vpn authentication

eppiet — Fri, 21 Feb 2020 18:09:13 GMT

Is there a way to allow different vpn group using different client authentication methods. eg one being LOCAL and the other one RADIUS.

Thanks

Eppie

Re: vpn authentication

awaheed — Sat, 31 Jan 2004 20:44:55 GMT

Hi Eppie,

As the Auth method is decided at the "Crypto map" level and not at the "vpngroup" level:

As the commands for AAA on PIX are: (using tacacs)

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ (inside) host 10.0.0.2 secret123

aaa-server database protocol LOCAL (using local)

And then once we define the AAA commands then they are attached to the Crypto map as:

crypto map partner-map client authentication TACACS+

crypto map partner-map interface outside

(when using local database)

crypto map partner-map client authentication database

crypto map partner-map interface outside

So there is no way to use BOTH the LOCAL and the TACACS/RADIUS at the sametime and you can only have one or the other.

For further reading:

Hope this helps,

Regards,

Aamir

-=-=-