Re: vpn authentication

eppiet · ‎01-30-2004

Is there a way to allow different vpn group using different client authentication methods. eg one being LOCAL and the other one RADIUS.

Thanks

Eppie

awaheed · ‎01-31-2004

Hi Eppie,

As the Auth method is decided at the "Crypto map" level and not at the "vpngroup" level:

As the commands for AAA on PIX are: (using tacacs)

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ (inside) host 10.0.0.2 secret123

or

aaa-server database protocol LOCAL (using local)

And then once we define the AAA commands then they are attached to the Crypto map as:

crypto map partner-map client authentication TACACS+

crypto map partner-map interface outside

or

(when using local database)

crypto map partner-map client authentication database

crypto map partner-map interface outside

So there is no way to use BOTH the LOCAL and the TACACS/RADIUS at the sametime and you can only have one or the other.

For further reading:

Hope this helps,

Regards,

Aamir

-=-=-