Deploying ACS over a RSA ACE/Server

[mbilgrav]

Hi,

My current setup has a ACE/Server validation both SDI tokens and RADIUS on port udp/1812.

Now I want to have downloadable ACL in use with my VPN3000, and still have the users validated via SDI tokens.

So Can I install ACS over a RSA ACE/Server, and use RADIUS from RSA on port 1812 and use RADIUS from ACS on port 1645 at the same time ?

And if so, can I use the RADIUS auth on the VPN3000 group to use the SDI ? i.e. RADIUS used in group config, and ACS local user-db configured to use SDI, and at the return give a downloadalbe ACL to the VPN3000 for this given user.

[umedryk]

As far as I know, you cannot use Radius from RSA and from ACS on different ports simultaneously

[splinter1]

i have implemented at several locations RSA with ACS on the same server, where RADIUS was running on differing ports for each server. The ACS typically pulls from the RSA server as an external DB, as well as windows AD, or LDAP (and of course local).

this is particularly helpful during migrations or phased implementations where you want to move from simple RSA authentication to full AAA. also for those times where you have a pre-existing RSA deployment that you want to move over to AAA through ACS.

i'm unclear about what you are trying to do with the vpn3k auth, as far as what system is configured with what. however there is no reason why you cant just have the vpn3k pulling authen and author from the ACS who is in turn pulling authen from SDI.

later...

j...