cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3153
Views
0
Helpful
2
Replies
Explorer

AnyConnect clients failing auth - Using local auth instead of RADIUS

I'm trying to set up RADIUS authentication for AnyConnect users using a Windows NPS server. The authentication is working from the ASA fine:

 

ASA# test aaa-server authentication RADIUS username mmurray password $

Server IP Address or name: 10.10.2.2

INFO: Attempting Authentication test to IP address <10.10.2.2> (timeout: 12 seconds)

INFO: Authentication Successful

 

But when I try to connect via AnyConnect it looks like the ASA is not using RADIUS but just the local user database instead:

 

AAA user authentication Rejected : reason = User was not found : local database : user = ***** : user IP = 

 

What am I missing?

 

ASA# sh run aaa

aaa authentication ssh console LOCAL

aaa authentication match aaa-auth inside RADIUS

 

ASA# sh run aaa-server

aaa-server RADIUS protocol radius

aaa-server RADIUS (inside) host 10.10.2.2

key *****

 

ASA# sh run tunnel-group

 

tunnel-group employeegroup type remote-access

tunnel-group employeegroup general-attributes

address-pool remoteaccessvpn

authentication-server-group (inside) RADIUS

default-group-policy employeegroup

tunnel-group employeegroup webvpn-attributes

group-alias employeegroup enable

tunnel-group employeegroup ipsec-attributes

ikev1 pre-shared-key *****

 

ASA# sh run webvpn

webvpn

enable outside

anyconnect image disk0:/anyconnect-win-4.1.02011-k9.pkg 1

anyconnect image disk0:/anyconnect-macosx-i386-4.1.02011-k9.pkg 2

anyconnect enable

cache

  disable

error-recovery disable

Everyone's tags (3)
1 ACCEPTED SOLUTION

Accepted Solutions
VIP Advocate

Re: AnyConnect clients failing auth - Using local auth instead of RADIUS

I think you are missing the following:


webvpn
  tunnel-group-list enable

Without this, the ASA will use the DefaultWebvpnGroup as the default tunnel group for any inbound connections. Your AAA authentication is set for the employeegroup tunnel-group only.

2 REPLIES 2
VIP Advocate

Re: AnyConnect clients failing auth - Using local auth instead of RADIUS

I think you are missing the following:


webvpn
  tunnel-group-list enable

Without this, the ASA will use the DefaultWebvpnGroup as the default tunnel group for any inbound connections. Your AAA authentication is set for the employeegroup tunnel-group only.

Highlighted
Explorer

Re: AnyConnect clients failing auth - Using local auth instead of RADIUS

Also changed the following:

 

authentication-server-group (inside) RADIUS

 

to:

 

authentication-server-group (outside) RADIUS

 

This the interface where the tunnel terminates.