Hi Everyone, I recently began using Radius for our networks to authenticate Cisco Console Logins, and VPN Connection Requests (anyconnect), which has been working great. Our network isn't huge (3 ASA5505's with site to site VPNs, 1 site with a Wireless AP). I would like to setup our Wireless Access Point to have (1) SSID that authenticates users via Radius (to Windows NPS on our Domain Controller). I have a Windows Security Group called "Wireless Users" setup and I want users to be able to login to the Wireless using their AD account. We do not have multiple VLANs or anything complicated. I am unable to find a solution for this on Autonomous IOS Version 12.4, and was wondering if anyone could assist. Thank you!! (config below) version 12.4 no service pad service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname xxxx-AP ! enable secret xxxxxxxxxxxxxxxx ! aaa new-model ! ! aaa group server radius radius-admin server-private 192.168.12.2 auth-port 1812 acct-port 1813 key xxxxxxxxxxxxxxxx ! aaa authentication login userAuthent group radius-admin local aaa authorization exec userAuthor local group radius-admin if-authenticated ! aaa session-id common no ip domain lookup ip domain name xxxxxxxxxxx ! ! login block-for 60 attempts 3 within 30 dot11 syslog ! ! dot11 ssid ssid1 authentication open authentication key-management wpa version 2 guest-mode wpa-psk ascii xxxxxxxxxxxxxxxx ! power inline negotiation prestandard source ! crypto pki trustpoint TP-self-signed-########### enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-########### revocation-check none rsakeypair TP-self-signed-############ ! ! username admin privilege 15 secret xxxxxxxxxxxxxxxx ! ! bridge irb ! ! interface Dot11Radio0 no ip address no ip route-cache ! encryption mode ciphers aes-ccm ! broadcast-key change 3600 ! ! ssid ssid1 ! antenna gain 0 station-role root bridge-group 1 bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding bridge-group 1 spanning-disabled ! interface Dot11Radio1 no ip address no ip route-cache ! encryption mode ciphers aes-ccm ! broadcast-key change 3600 ! antenna gain 0 dfs band 3 block mbssid channel dfs station-role root bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding bridge-group 1 spanning-disabled ! interface GigabitEthernet0 no ip address no ip route-cache duplex auto speed auto bridge-group 1 no bridge-group 1 source-learning bridge-group 1 spanning-disabled ! interface BVI1 ip address 192.168.12.254 255.255.255.0 no ip route-cache ! ip http server no ip http secure-server ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag ip radius source-interface BVI1 ! access-list 1 permit 192.168.0.0 0.0.255.255 no cdp run bridge 1 route ip ! ! banner login ^CC xxxxxxxxx - AUTHORIZED ACCESS ONLY ^C ! line con 0 logging synchronous line vty 0 4 access-class 1 in authorization exec userAuthor login authentication userAuthent transport input ssh line vty 5 15 access-class 1 in authorization exec userAuthor login authentication userAuthent transport input ssh ! end ... View more

(EDIT: Sorry for the double post) Hi all, I recently re-configured our central ASA5505, and re-setup the Remote Access VPN Configuration, and I am having difficulty passing traffic. Some background -- We have 1 central site, that connects to 2 spokes (Simple Hub & spoke topology), and they are connected with L2L tunnels and all 3 sites can pass traffic OK on the L2L tunnels. Site 1 (Hub) is 192.168.9.0/24 Site 2 (spoke) is 192.168.12.0/24 Site 3 (spoke) is 192.168.14.0/24 RA Vpn pool is 192.168.99.0/25 Here's the problem -- I can get the Cisco VPN Client on my remote PC to connect OK, and statistics shows that packets are being encrypted AND bypassed (split tunneling is setup), but NOTHING is being decrypted!! I need to figure out why. I had one other person try connect, and they get the same thing. Hub Config::: ASA Version 8.0(2) ! hostname xxxx-HUB domain-name xxxxxx ! interface Vlan1 nameif inside security-level 100 ip address 192.168.9.1 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address xx.xx.xx.xx 255.255.255.248 ! interface Vlan3 nameif inet security-level 50 ip address 10.10.0.1 255.255.255.0 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 description TO ACCESS POINT switchport trunk allowed vlan 1,3 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! ftp mode passive clock timezone CST -6 clock summer-time CDT recurring dns domain-lookup inside dns server-group DefaultDNS name-server 192.168.9.2 name-server 192.168.12.2 name-server 8.8.8.8 domain-name xxxxx same-security-traffic permit