Authenticating with a PIX 501 via MS Windows IAS

jackdobiash · ‎09-27-2004

Hello! I have a question regarding our Cisco PIX 501 that we recently purchased and are attempting to make work. What my ultimate goal is to have the user connect to the box over a IPSec VPN connection, and have their authentication take place via a Windows 2000 IAS server. In every instance that I try it, the client connects to the pix, it asks for additional authentication, and after giving it it just sits there. Now, on the IAS server log, it does show that the user was successfully granted, but it never seems to make it back to the PIX box. I have tried this with the Cisco VPN Client (v4.6) and the built in Microsoft PPTP and IPSec Client and they both do the same thing. I know that connectivity is possible, because as soon as I tell it to use the local database (or just use the vpngroup) it works fine. Any thoughts? Here is how it is layed out: Thanks!

Jack Dobiash

Confederated Tribes of Grand Ronde

VPN Client

|

(public Internet)

PIX Box (NAT Enabled Firewall)

(private Network)

|

IAS Server

Config on Pix Box

-----------------

PIX Version 6.3(3)

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

hostname vpntest

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list inside_outbound_nat0_acl permit ip any 10.0.100.128 255.255.255.128

access-list outside_cryptomap_dyn_20 permit ip any 10.0.100.128 255.255.255.128

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside xxx.xxx.xx.xx 255.255.255.240

ip address inside 10.0.10.50 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

ip local pool vpnpool 10.0.100.129-10.0.100.254

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list inside_outbound_nat0_acl

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

route outside 0.0.0.0 0.0.0.0 xxx.xxx.xx.xx 1

route inside 10.0.0.0 255.0.0.0 10.0.10.1 1

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server RADIUS (inside) host 10.10.10.18 radiusclient timeout 10

aaa-server LOCAL protocol local

floodguard enable

sysopt connection permit-ipsec

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map client authentication RADIUS

crypto map outside_map interface outside

isakmp enable outside

isakmp identity address

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption 3des

isakmp policy 20 hash md5

isakmp policy 20 group 2

isakmp policy 20 lifetime 86400

vpngroup vpngroup address-pool vpnpool

vpngroup vpngroup dns-server 10.10.10.18

vpngroup vpngroup wins-server 10.10.10.18

vpngroup vpngroup idle-time 1800

vpngroup vpngroup password ********

vpdn username User1 password *********

jmia · ‎09-27-2004

Jack,

The following document should help you out for authentication via RADIUS for your vpn clients:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00800b6099.shtml

Hope this helps.

Jay

jackdobiash · ‎09-28-2004

Thanks for the reply, however, I guess I should have also stated in my original message that I have already gone through this entire forum looking for the answer, and ran across this and other links for how to setup IAS and such. As far as I can tell, the config is sound. As I said before, the authentication makes it to the IAS server, the IAS server shows that it accepts it (by showing a Granted in the log), but that request never makes it back to the PIX box. When I turn debugging on the PIX box, it shows it waiting for the Authentication, but never seems to get it, I have also seen this very same problem posted in a couple other threads, but no one ever seems to reply with an answer, but it does show that others do seem to be having the same problem.

If someone who has a sucessful setup of Windows 2000 IAS and a PIX box could perhaps post their config, or find a problem with my own config, that would be greatly appreciated. Thanks!

jackdobiash · ‎09-28-2004

hahaha.. it never fails. I research a problem for a long time, try everything I can think of, and then after I go and post a message about it in the forums I figure it out :)

Apparently, the IAS server needs to be on the same Subnet as the PIX box for it to work properly. Even though the PIX box and IAS server were able to talk to each other through a router, for some reason the responses weren't getting back through it properly. Freaky eh? I hope this can help someone else who may be having the same problem.