topic Re: PIX VPN Authentication in Network Access Control

PIX VPN Authentication

gparrish — Fri, 21 Feb 2020 18:08:20 GMT

Can someone tell me all the options for authenticating VPN users on the PIX (515e v6.31)? I dont see any way to do local user authentication based on the VPN client.

I know of the following options:

AAA using Tacacs

AAA using Radius

VPN Group with local password

Thanks,

Greg

Re: PIX VPN Authentication

mostiguy — Fri, 12 Sep 2003 00:50:53 GMT

What do you mean by "local user authentication based on the vpn client"? If you mean each user has a unique username and password, that was introduced in pix os 6.2 (maybe 6.3).

Re: PIX VPN Authentication

gparrish — Fri, 12 Sep 2003 01:06:08 GMT

Yes I mean that. In the normal Cisco IOS context you normally have like tacacs and local authentication choices so thanks for that bit of information! I will look into how to configure that. Just trying to figure out all the options so we can select one to use.

Thanks,

Greg

Re: PIX VPN Authentication

gfullage — Fri, 12 Sep 2003 05:04:21 GMT

Introduced in 6.3, you would do:

crypto map client authentication LOCAL

username password

You can have as many username/password entries as you like.

Re: PIX VPN Authentication

gparrish — Fri, 12 Sep 2003 12:34:54 GMT

Any idea how to configure the VPN Client with the username and password for authentication since it only accepts the Group and CA Certificate options?

Thanks,

Greg

Re: PIX VPN Authentication

l.mourits — Fri, 12 Sep 2003 13:22:41 GMT

Hi Greg,

You do not need to configure username and password within the client. Once the client tries to connect the user will be prompted to enter username and password. Only put in groupname and grouppassword and you'll be fine.

Kind regards,

Leo

Re: PIX VPN Authentication

gparrish — Fri, 12 Sep 2003 21:34:08 GMT

Okay so this provides even more authentication? You have to use the VPN Group and then you could also authenticate each user in addition to that?

Sounds like you have to use the VPN Group or a certificate at all times?

Thanks,

Greg

Re: PIX VPN Authentication

gfullage — Sat, 13 Sep 2003 00:07:37 GMT

Correct, user authentication is a 2nd level of authentication. You don't actually have to do it (just don't add in the two commands I mentioned previously), and then the client will get in simply with having the correct group name/password or certificate.

I would always use user authentication though, considering the group name/password or cert is stored on the PC all the time. If that PC gets stolen and you have no user authentication set up, the thief has open access into your network. The group name/password or cert authenticate the PC that is connecting, whereas the extra user authentication authenticates the person sitting at that PC.