intra-interface access-list to_spoke1 extended permit ip 192.168.0.0 255.255.0.0 192.168.12.0 255.255.255.0 access-list 101 extended permit icmp any any access-list split standard permit 192.168.0.0 255.255.0.0 access-list to_spoke2 extended permit ip 192.168.0.0 255.255.0.0 192.168.14.0 255.255.255.0 access-list RTP extended permit udp any any range 10000 20000 access-list RTP extended permit tcp any any range 10000 20000 access-list sip extended permit tcp any any range sip 5061 access-list sip extended permit udp any any range sip 5061 access-list sip extended permit udp any any eq 3000 access-list sip extended permit tcp any any eq 3000 access-list nonat extended permit ip 192.168.0.0 255.255.0.0 192.168.0.0 255.255.0.0 pager lines 24 logging enable logging monitor debugging logging asdm informational mtu inside 1500 mtu outside 1500 mtu inet 1500 ip local pool RA-Pool 192.168.99.1-192.168.99.126 mask 255.255.255.128 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-61551.bin no asdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list nonat nat (inside) 1 0.0.0.0 0.0.0.0 nat (inet) 1 0.0.0.0 0.0.0.0 route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout uauth 0:05:00 absolute dynamic-access-policy-record DfltAccessPolicy aaa authentication ssh console LOCAL http server enable http 192.168.0.0 255.255.0.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set ESP-AES-SHA esp-aes esp-sha-hmac crypto dynamic-map dyn1 1 set transform-set ESP-AES-SHA crypto dynamic-map dyn1 1 set reverse-route crypto map outside_map 10 match address to_spoke1 crypto map outside_map 10 set peer xx.xx.xx.xx crypto map outside_map 10 set transform-set ESP-AES-SHA crypto map outside_map 11 match address to_spoke2 crypto map outside_map 11 set peer xx.xx.xx.xx crypto map outside_map 11 set transform-set ESP-AES-SHA crypto map outside_map 999 ipsec-isakmp dynamic dyn1 crypto map outside_map interface outside crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption aes hash sha group 2 lifetime 86400 telnet timeout 5 ssh 192.168.0.0 255.255.0.0 inside ssh xx.xx.xx.xx 255.255.255.255 outside ssh timeout 5 console timeout 0 management-access inside dhcpd auto_config outside ! dhcpd address 192.168.9.101-192.168.9.199 inside dhcpd dns 192.168.9.2 192.168.12.2 interface inside dhcpd lease 20000 interface inside dhcpd domain xxxxx interface inside dhcpd enable inside ! dhcpd address 10.10.0.100-10.10.0.199 inet dhcpd dns 208.67.222.222 8.8.8.8 interface inet dhcpd enable inet ! priority-queue inside tx-ring-limit 256 priority-queue outside tx-ring-limit 256 threat-detection basic-threat threat-detection statistics port threat-detection statistics protocol threat-detection statistics access-list ! class-map inspection_default match default-inspection-traffic class-map voice match access-list sip ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map type inspect sip default_sip parameters max-forwards-validation action drop log policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect netbios inspect rtsp inspect sip default_sip inspect icmp policy-map qos class voice priority ! service-policy global_policy global service-policy qos interface inside service-policy qos interface outside webvpn group-policy Company-RA internal group-policy Company-RA attributes dns-server value 192.168.9.2 192.168.12.2 split-tunnel-policy tunnelspecified split-tunnel-network-list value split default-domain value xxxxxxx address-pools value RA-Pool username vpnuser1 password xxxxxxx encrypted privilege 3 username vpnuser1 attributes vpn-group-policy Company-RA vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn username vpnuser2 password xxxxxx encrypted privilege 15 username vpnuser2 attributes vpn-group-policy Company-RA vpn-access-hours none vpn-simultaneous-logins 3 vpn-idle-timeout 30 vpn-session-timeout none vpn-filter none vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn password-storage disable group-lock none username admin password xxxxxxxx encrypted privilege 15 username admin attributes service-type admin username steve password xxxxxx encrypted privilege 3 <<< Account being used to test username steve attributes vpn-group-policy Company-RA tunnel-group xx.xx.xx.xx type ipsec-l2l tunnel-group xx.xx.xx.xx ipsec-attributes pre-shared-key * tunnel-group xx.xx.xx.xx type ipsec-l2l tunnel-group xx.xx.xx.xx ipsec-attributes pre-shared-key * tunnel-group Company-RA type remote-access tunnel-group Company-RA general-attributes address-pool RA-Pool default-group-policy Company-RA tunnel-group Company-RA ipsec-attributes pre-shared-key * prompt hostname context I realize the other spoke configs may be relevant, but at this time I am just trying to pass traffic to the 192.168.9.0/24 (Hub) Network, which I am unable to do so far. Any help is greatly appreciated! Thanks! ... View more

