Doesn't avpairs have to do with TACAS? Trying to figure out what exatly you mean here:
else, you may need to configure your NTDOMAIN as a user on IAS. And you > > have to define you tunnel-id as a user on IAS as well. Can you explain that a little further? Thanks > > ----- Original Message ----- > From: "YAVUZ TEMIZKAN" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Monday, March 08, 2004 1:00 PM > Subject: Re: [FW-1] Cisco VPN concentrator > > > > Seems like the radius avpairs for VPN client are not defined on the IAS. > > You may have to do it manually. > > > > > > Check out this link: > > http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_user_guid > > e_chapter09186a0080102172.html#984410 > > > > else, you may need to configure your NTDOMAIN as a user on IAS. And you > > have to define you tunnel-id as a user on IAS as well. > > > > > > -----Original Message----- > > From: Security Guy [mailto:[EMAIL PROTECTED] > > Sent: Monday, March 08, 2004 6:04 PM > > To: [EMAIL PROTECTED] > > Subject: Re: [FW-1] Cisco VPN concentrator > > > > Without the IAS server users can authenticate. > > > > Here are the login attempts: [scroll down, 2 different attempt are > > logged] > > > > 1. > > logging in as testd00d > > using domain ID\password > > > > 46205 03/08/2004 10:53:25.110 SEV=5 IKEDBG/64 RPT=650 1.1.1.1 [end user > > IP] > > IKE Peer included IKE fragmentation capability flags: > > Main Mode: True > > Aggressive Mode: False > > > > 46207 03/08/2004 10:53:25.490 SEV=5 IKE/172 RPT=729 1.1.1.1 [end user > > IP] > > Group [basegroupname] > > Automatic NAT Detection Status: > > Remote end IS behind a NAT device > > This end is NOT behind a NAT device > > > > 46211 03/08/2004 10:53:34.710 SEV=3 AUTH/5 RPT=116 1.1.1.1 [end user IP] > > Authentication rejected: Reason = Unspecified > > handle = 234, server = radiusserver, user = testd00d, domain = <not > > specified> > > > > 2. > > logging in as DOMAIN\testd00d > > using domain ID\password > > > > 6216 03/08/2004 10:55:17.210 SEV=5 IKE/172 RPT=730 1.1.1.1 [end user IP] > > Group [basegroupname] > > Automatic NAT Detection Status: > > Remote end IS behind a NAT device > > This end is NOT behind a NAT device > > > > 46220 03/08/2004 10:55:28.770 SEV=3 AUTH/5 RPT=117 1.1.1.1 [end user IP] > > Authentication rejected: Reason = Unspecified > > handle = 236, server = radiusserver, user = testd00d, domain = NTDOMAIN > > > > > > > > ----- Original Message ----- > > From: "YAVUZ TEMIZKAN" <[EMAIL PROTECTED]> > > To: <[EMAIL PROTECTED]> > > Sent: Monday, March 08, 2004 10:20 AM > > Subject: Re: [FW-1] Cisco VPN concentrator > > > > > > > Cisco VPN concentrator supports local authentication as well as > > radius. > > > Did you try and succeed in authentication with local usernames? > > > If the login request can reach the IAS and get an error, the problem > > may > > > be because of the domain. > > > Every user has a domain on the VPN concentrator ( depending on which > > > they get the split-tunnel routing info and IP addresses) and this > > domain > > > should be authenticated as well. > > > For example if the username is [EMAIL PROTECTED] , then both [EMAIL PROTECTED] > > > and > > > cisco has to be configured on the IAS. And user cisco has unlimited > > > simultaneous login rights.(That means more than one user can > > > authenticate with user cisco at the same time) > > > > > > > > > -----Original Message----- > > > From: Security Guy [mailto:[EMAIL PROTECTED] > > > Sent: Monday, March 08, 2004 4:45 PM > > > To: [EMAIL PROTECTED] > > > Subject: Re: [FW-1] Cisco VPN concentrator > > > > > > Yes, I've got that covered. It's currently set as the primary DNS > > > server. > > > I checked again this morning I am able to resolve the radius server by > > > name > > > and IP. > > > > > > Should have checked this before, it looks like the login requests are > > > reaching the radius server. I'm going to review the logs. It's > > looking > > > more > > > and more like a config issue on the IAS [radius server] > > > > > > > > > ----- Original Message ----- > > > From: "Horst Moll" <[EMAIL PROTECTED]> > > > To: <[EMAIL PROTECTED]> > > > Sent: Monday, March 08, 2004 8:47 AM > > > Subject: Re: [FW-1] Cisco VPN concentrator > > > > > > > > > > Hi, > > > > > > > > do you have an internal DNS server? If so, check if there is an > > > appropriate entry for your radius > > > > server. > > > > We have a similar configuration, but we are using an internal DNS > > > Server. > > > > :-)Horst > > > > > > > > Security Guy wrote: > > > > > Internet Internet > > > > > | | > > > > > Router Cisco VPN concentrator > > > > > | | {internal nic} > > > > > Firewall--------dmz-------| | > > > > > | | > > > > > | | > > > > > |--------------internal LAN----------------|------| > > > > > radius server > > > > > > > > > > > > > > > > > > > > Ok this one is a little off topic, but related non the less > > > > > > > > > > Problem: > > > > > Cisco VPN concentrator will not pass authentication requests to > > our > > > radius server > > > > > > > > > > Configs: > > > > > Cisco VPN concentrator, configured with two interfaces. One with > > a > > > pubic IP, another with an internal private IP. The radius server is > > > Microsoft's version "IAS" [running on a w2k server] The domain is NT > > 4. > > > The > > > radius server and internal nic of the concentrator are on the same > > > internal > > > subnet. > > > > > > > > > > Attempts/Symptoms > > > > > Cisco has a great guide on their site which deals with components > > > mentioned, the guide has been followed and checked twice. From the > > > concentrator I can ping the radius server by name and by IP. While > > > watching > > > login attempts on the concentrator I see it trying and failing to > > reach > > > the > > > radius server by name. BUT nowhere in the