topic Re: different AAA server groups with PIX 6.3 in Network Security

different AAA server groups with PIX 6.3

Richard Bradfield — Mon, 11 Mar 2019 09:55:13 GMT

we are doing some testing with a new Radius server, and want a specific VPNgroup to access this new Server,

with PIX release 7.0 this can be done as the Crypto map xxx client authentication-server command is not used and the authentication server is added to the vpngroup.

BUT how is this done with PIX release 6.3 as the"crypto map xxx client authentication determines which AAA server group to use.

Is there anyway round this on release 6.3

Re: different AAA server groups with PIX 6.3

mfreijser — Tue, 03 Apr 2007 10:42:48 GMT

You can create multiple aaa-server groups with a maximum of 14 RADIUS servers each.

To use more than one RADIUS server:

First create multiple aaa-server groups, each defining a different RADIUS server

Then you assign the server-group to the crypto map with the command "crypto map client authentication "

You can find the exact commands in the Pix Firewall Command Reference found here:

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_reference_book09186a008017284e.html

Please rate if the post helps!

Regards,

Michael

Re: different AAA server groups with PIX 6.3

Richard Bradfield — Tue, 03 Apr 2007 23:04:56 GMT

yes done all that, I have a number of server groups setup.

the trouble is that the "crypto map client authentication " is like a global command and affects all VPN groups, it does not allow you to select a different server-group for each vpngroup

as I say this is not a problem with ver 7.0 it looks like will have to upgrade to 7.0 to get this to work.

Re: different AAA server groups with PIX 6.3

David White — Wed, 04 Apr 2007 03:00:24 GMT

Yes, you are correct. What you want to do is not possible in 6.x.

Sincerely,

David.