JAAS to RSA RADIUS Server

I need to write a JAAS module that will validate passwords against an RSA RADIUS Server (via RSA's Authentication Manager).
I'm not seeing the sort of api's I saw when I did a similar module for Siteminder, so a couple of questions:
- Is there a Java API for RSA Authentication Manager? (I'm not finding one on their website or via Google)
- If I need to use a RADIUS client what's the best (open source) choice?
Thanks in advance-- Mike

If I got your right, they provide you a RADIUS Server, so you don't need a special API. just go on sourceforge (www.sf.net) and try one of the available java radius client APIs to do the authentication as a proxy between your user and the RADIUS server.
I wrote a very simple one back in 2001 for the authentication against a RADIUS server only and not a full implmenetation of standard, but I think now on sf you will find much more mature ones.

Similar Messages

  • Using RSA RADIUS Server and WLC 7.4 to dynamically asssign users to VLAN

    Hello,
    What we are trying to do:
    John logs on to wifi using RSA fob for password. RSA sends back auth request with attibutes to WLC 7.4 that magically knows how to interpret the attributes and puts John on vlan 10. Mary logs on with her fob and gets put on VLAN 20.
    We dont have ISE. We dont have ACS. We have RSA Authentication Manager 7.0
    We have looked high and low for documentation for this kind of setup and we find stuff that is close to a match but not quite.
    Here is what we are seeing
    1. dynamic vlan assignment is not working -- radius server is set with the attributes
    2. RSA authentication works
    3. John and Mary are always put into the VLAN where the MGMT interface is
    4. I can see that attributes are making it back to the WLC by sniffing
    We are stuck at this point. Any help would be much appreciated,
    P.

    Here is a little more background:
    We have created a dynamic interface in VLAN 157
    Wireless LAN has been assigned to MGMT interface which is on VLAN 35
    This is a VWLC ver 7.4.100
    AP is attached to VWLC (only FlexConnect mode is supported)
    RADIUS Server has been configured
    Users are getting assigned to VLAN 35
    Also I have attached some screenshots and two packet captures so you can see what the RSA is sending back with your own eyes
    I dont see any atttributes in the capture when RSA sends to the VWLC
    I see attributes in the capture when RSA send to my local RADIUS Client (My PC)
    And to answer your question we have sending a VLAN ID (157)

  • 2106 and RSA RADIUS

    I have a 2106 wireless controller set up along with a 1252 access point. I am able to authenticate to the AP via WPA-PSK without issue. However when I configure authentication to use our RSA RADIUS server it fails with several error messages. I am confident the RADIUS server is set up properly because we have been using it to authenticate to your routers/switches for the past year.
    Here are the error messages I receive in the controllers logs:
    DOT1X-3-ABORT_AUTH: Authentication Aborted
    DOT1X-3-AAA_SEND_FAILURE: Unable to send AAA message for client <mac address>
    DOT1X-3-MAX_EAP_RETRIES: Max EAP identity request retries (3) exceeded for client <mac address>
    AAA-4-RADIUS_RESPONSE_FAILED: RADIUS server <ip address> failed to respond to request (IDxx) for STA <mac address> / user 'unknownUser'
    Looking at the accounting logs on the RADIUS server also show that the devices MAC is being sent as the UserName, which doesn't seem right to me which may be the issue but I'm unsure how to fix it, especially since I don't have MAC filtering turned on.
    I am trying to authenticate with a MacBook Pro running 10.5.2.

    Well having no luck going to my RADIUS server directly from the WLC I decided to try using our test ACS server in the mix. I configured it to talk to the RSA RADIUS server and reconfigured to the WLC to talk to the ACS server.
    Except for not selecting the proper protocols I authenticated without a hitch using a token code on an XP machine with the Cisco client.
    I then fired up the Mac and it authenticated properly with no issues as well, and even gave me the option to say it was a one time password. I thought I read elsewhere that one time passwords weren't supported? Well apparently they are now.

