Re: PIX VPN Authentication

gparrish · ‎09-11-2003

Can someone tell me all the options for authenticating VPN users on the PIX (515e v6.31)? I dont see any way to do local user authentication based on the VPN client.

I know of the following options:

AAA using Tacacs

AAA using Radius

VPN Group with local password

Thanks,

Greg

mostiguy · ‎09-11-2003

What do you mean by "local user authentication based on the vpn client"? If you mean each user has a unique username and password, that was introduced in pix os 6.2 (maybe 6.3).

gparrish · ‎09-11-2003

Yes I mean that. In the normal Cisco IOS context you normally have like tacacs and local authentication choices so thanks for that bit of information! I will look into how to configure that. Just trying to figure out all the options so we can select one to use.

Thanks,

Greg

gfullage · ‎09-11-2003

Introduced in 6.3, you would do:

crypto map client authentication LOCAL

username password

You can have as many username/password entries as you like.

gparrish · ‎09-12-2003

Any idea how to configure the VPN Client with the username and password for authentication since it only accepts the Group and CA Certificate options?

Thanks,

Greg

l.mourits · ‎09-12-2003

Hi Greg,

You do not need to configure username and password within the client. Once the client tries to connect the user will be prompted to enter username and password. Only put in groupname and grouppassword and you'll be fine.

Kind regards,

Leo

gparrish · ‎09-12-2003

Okay so this provides even more authentication? You have to use the VPN Group and then you could also authenticate each user in addition to that?

Sounds like you have to use the VPN Group or a certificate at all times?

Thanks,

Greg

gfullage · ‎09-12-2003

Correct, user authentication is a 2nd level of authentication. You don't actually have to do it (just don't add in the two commands I mentioned previously), and then the client will get in simply with having the correct group name/password or certificate.

I would always use user authentication though, considering the group name/password or cert is stored on the PC all the time. If that PC gets stolen and you have no user authentication set up, the thief has open access into your network. The group name/password or cert authenticate the PC that is connecting, whereas the extra user authentication authenticates the person sitting at that PC.