topic AD Authentication for Client VPN in Network Access Control

AD Authentication for Client VPN

Vamsi Pinnaka — Mon, 11 Mar 2019 01:39:48 GMT

Hi,

I am using Cisco 1812 as EZVPN server. I want to use Active directory for VPN user authentication. I am trying from couple of days but no success.

With ASA, i am able to authenticate against AD, but not with IOS router. Below are my configurations

aaa authentication login AD krb5

kerberos local-realm THECCIEGROUP.LOCAL

kerberos realm thecciegroup.local THECCIEGROUP.LOCAL

kerberos realm .thecciegroup.local THECCIEGROUP.LOCAL

kerberos server THECCIEGROUP.LOCAL 10.10.102.2

kerberos preauth encrypted-kerberos-timestamp

kerberos credentials forward

If kerberos authentication is not possible, I would like to know the possibility of using AD as ACS external database. I am running both AD and ACS in the same server. If i can integrate AD with ACS, i can use TACACS or RADIUS for the authentication.

Thanks&Regards,

Vamsi Pinnaka

Bangalore.

AD Authentication for Client VPN

Nicolas Darchis — Tue, 27 Dec 2011 12:47:53 GMT

I can answer from the ACS side.

Yes you can integrate ACS with AD and then the switch uses ACS like a radius server. ACS checks AD through kerberos in the backend, transparently.

If you have ACS 4.x running on a Windows PC being a member server of the domain, the integration is automatically done actually.

AD Authentication for Client VPN

Vamsi Pinnaka — Tue, 27 Dec 2011 13:05:22 GMT

Thanks for your reply. Better i will go with ACS with AD. I can have better authorization features with TACACS...

I will do this and let you know.....

Thanks&Regards,

Vamsi Pinnaka

Bangalore

AD Authentication for Client VPN

Vamsi Pinnaka — Thu, 29 Dec 2011 06:04:19 GMT

Working perfectly..... Successfully integrated AD with ACS external database..

Thanks&Regards

Vamsi Pinnaka

Bangalore