip 136.1.11.0 0.0.0.255 10.0.0.0 0.0.0.255

!

ip radius source-interface Loopback0

!

!

!

!

!

radius-server host 10.0.0.100 auth-port 1645 acct-port 1646 key CISCO

!

control-plane

!

!

!

line con 0

exec-timeout 0 0

privilege level 15

logging synchronous

line aux 0

exec-timeout 0 0

privilege level 15

line vty 0 4

password cisco

!

scheduler allocate 20000 1000

!

webvpn gateway SSLVPN

ip interface Loopback0 port 443

http-redirect port 80

ssl encryption rc4-md5

ssl trustpoint TP-self-signed-3354934498

logging enable

inservice

!       

webvpn install svc flash:/webvpn/anyconnect-win-2.5.3055-k9.pkg sequence 1

!

webvpn context SSLVPN

title "**SSLVPN  **"

ssl encryption rc4-md5

ssl authenticate verify all

!

aaa authentication list RAD

aaa authentication domain @SSLVPN

aaa authorization list RAD

gateway SSLVPN

inservice

!

end

Any Idea?

1369
Views
0
Helpful
0
Replies
CreatePlease to create content