Are attributes needed for cisco vpn 3005

Question

Hey all,
I am trying to setup radius authentication for my cisco 3005. I am using
BM 3.8sp3 radius. I have it setup (or at least i can us NTradping and
authenticate to it).
I goto 3005 and add radius server as authentication server. When I try to
test it, I get the follow message on the concentrator:
Authentication Rejected: Access hours restrictions in effect
Looking at the debug screen of the radius server, all has succeeded. Is
there a profile that I need to setup and any attributes to assign to get
this to work?
Thanks
Matt

Answer 1

I found the answer to my last question, you do need xauth for radius
> I think I found it. To test authentication I think it uses the base
group.
> I did have a time restriction on their.
>
> Now for another question: I am testing certificate based authentication
> and it is working (Using a Novell CA). To get radius authentication to
> work in conjunction with that. Do I need to use an SA that uses
> Certificates and XAuth?
>
> Thanks
> Matt
>
> > [email protected] schreef:
> > > I don't have any time restrictions in place. But just in case I set
> som=
> > e=20
> > > up and applied those and I still get the same message.
> > >=20
> > > I applied the access time to both a group and the individual user.
> My=20
> > > question I have is where would those be applied seeing that the
user
> is=
> > =20
> > > being authenticated via an external reference.
> > >=20
> > > Thanks
> > > Matt
> > >=20
> >
> > Matt,
> >
> > Try to test with a user not a group, make sure you don't have any
time=20
> > restrictions on the NDS user and also no Policy Management on your=20
> > concentrator.
> >
> > > I applied the access time to both a group and the individual user.
> > In the vpn concentrator?
> >
> > > My question I have is where would those be applied seeing that
the=20
> > user is
> > > being authenticated via an external reference.
> >
> > Radius authentication uses the NDS (well you can configure this
also=20
> > otherwise as a radius proxy..).
> > When configure the nds user with logon restrictions, I'm pretty
sure=20
> > that you wont be able to acces your network through the concentrator.
> >
> > If you want to restrict the acces to your vpn concentrator than you
have
> =
> >
> > to use the policy base mangement of your vpn concentrator.
> >
> > You can set acces hours to the groups created on the vpn
concentrator,=20
> > and throug radius you can sent attributes that will be used to
indentify
> =
> >
> > which group the user will be put in when the user authenticating to
> the=20
> > vpn concentrator.
> >
> > Hope this makes sense....
> >
> > gl,
> >
> > Louis G=F6hl
>