  • Rsa/ace server radius authentication

    Hi ,
    I am in the process of setting up cisco routers/swithces to authenticate to an RSA/ACE radius server. Basically I would like it to work as follows.
    SSH/Telnet to router switch.I have ace side configured. I have added the necessary users to authenticate list on agent host.
    Username:joebloggs
    Password : ( rsa secure id token here ). Do I have to authenticate then using enable password or what is best practice here ??
    router>en
    router#
    I have the following lines added so far and need some help on the aaa authentication as there seems to be a lot of options
    aaa new-model
    aaa authentication banner # Connection to this device is for authorized users only #
    aaa authentication fail-message # You are not authorized to log on to this device #
    radius-server host x.x.x.x auth-port 1645 acct-port 1813
    radius-server retransmit 3
    radius-server key xxxxxx

    francis
    if you want users who telnet/SSH to vty ports or who are on the console to authenticate with the radius server you should add something like this to your configuration:
    aaa authentication login default group radius line
    This will send an authentication request to the configured radius server and if there is an error from the radius server (this is different from a negative response) then the router will authenticate using the configured line password. This will work for both telnet and SSH connections and for login from the console.
    You are correct that there are quite a few optional parameters. These are to allow flexibility in what is the primary authentication method and what (if any) fall back methods you wish to use.
    From user mode going to enable mode you could configure the router to use the enable password/enable secret or you can configure it to use radius. I believe that best practice is to use radius rather than the local enable password/enable secret.
    aaa authentication enable default group radius enable
    HTH
    Rick

  • OTP of ASDM using external radius server ( Not RSA )

    Hello,
    Just seeing if the ASDM will support OTP using an external radius server, and not RSA.  I see there was a feature added to 8.2 that states its possible with RSA, but nothing of any other support.  Just checking to see if someone know for sure.
    Thanks,
    Jason

    I did see in the Release notes for ASDM 6.2, that SDI is support with RSA.  Can anyone confirm or not if it works with Radius too ( OTP ).
    http://www.cisco.com/en/US/docs/security/asdm/6_2/release/notes/asdmrn62.html

  • ACS5.2 with Radius to RSA token server

    I have a test lab with the eval version of ACS5.2. I am running 802.1x on my switch to the ACS usinf radius and want to use my RSA token server to authenticate my users. I have setup my RSA server under "Radius Identiny Servers" in the external identity stores section of the ACS5.2. I have only selected this RSA server in access policies -> identity. When I plug in my 802.1x enabled laptop into the switch I can see the packets going to my ACS but I cannot see any communication from my ACS to the RSA server. And the error I get in the ACS is 22056 Subject not found in the applicable identity store(s). . It works fine with AD. Any reason why the ACS is not talking to the RSA token server?

    It looks like the RSA token server is not one of the identity stores used by the authentication policies you set up, I would start troubleshooting by looking at them and see what identity store or identity store sequence they are using.

  • Authenticated on ISE 1.2 (as admin) against an external radius server

    Hello
    Our customer wants to be authenticated on ISE 1.2 (as admin) against an external radius server (like ACS not microsoft). How could i do that ?
    Is it possible while retaining internal admin users database in a sequence "external_radius or internal"
    thank you in advance.
    Best regards

    External authentication is supported only with internal authorization:
    External Authentication + Internal Authorization
    When configuring Cisco ISE to provide administrator authentication using an external RSA SecurID identity store, administrator credential authentication is performed by the RSA identity store. However, authorization (policy application) is still done according to the Cisco ISE internal database. In addition, there are two important factors to remember that are different from External Authentication + External Authorization:
    You do not need to specify any particular external administrator groups for the administrator.
    You must configure the same username in both the external identity store and the local Cisco ISE database.
    To create a new Cisco ISE administrator that authenticates via the external identity store, complete the following steps:
    Step 1 Choose Administration > System > Admin Access > Administrators > Local Administrators.
    The Administrators window appears, listing all existing locally defined administrators.
    Step 2 Follow the guidelines at Creating a New Cisco ISE Administrator to ensure that the administrator username on the external RSA identity store is also present in Cisco ISE. Be sure to click the External option under Password.
    Note Remember: you do not need to specify a password for this external administrator user ID, nor are you required to apply any specially configured external administrator group to the associated RBAC policy.
    Step 3 Click Save .

