Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Radius group authorization with PIX

Is it possible to specify group authorisation with the Radius server on the PIX?

I can't find any info regarding this, have anyone tried it yet?

On the IOS router you can specify

aaa authorization network groupauth-name group your-radius-server-group

and all of your group parameters then can be configured on the radius.

I found that you can have the following Cisco AV-pairs downloaded from the radius:

radiusReplyItem cisco-avpair = "ipsec:addr-pool=default"

radiusReplyItem cisco-avpair = "ipsec:default-domain=viatel.com"

radiusReplyItem cisco-avpair = "ipsec:dns-servers=135.196.0.14"

radiusReplyItem cisco-avpair = "ipsec:max-users=10”

radiusReplyItem cisco-avpair = "ipsec:max-logins=1”

radiusReplyItem cisco-avpair = "ipsec:include-local-lan=1"

radiusReplyItem cisco-avpair = "ipsec:key-exchange=ike"

radiusReplyItem cisco-avpair = "ipsec:key-exchange=preshared-key"

radiusReplyItem cisco-avpair = "ipsec:timeout=10

radiusReplyItem cisco-avpair = "ipsec:tunnel-password=xxx"

radiusReplyItem cisco-avpair = "

ipsec:wins-servers="

radiusReplyItem cisco-avpair="ipsec:idletime=20"

radiusReplyItem cisco-avpair="ipsec:inacl=135

radiusReplyItem cisco-avpair = "ipsec:access-restrict=ATM5/0.101"

radiusReplyItem cisco-avpair = “ipsec:group-lock=1”

Many thanks

Oleg

4 REPLIES
Silver

Re: Radius group authorization with PIX

Are you looking for something like the aaa group server radius command? The command details are given in the link below:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123tcr/123tsr/sec_a1gt.htm#1076049

New Member

Re: Radius group authorization with PIX

Thanks for your reply, much appreciated!!!

the command you're reffering to is used to configure the Radius server parameters on the router.

I have done that already and what I am looking for is what vpn group radius attributes (if any) we can use with the PIX.

For example: with an IOS router you can configure all group parameters on the Radius server and you don't even need to add the group on the router itself.

here is what I have on the IOS router (837):

aaa group server radius ipvpn

server-private 10.1.1.1 auth-port 1645 acct-port 1646 key 7 xxxxx

aaa authentication login remote-837 group ipvpn

aaa authentication enable default enable

aaa authorization exec default local

aaa authorization network default none

aaa authorization network remote-837 group ipvpn

aaa session-id common

crypto isakmp policy 10

encr 3des

authentication pre-share

group 2

crypto ipsec transform-set remote esp-3des esp-sha-hmac

!

crypto dynamic-map remote 10

set security-association idle-time 3600

set transform-set remote

!

!

crypto map 837-vpn client authentication list remote-837

crypto map 837-vpn isakmp authorization list remote-837

crypto map 837-vpn client configuration address respond

crypto map 837-vpn 10 ipsec-isakmp dynamic remote

interface ATM0.38 point-to-point

ip nat outside

pvc 0/38

ubr 256

oam-pvc manage

encapsulation aal5mux ip

!

crypto map 837-vpn

and then I have configured group account on the radius server with all the parameters that I want e.g. password, dns, wins servers etc.

So when a VPN Client wants to connect to this router the router will check the group parameters on the radius server and then authenticate the user (another account on the same radius server).

What I am looking for is the same functionality on the PIX instead of configuring vpngroup commands on each of the PIXs manually.

Hope it makes it a bit clearer.

Thanks

Oleg

New Member

Re: Radius group authorization with PIX

Oleg-

Have you been able to apply ACLs to IPSec groups from the ACS server with no configuration done one the router (at least none after the initial configuration)? Would appreciate any advice.

Regards,

Blake

New Member

Re: Radius group authorization with PIX

Hi,

haven't tried it myself as we are not using ACS server.

and the PIX doesn't support the radius groups.

Remember seeing something about it on the Cisco site though.

/OlK

436
Views
0
Helpful
4
Replies
CreatePlease login to create content