VPN configuration

[csanchez]

I want to change the password for VPN access from outside to inside. What are the necessary steps to accomplish this safely?

Thanks in advance.

[sachinraja]

hi sanchez

are you using local or radius authentication ??? if it is local, you just need to change the group/user password on the pix...

vpngroup abcvpn password ****** (for changing group password)

username abc password xyzzzz (for changing the user password)

do let us know if you require some other info on this...

Raj

[csanchez]

How can I tell what exactly I am using? I see RADIUS and Local config lines and I am not sure what it exactly means.

Here is a portion of the config,

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

sysopt connection permit-ipsec

sysopt noproxyarp inside

crypto ipsec transform-set myset esp-des esp-md5-hmac

crypto dynamic-map dymap 10 set transform-set myset

crypto map mymap 10 ipsec-isakmp dynamic dymap

crypto map mymap client configuration address initiate

crypto map mymap client configuration address respond

crypto map mymap interface outside

isakmp enable outside

isakmp key *********** address 0.0.0.0 netmask 0.0.0.0

isakmp identity address

isakmp client configuration address-pool local bigpool outside

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption des

isakmp policy 20 hash md5

isakmp policy 20 group 2

isakmp policy 20 lifetime 86400

vpngroup vpn3 address-pool bigpool

vpngroup vpn3 dns-server 10.7.3.28

vpngroup vpn3 default-domain mydomain.org

vpngroup vpn3 idle-time 1800

vpngroup vpn3 password ***********

Thanks in advance.

[Patrick Iseli]

1.) To change the password in the VPN Group follow this example => Replace "NEWPASSWORD" with your new password in the example.

example:

enable

conf term

vpngroup vpn3 password NEWPASSWORD

# Do not save the change the settings until you have verified that everything is ok. Test with the VPN Client the connection.

If everytjing was ok, save it by typing:

ena

wr mem

2.) The TACACS and RADIUS config seems not to be active. This are default settings that you are seeing.

3.) If you have forgotten your passwords in the config you can revover them by coping the config from the PIX to a TFTP Server. This will show the PSK - Pre Shared VPN Key and the VPN Group password in clear text.

sincerely

Patrick

[csanchez]

Thanks Patrick