Alex,
That is exactly what I have setup at my current work place.
I have a pair of VPN concentrator 3030 running in load-sharing mode.
Both the External and Internal interfaces are connected to the
Firewall for extra protection. IPSec traffics are allowed through
the firewall to terminate at the cluster IP address of the VPN
concentrator. Once IPsec is decrypted by the Concentrator, it goes
back into the firewall for inspection and access for maximum
security and access-control
We have two different groups of remote access users, both use
the same pre-share key. One group is "admin", the other group
is "normal" users. The "admin" group uses RSA SecurID for remote access
authentication. The "normal" group uses Steelbelt Radius
for remote access authentication. We use profile on the radius to
control IP pool that will be assign to "admin" and "normal" group.
In other words, if a user belong to "admin", he will get ip address
from pool_A and the firewall will allow unlimited access to pool_A.
A user belong to "normal" group will get ip address from pool_B.
Firewall will restrict access from pool_B to certain resources.
This is done by the Radius server returning the attributes back
to the user such as IP address and other things.
It is a very simple to setup. I will post the link tomorrow.
We decided to go with RSA SecurID and Juniper Steelbelted radius
because both of these run on Linux and not windows.
"I'm not trying to authenticate users' admission into the groups, I'm trying to authenticate the users themselves"
This is what Cisco referred to as "extended"
authentication. I think that what you meant
as "Admission into the groups is via credentials stored in the client's profile".
This is referred to vpngroup and pre-share
key.
CCIE Security
