AD Authentication for Client VPN

[Vamsi Pinnaka]

Hi,

I am using Cisco 1812 as EZVPN server. I want to use Active directory for VPN user authentication. I am trying from couple of days but no success.

With ASA, i am able to authenticate against AD, but not with IOS router. Below are my configurations

aaa authentication login AD krb5

kerberos local-realm THECCIEGROUP.LOCAL

kerberos realm thecciegroup.local THECCIEGROUP.LOCAL

kerberos realm .thecciegroup.local THECCIEGROUP.LOCAL

kerberos server THECCIEGROUP.LOCAL 10.10.102.2

kerberos preauth encrypted-kerberos-timestamp

kerberos credentials forward

If kerberos authentication is not possible, I would like to know the possibility of using AD as ACS external database. I am running both AD and ACS in the same server. If i can integrate AD with ACS, i can use TACACS or RADIUS for the authentication.

Thanks&Regards,

Vamsi Pinnaka

Bangalore.

[Nicolas Darchis · Accepted solution]

I can answer from the ACS side.

Yes you can integrate ACS with AD and then the switch uses ACS like a radius server. ACS checks AD through kerberos in the backend, transparently.

If you have ACS 4.x running on a Windows PC being a member server of the domain, the integration is automatically done actually.

[Vamsi Pinnaka]

Thanks for your reply. Better i will go with ACS with AD. I can have better authorization features with TACACS...

I will do this and let you know.....

Thanks&Regards,

Vamsi Pinnaka

Bangalore

[Vamsi Pinnaka]

Working perfectly..... Successfully integrated AD with ACS external database..

Thanks&Regards

Vamsi Pinnaka

Bangalore