Anyconnect Radius Server

[keithcclark71]

The battle continues. I setup remote user VPN for AAA using Radius. I have an FTD that is SiteA IPSEC tunneled to SITEB where the radius server is. However when I establish Anyconnect to SiteA it prompts me for username and password which I provide but fails. I setup the gateway FTD .1 in SiteA ipaddress to be a radius client and double checked my settings in Network policy Server etc.  Is there any commands to check radius communication in the CLI ? I cant ping from the FTD to the radiues server but from a host behind the FTD I can ping it over the tunnel.

[MHM Cisco World]

From ftd to radius if acl of ipsec not allow ftd ip then traffic drop.

So what you need 

Add acl in both site 

Site a

Acl for traffic from vpn pool to radius server 

Site b

Acl for traffic from radius to vpn pool 

Try this way.

[keithcclark71]

I never get an IP address from the pool.  I believe that getting an IP from the pool would only happenonce authentication completes. It seems as though I am not even reaching the Radius server that is in SITEB when trying to Anyconnect VPN into SITEA.  I am trying to authenticate to the radius in SITEB over the SiteA to Site B S2S Tunnel.  I can ping the radius server from site A host but if I SSH into the FTD at SITEA I cannot ping or verify that I can reach the  Radius server in SiteB. 

[MHM Cisco World]

do you config VPN POOL in SiteA ?
If yes 
and you use policy based VPN then 
ACL allow VPN POOL SUBNET -> Radius Server IP 

note the ACL must be mirror.

any connect not get IP ?
I know the any connect get IP after pass the auth, but FW use the first IP form VPN POOL to connect to Radius.

[keithcclark71]

Cant authenticate anyconnect VPN into SiteA using Radius in SiteB here is the scenario

Anyconnect IP Pool is configured in SiteA (SiteAVPNPool) 192.168.101.50-150

Tunnel between SiteA and SiteB is up (Hosts in SiteA can ping Hosts in SiteB and vice versa)
SitaA (FTD1010)protected networks Inside 192.168.5.0/24 and SiteAVPNPool 192.168.101.0/24
SiteB (ASA 5505) protected networks Inside 192.168.1.0/24 

NPS Radius Server 192.168.1.5 Shared Key cisco
Client FTD 192.168.5.1 (SiteA FTD) Shared Key cisco 
I have verified shared key is same (Cisco is just an example)

NAT SIteA FTD and SiteB (Nat in place and working as can ping internal hosts from both ends of tunnel)

SiteAVPNPool

Static(FTD1010) Source Inside Dest Any Original source 192.168.5.0/24 Original Destinations 192.168.101.0/24 Trans Source 192.168.5.0/24 Trans destinations 192.168.101.0/24

SiteB (ASA 5505) Static Source inside original source 192.168.1.0/24 original  Destinations 192.168.101.0/24  Original Source 192.168.1.0/24 Original Destinations 192.168.101.0/24

FTD1010 Outside ACL SiteA Allow all outside Inside Source 192.168.101.0/24 Destination 192.168.5.0/24 192.168.1.0/24 
Inside ACL SiteA Allow all inside 192.168.1.0/24

ASA Outside ACL SiteB Allow 192.168.101.0/24 192.168.1.0
Inside ACL SiteB  Allow 192.168.1.0/24 192.168.101.0/24

For whatever Reason I cannot ping any FTD interfaces sourced from the ASA inside \outside interfaces over the tunnel . This is also the case for the FTD it cannot ping the radius server at 192.168.1.5 using any interface. I have no way to see if the FTD is able to source a radius requestto the radius server. It seems to me the FTD should be able to ping and same with ASA coming back. I also see no arp entries for anything on tunnel end

[MHM Cisco World]

can you share the config if ASA?

[Aref Alsouqi]

When you say sourcing from the inside/outside interface, are you referring to the keyword you can use with the ping command, example "ping inside 192.168.1.5"? if so, that command just tells the firewall where to send the traffic, down which interface, it does not really use that interface as the source. The FTD would use its management interface to send the RADIUS traffic, so you should add the the management interfaces IP addresses to the encryption domain access list, apply the NAT exemption, and add the management interfaces IP addresses to the NPS server as the clients. With regard to pinging the NPS from the outside interface, that won't work as that traffic will not be sent inside the VPN tunnel, if you want that to happen, again, you should add the outside interface IP address to the encryption domain access list, but it is not really recommended nor required in your case.

[Mohammed al Baqari]

This is not very accurate. Radius won't go through management. It will go
through the configured interface and in this case it is using the inside
interface which won't work and will be dropped by rpf.

[MHM Cisco World]

aaa-server AAA-SERVER (inside) host x.x.x.x <<-
are you config this ??

[keithcclark71]

It is FTD not ASA. I am replacing ASA 5505's  with FTD 1010 so only way I can have anyconnect work for each tail site is having individual radius at each location or I can use radius at one site so long as the tail sites have a site to site tunnel established to the radius server hosted site which I prefer to do as tail sites are not domain systems and the radius server i am trying to use is domain controller. 

[Mohammed al Baqari]

Hi,

Because the NPS server is at SiteB, you can't source radius traffic from
FTD inside interface. This won't work. The radius traffic from FTD
should be sourced from outside interface because it will follow the routing
table (you should be having a route on the FTD for siteB subnet pointing to
the outside interface or following the default route).

Configure the FTD on NPS using outside interface and allow communication
between FTD outside and NPS over the crypto ACLs, NAT, etc.

This should get it working.

***** please remember to rate useful posts

[keithcclark71]

With it sourced from the outside it would go through the VPN tunnel then to the other end then NAT should take it from there. I believe that's how I had it at one time and didn't work. Is there anyway to test radius communication from the FTD cli?

[Mohammed al Baqari]

Hi,

You should exempt it from NAT at the other end which it's using the outside
interface. If you are using the inside interface, it won't work and will be
dropped by rpf.

Go to CLISH, system support diag, and from there use test aaa command

***** please remember to rate useful posts