Can't authenticate Mac VPN client from RADIUS server

cbonthron · ‎02-21-2006

Hello,

I'm a real noob here so please bear with me.

I have been able to configure my PIX 515E to allow VPN connections onto my network, but what I need to do is set up some sort of user authentication to control access at a user level. From what I've read here and in the Configuration Guide I should be able to do this authentication with a RADIUS server. I'm running a Corriente Networks Elektron Security server which has RADIUS server capabilities. It is running on my (inside) interface at IP 192.168.10.26.

I thought that I had everything configured properly but it never seems to authenticate. I connect, the XAUTH window pops up, I add my username and password as it's configured on my RADIUS server, but when I click OK it just cycles the progress bar at the bottom and eventually times out. The client log doesn't show me anything and the log on the RADIUS server shows me nothing. Any ideas? this seems like it should be simple because I can connect until I attempt to authenticate to the RADIUS server.

TIA for any direction you can provide me.

Christine

cbonthron · ‎02-21-2006

If it helps, here is my config with a some of the non-related bits deleted:

interface ethernet0 auto

interface ethernet1 auto

interface ethernet2 auto

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 DMZ security50

enable password ********* encrypted

passwd ******* encrypted

hostname pixfirewall

domain-name acme.com

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol http 80

fixup protocol http 82

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

access-list inside_outbound_nat0_acl permit ip any 192.168.10.0 255.255.255.0

access-list inside_outbound_nat0_acl permit ip host 192.168.10.26 192.168.10.192 255.255.255.224

access-list inside_outbound_nat0_acl permit ip host 192.168.10.69 192.168.10.192 255.255.255.224

access-list outside_cryptomap_dyn_20 permit ip any 192.168.10.0 255.255.255.0

access-list outside_cryptomap_dyn_40 permit ip any 192.168.10.192 255.255.255.224

mtu outside 1500

mtu inside 1500

mtu DMZ 1500

ip address outside 207.XXX.XXX.130 255.255.255.0

ip address inside 192.168.10.1 255.255.255.0

ip address DMZ 192.168.100.1 255.255.255.0

multicast interface inside

ip audit info action alarm

ip audit attack action alarm

ip local pool CBI_VPN_Pool 192.168.10.201-192.168.10.220

pdm location 192.168.10.50 255.255.255.255 inside

pdm group CBI_Servers inside

pdm logging warnings 100

pdm history enable

arp timeout 14400

global (outside) 200 interface

global (DMZ) 200 interface

nat (inside) 0 access-list inside_outbound_nat0_acl

nat (inside) 200 192.168.10.0 255.255.255.0 0 0

static (inside,outside) 207.XXX.XXX.150 192.168.10.27 netmask 255.255.255.255 0 0

static (inside,outside) 207.XXX.XXX.132 192.168.10.26 dns netmask 255.255.255.255 0 0

access-group 100 in interface outside

route outside 0.0.0.0 0.0.0.0 207.XXX.XXX.129 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server radius-authport 1812

aaa-server radius-acctport 1812

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server RADIUS (inside) host 192.168.10.26 ************* timeout 10

aaa-server LOCAL protocol local

http server enable

http 192.168.10.3 255.255.255.255 inside

no floodguard enable

sysopt connection permit-ipsec

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-DES-MD5

crypto dynamic-map outside_dyn_map 40 match address outside_cryptomap_dyn_40

crypto dynamic-map outside_dyn_map 40 set transform-set ESP-DES-MD5

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map client authentication RADIUS

crypto map outside_map interface outside

crypto map inside_map interface inside

isakmp enable outside

isakmp nat-traversal 3600

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption des

isakmp policy 20 hash md5

isakmp policy 20 group 2

isakmp policy 20 lifetime 86400

vpngroup Test_VPN address-pool CBI_VPN_Pool

vpngroup Test_VPN dns-server 142.77.2.101 142.77.2.36

vpngroup Test_VPN default-domain acme.com

vpngroup Test_VPN idle-time 1800

vpngroup Test_VPN authentication-server RADIUS

vpngroup Test_VPN user-authentication

vpngroup Test_VPN user-idle-timeout 1200

vpngroup Test_VPN password ********

ssh timeout 5

console timeout 0

dhcpd address 192.168.10.100-192.168.10.254 inside

dhcpd dns 142.77.2.101 142.77.2.36

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd auto_config outside

dhcpd enable inside

bjames · ‎03-13-2006

What does this do?

access-group 100 in interface outside

cbonthron · ‎03-14-2006

"access-group 100 in interface outside"

No luck with that.

Thanks though.