concentrator conifgs is the > > > radius server defined by name, IP only. > > > > > > > > > > Questions: > > > > > 1. How is the radius server aware of the domain? what can be done > > > to > > > verify this connection? > > > > > 2. How can I tell where authentication requests are getting > > stopped? > > > > > 3. Regarding the positioning of both the concentrator and radius > > > server, > > > aside from placing the concentrator in the DMZ is the current > > placement > > > considered 'secure' [from what I understand the concentrator is a mix > > > between a PIX and hardened router] Finally is the radius server > > > positioned > > > correctly on our internal LAN? > > > > > > > > > > Thanks! > > > > > > > > > > ================================================= > > > > > To set vacation, Out-Of-Office, or away messages, > > > > > send an email to [EMAIL PROTECTED] > > > > > in the BODY of the email add: > > > > > set fw-1-mailinglist nomail > > > > > ================================================= > > > > > To unsubscribe from this mailing list, > > > > > please see the instructions at > > > > > http://www.checkpoint.com/services/mailing.html > > > > > ================================================= > > > > > If you have any questions on how to change your > > > > > subscription options, email > > > > > [EMAIL PROTECTED] > > > > > ================================================= > > > > > > > > > > > > > -- > > > > :-)Horst Moll (Dipl.-Ing. TH) > > > > IT Sicherheitsberater > > > > ______________________________________________________ > > > > > > > > BDG GmbH & Co. KG - Make IT safe. > > > > Stollberger Str. 307 > > > > D-50933 Koeln > > > > > > > > Tel: +49 (0)221-954231-0 > > > > direkt: +49 (0)221-954231-41 > > > > mobil: +49 (0)163-54231-41 > > > > Fax: +49 (0)221-954231-31 > > > > > > > > E-Mail: [EMAIL PROTECTED] > > > > Web: www.bdg.de > > > > PGP Fingerprint: F012 EBD9 8872 A00B E444 659C 5B64 C172 A126 B78F > > > > _____________________________________________________ > > > > > > > > > ************************************************************************ > > > **** > > > ************ > > > > > > > > Besuchen Sie uns auf der Cebit, 18.03.-24.03.2004 in Hannover, in > > der > > > > > > > > Software Security Area, auf dem TREND MICRO Stand Halle 6, Stand G20 > > > > > > > > Sichern Sie sich gleich Ihren Besuchstermin unter > > > > > > > > http://www.bdg.de/anmeld_cebit.html > > > > > > > > > > > > > ************************************************************************ > > > **** > > > ************ > > > > > > > > ================================================= > > > > To set vacation, Out-Of-Office, or away messages, > > > > send an email to [EMAIL PROTECTED] > > > > in the BODY of the email add: > > > > set fw-1-mailinglist nomail > > > > ================================================= > > > > To unsubscribe from this mailing list, > > > > please see the instructions at > > > > http://www.checkpoint.com/services/mailing.html > > > > ================================================= > > > > If you have any questions on how to change your > > > > subscription options, email > > > > [EMAIL PROTECTED] > > > > ================================================= > > > > > > > > > > ================================================= > > > To set vacation, Out-Of-Office, or away messages, > > > send an email to [EMAIL PROTECTED] > > > in the BODY of the email add: > > > set fw-1-mailinglist nomail > > > ================================================= > > > To unsubscribe from this mailing list, > > > please see the instructions at > > > http://www.checkpoint.com/services/mailing.html > > > ================================================= > > > If you have any questions on how to change your > > > subscription options, email > > > [EMAIL PROTECTED] > > > ================================================= > > > > > > ================================================= > > > To set vacation, Out-Of-Office, or away messages, > > > send an email to [EMAIL PROTECTED] > > > in the BODY of the email add: > > > set fw-1-mailinglist nomail > > > ================================================= > > > To unsubscribe from this mailing list, > > > please see the instructions at > > > http://www.checkpoint.com/services/mailing.html > > > ================================================= > > > If you have any questions on how to change your > > > subscription options, email > > > [EMAIL PROTECTED] > > > ================================================= > > > > > > > ================================================= > > To set vacation, Out-Of-Office, or away messages, > > send an email to [EMAIL PROTECTED] > > in the BODY of the email add: > > set fw-1-mailinglist nomail > > ================================================= > > To unsubscribe from this mailing list, > > please see the instructions at > > http://www.checkpoint.com/services/mailing.html > > ================================================= > > If you have any questions on how to change your > > subscription options, email > > [EMAIL PROTECTED] > > ================================================= > > > > ================================================= > > To set vacation, Out-Of-Office, or away messages, > > send an email to [EMAIL PROTECTED] > > in the BODY of the email add: > > set fw-1-mailinglist nomail > > ================================================= > > To unsubscribe from this mailing list, > > please see the instructions at > > http://www.checkpoint.com/services/mailing.html > > ================================================= > > If you have any questions on how to change your > > subscription options, email > > [EMAIL PROTECTED] > > ================================================= > > ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
