topic RADIUS authentication for VPN users in Network Access Control

RADIUS authentication for VPN users

whiteford — Fri, 21 Feb 2020 18:18:38 GMT

I'm trying to authenticate users on our VPN concentrator to use our Windows 2003 IAS RADIUS server but am having no luck.

If I goto Configuration > system > servers > authentication and test my Active Directory account it fails.

I am sure i have configured my IAS RADIUS server correctly, can anyone guide or help via this post or email?

let me know what info you need posted and I'll get straight back to you, I'm sure this can be done?

Re: RADIUS authentication for VPN users

r.docuyanan — Wed, 11 Jul 2007 15:44:27 GMT

Hi Whiteford, r u using ASDM, somewhere somehow the authentication will fail if you are using the Test button key , make sure

you add the domain with the username when you are testing

username@domain

password

give it a try

DOMAIN\user

password

Re: RADIUS authentication for VPN users

whiteford — Wed, 11 Jul 2007 18:13:31 GMT

Still no luck the test button still fails, is there a tool I can test RADIUS with? ADSM? I only use that for a PIX not a concentrator.

What info can I give you, or can you give me?

I just want to allow a certain Active Directory security group VPN access via ISA RADIUS.

Hope you can help

Re: RADIUS authentication for VPN users

j.vonk — Tue, 31 Jul 2007 08:39:12 GMT

Here's how i set it up (PIX and ASA):

Windows 2003 Ent. IAS

Radius Clients:

Address: Internal IP Adress

Protocol: RADIUS

Type: RADIUS Standard

Request must contain ... attribute: disabled

Shared Secret: examplekey

Remote Access Policies:

Name: VPN Device

Conditions: (all AND)

Day-and-Time-Restrictions matches: full week

Windows-Groups-Matches:

NAS-IP-Address matches:

PIX/ASA:

AAA Server Groups:

Server Group RADIUS:

Server Name:

Interface Name: Inside

Timeout: 5 sec's

Server Authentication Port: 1645

Server accounting port: 1646

Retry Interval: 10 sec's

Server Secret Key: examplekey

common password:

ACL Netmask Convert: Standard

Then when i select the Radius Server and click Test> Authentication i can successfully authenticate accounts which are member of the AD group specified for

For diverse reasons i use 2 IAS servers on our network, but you have to keep them in sync manually.

Kind regards, hope it helps

Re: RADIUS authentication for VPN users

Danilo Dy — Tue, 31 Jul 2007 12:41:38 GMT

I use 2003 AD/IAS for both ASA SSL and PIX IPSec VPN Client remote access but I haven't tried VPN Concentrator.

One setting to remember when creating account in 2003 AD, in the Dial-In tab under Remote Access Dial-in [or VPN] select "Allow Access", by default this is "Deny Access".