  • ACS 4.0 and RSA Token Server problem

    Hi,
    We are having a problem trying to get ACS 4.0 for Windows to authenticate wireless users on an RSA Token server.
    Our Cisco 1200 series AP is configured for WPA2 and LEAP authentication. It points at the ACS server for RADIUS authentication. Now this works fine for users with a static password defined on the ACS internal database. However, for obvious security reasons, we?d like the authentication passed to our internal RSA server.
    I have installed the RSA Agent on the same server as the ACS along (after adding the generated sdconf.rec file to the System32 folder). The RSA server has been added to the ACS external databases and a user configured to use the RSA Token server for password.
    When we try to authenticate, the ACS fails the attempt with reason ?External DB password invalid?. The same user can successfully authenticate when using the RSA test authentication tool which is installed on the ACS server as part of the RSA Agent software.
    After running some debugs on a PIX in front of the servers, I can see traffic to/from the servers when using the test tool (which works), however it looks like ACS doesn?t even send traffic to the RSA server when authenticating.
    Any help or advice appreciated.
    Thanks

    Hi,
    The token servers only support PAP. Please make sure that the request are going to the RSA in PAP.
    Following link talks about the same.
    http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs40/user/o.htm#wp824733
    Regards,
    ~JG

  • Access denied when ssh in window server 2008 after set it as radius server

    yesterday i succeed to use aaa to login and can see aaa in sh aaa session
    https://murison.wordpress.com/2010/11/11/cisco-radius-configuration-with-server-2008-r2/
    today i simulate again, it access denied, do not know where is wrong
    win 192.168.2.12 ---  switch 192.168.2.5 --- 192.168.2.1 R1
    R1
    conf t
    hostname router1
    int FastEthernet0/0
    ip address 192.168.2.1 255.255.255.0
    no shut
    end
    conf t
    ip route 192.168.2.0 255.255.255.0 192.168.2.5
    end
    enable
    configure terminal
    enable secret cisco
    end
    conf t
    aaa new-model
    username radiusclient privilege 15 password 0 cisco
    crypto key generate rsa
    ip ssh time-out 60
    ip ssh version 2
    line vty 0 4
    transport input ssh
    exit
    line vty 5 15
    transport input ssh
    exit
    ip domain-name radius1.local
    radius-server host 192.168.2.12
    radius-server key cisco
    aaa group server radius NPSSERVER
    server 192.168.2.12
    exit
    aaa authentication login default group NPSSERVER local
    aaa authorization exec default group NPSSERVER local
    exit
    R2
    conf t
    vlan 10
    int vlan 10
    ip address 192.168.2.5 255.255.255.0
    end
    conf t
    hostname router2
    int FastEthernet1/0
    switchport
    switchport access vlan 10
    switchport mode access
    shutdown
    no shut
    end
    conf t
    hostname router2
    int FastEthernet1/1
    switchport
    switchport access vlan 10
    switchport mode access
    shutdown
    no shut
    end
    conf t
    hostname router2
    int FastEthernet1/2
    switchport
    switchport access vlan 10
    switchport mode access
    shutdown
    no shut
    end
    R3
    conf t
    hostname router3
    int FastEthernet0/0
    ip address 192.168.2.7 255.255.255.0
    no shut
    end
    conf t
    ip route 192.168.2.0 255.255.255.0 192.168.2.5
    end

    Hi,
    The configuration looks fine. What do you see in radius server as the reason for authentication failure?
    Regards,
    Kanwal
    Note: Please mark answers if they are helpful.

  • Wireless WPA2 + AD + RSA ACE Server possible

    I have a client that wants to use WPA2 authenticated to the Windows Active Directory and also has an RSA ACE Server. The goal os to provide 802.1x security with these 3 devices. I am NOT looking to USE the RSA tokens for this, only the underlying RSA RADIUS service to authenticate clients. Is this possible or do I also need a ACS server?
    The alternative is to use Wireless WPA2 + AD + Windows IAS RADIUS.
    Thanks for any comments,
    Chris Serafin
    Security Engineer
    [email protected]

    Hi Chris,
    I don't think you can use the RSA's radius server without using tokens. If you are looking to authenticate to Active Directory then either use Wireless + IAS + AD or use Wireless + ACS + AD
    There will be no need to bring the RSA into the solution.

  • ISE 1.2 Patch 2 External RADIUS Server Sequence Broken?