Hello all. I have setup a few trunks before between Cisco ASA5505 and CISCO 1252 access points, with no problem... However this one will not work for some reason, and I have been unable to find out why.. If I put the port into Access Mode, I am able to access the Access Point's Management Interface on the Native Vlan (1), but once I enable Trunking Mode on the port, all communication stops. The goal is to provide a trunk for 2 VLANS running on 2 SSID's.   EDIT: I did notice that the "switchport trunk native vlan " command is missing on this ASA5505 (only gives option for switchport trunk allowed), it does seem to appear in other versions. Is there a command I am missing somewhere to make this work?   Please help!!!   ASA5505: ASA Version 8.0(2) Licensed features for this platform: Maximum Physical Interfaces  : 8 VLANs                        : 20, DMZ Unrestricted Inside Hosts                 : Unlimited Failover                     : Active/Standby VPN-DES                      : Enabled VPN-3DES-AES                 : Enabled VPN Peers                    : 25 WebVPN Peers                 : 2 Dual ISPs                    : Enabled VLAN Trunk Ports             : 8 Advanced Endpoint Assessment : Disabled This platform has an ASA 5505 Security Plus license.   Switching Config: interface Vlan1  nameif inside  security-level 100  ip address 192.168.9.1 255.255.255.0 ! interface Vlan2  nameif outside  security-level 0  ip address xxxxxxxxxxxx 255.255.255.248 ! interface Vlan3  nameif inet  security-level 50  ip address 10.10.0.1 255.255.255.0 ! interface Ethernet0/0  switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4  description TO ACCESS POINT  switchport trunk allowed vlan 1,3  switchport mode trunk ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7     ACCESS POINT CONFIG: Cisco IOS Software, C1250 Software (C1250-K9W7-M), Version 12.4(10b)JDA3, RELEASE SOFTWARE (fc1) dot11 ssid INET    vlan 3    authentication open    authentication key-management wpa version 2    mbssid guest-mode    wpa-psk ascii 7 xxxxxxxxxxxxxxxxxxxxxxx ! dot11 ssid Inside    vlan 1    authentication open    authentication key-management wpa version 2    mbssid guest-mode    wpa-psk ascii 7 xxxxxxxxxxxxxxxxxxxxxx ! dot11 ssid Inside-5g    vlan 1    authentication open    authentication key-management wpa version 2    mbssid guest-mode    wpa-psk ascii 7 xxxxxxxxxxxxxxx ! interface Dot11Radio0  no ip address  no ip route-cache  !  !  encryption vlan 1 mode ciphers aes-ccm  !  encryption vlan 3 mode ciphers aes-ccm  !  broadcast-key change 3600  !  !  ssid INET  !  ssid Inside  !  mbssid  channel 2437  station-role root ! interface Dot11Radio0.1  encapsulation dot1Q 1 native  no ip route-cache  bridge-group 1  bridge-group 1 subscriber-loop-control  bridge-group 1 block-unknown-source  no bridge-group 1 source-learning  no bridge-group 1 unicast-flooding  bridge-group 1 spanning-disabled ! interface Dot11Radio0.3  encapsulation dot1Q 3  no ip route-cache  bridge-group 3  bridge-group 3 subscriber-loop-control  bridge-group 3 block-unknown-source  no bridge-group 3 source-learning  no bridge-group 3 unicast-flooding  bridge-group 3 spanning-disabled ! interface Dot11Radio1  no ip address  no ip route-cache  !  encryption mode ciphers aes-ccm  !  encryption vlan 1 mode ciphers aes-ccm  !  broadcast-key change 3600  !  !  ssid Inside-5g  !  dfs band 3 block  mbssid  channel dfs  station-role root ! interface Dot11Radio1.1  encapsulation dot1Q 1 native  no ip route-cache  bridge-group 1  bridge-group 1 subscriber-loop-control  bridge-group 1 block-unknown-source  no bridge-group 1 source-learning  no bridge-group 1 unicast-flooding  bridge-group 1 spanning-disabled ! interface GigabitEthernet0  no ip address  no ip route-cache  duplex auto  speed auto ! interface GigabitEthernet0.1  encapsulation dot1Q 1 native  no ip route-cache  no cdp enable  bridge-group 1  no bridge-group 1 source-learning  bridge-group 1 spanning-disabled ! interface GigabitEthernet0.3  encapsulation dot1Q 3  no ip route-cache  no cdp enable  bridge-group 3  no bridge-group 3 source-learning  bridge-group 3 spanning-disabled ! interface BVI1  ip address 192.168.9.254 255.255.255.0  no ip route-cache ! interface BVI3  ip address 10.10.0.254 255.255.255.0  no ip route-cache ... View more