pix local authorization

[m.michalski]

Hi

I have question: Is it possible to configure local authorization for the remote clients ( IPSec VPN,PPTP) on pix 515E with software 6.3(1).

I would like to have it in order to avoid RADIUS installation or to buy ACS.

Maybe is it possible to do with 7.0.1 software.

Thanks in advance for any help.

Best

[sachinraja]

hi michal,

local authorization is possible with pix 6.3... you can have a look at the following URL:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/ab.htm#wp1157343

look for the command aaa authorization... you can have either LOCAL or TACACS authorization.. RADIUS is not an option !!!!

hope this helps.. all the best..

Raj

[m.michalski]

Hi Raj

Sorry, I should qualify my question.

I would like to configure a Cisco PIX firewall without a Radius authentication server so that clients can establish a VPN connection based on local authorization. In addition local authorization should be used to issue an access control list (ACL) name to be used to control what resources the individual VPN client is able to access.There is new feature in 7.0 software :Tunnel Groups, Group Policies etc. but I havn't tested yet. Maybe somebody has some experience with it.

[sachinraja]

Hi michal

i dont think its possible locally with a 6.3... am not really sure abouvt V7.0.. you can open a tac with cisco and find this out....

Raj

[alexr]

Hi,

Yes, local authorization is supported on PIX 6.3 version.

You can define them in several steps:

1. Define IP local pool for assigning IP addresses for remote VPN usrs.

2. Define access-list for VPN terminations.

3. Define nat (inside) 0 access-list name

4. Define access-list for split tunneling

5. Define isakmp and ipsec policies.

6. define vpn users via vpngroup command.

[steve.dutky]

Without aaa is there anyway to apply an acl to inbound VPN clients?

The example from 8-16 Cisco PIX Firewall and VPN Configuration Guide:

Step 6 Create access lists that define the services the VPN clients are authorized to use. The RADIUS server

returns this access list ID to enable authorization.

Note: Configure the authentication server with the vendor-specific acl=acl_ID identifier to specify the

access-list ID. In this example, the access-list ID is 100. The entry in the authentication server

would then be acl=100.