    Hi community,
    We have upgraded our proof of concept ISE 1.2 lab to Patch level 2.
    Our lab design includes the use of external RADIUS servers which we off-load certain authentication rules to.
    To ensure resiliency of the external RADIUS service, we have two of these which we add to a RADIUS Server Sequence, the idea being that if the first in the list is unavailable, ISE will try the second and all will be well.
    Now this worked for us in testing ISE 1.2, but I have noticed that after the upgrade to Patch 2 ISE is sending the majority RADIUS traffic to the first (failed) external RADIUS server, with only the odd RADIUS Access-Request to thte next in the list.
    Anybody else come across this??
    All helpful comments rated!
    Many thanks, Ash.

    I couldn't find any known issues with this feature. Could you please paste the screen shot of external radius sequence and configuration. Also, how are we determing that the first server in the sequence is DEAD?
    ~BR
    Jatin Katyal
    **Do rate helpful posts**

  • EAP-FAST on Local Radius Server : Can't Get It Working

    Hi all
    I'm using an 877w router (flash:c870-advsecurityk9-mz.124-24.T4.bin) as local radius server and have followed various config guides on CCO. LEAP works fine but I just can't get EAP-FAST to work.
    I'm testing with win7 client using anyconnect secure mobility client, and also a mac book pro but without luck.
    the router sees unknown auth type, and when I run some debugs it talks of unknown eap type 3
    sh radius local-server s
    Successes              : 1           Unknown usernames      : 0        
    Client blocks          : 0           Invalid passwords      : 0        
    Unknown NAS            : 0           Invalid packet from NAS: 17      
    NAS : 172.27.44.1
    Successes              : 1           Unknown usernames      : 0        
    Client blocks          : 0           Invalid passwords      : 0        
    Corrupted packet       : 0           Unknown RADIUS message : 0        
    No username attribute  : 0           Missing auth attribute : 0        
    Shared key mismatch    : 0           Invalid state attribute: 0        
    Unknown EAP message    : 0           Unknown EAP auth type  : 17       
    Auto provision success : 0           Auto provision failure : 0        
    PAC refresh            : 0           Invalid PAC received   : 0       
    Can anyone suggest what I might be doing wrong?
    Regs, Tim

    Thanks Nicolas, relevant snippets from config:
    aaa new-model
    aaa group server radius rad_eap
    server 172.27.44.1 auth-port 1812 acct-port 1813
    aaa authentication login eap_methods group rad_eap
    aaa authorization exec default local
    aaa session-id common
    dot11 ssid home
    vlan 3
    authentication open eap eap_methods
    authentication network-eap eap_methods
    authentication key-management wpa
    ip dhcp pool home
       import all
       network 192.168.1.0 255.255.255.0
       default-router 192.168.1.1
       dns-server 194.74.65.68 194.74.65.69
    ip inspect name ethernetin tcp
    ip inspect name ethernetin udp
    ip inspect name ethernetin pop3
    ip inspect name ethernetin ssh
    ip inspect name ethernetin dns
    ip inspect name ethernetin ftp
    ip inspect name ethernetin tftp
    ip inspect name ethernetin smtp
    ip inspect name ethernetin icmp
    ip inspect name ethernetin telnet
    interface Dot11Radio0
    no ip address
    encryption vlan 1 mode ciphers aes-ccm tkip
    encryption vlan 2 mode ciphers aes-ccm tkip
    encryption vlan 3 mode ciphers aes-ccm tkip
    broadcast-key vlan 1 change 30
    broadcast-key vlan 2 change 30
    broadcast-key vlan 3 change 30
    ssid home
    speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
    station-role root
    interface Dot11Radio0.3
    encapsulation dot1Q 3
    no cdp enable
    bridge-group 3
    bridge-group 3 subscriber-loop-control
    bridge-group 3 spanning-disabled
    bridge-group 3 block-unknown-source
    no bridge-group 3 source-learning
    no bridge-group 3 unicast-flooding
    interface Vlan3
    no ip address
    bridge-group 3
    interface BVI3
    ip address 192.168.1.1 255.255.255.0
    ip inspect ethernetin in
    ip nat inside
    ip virtual-reassembly
    radius-server local
    no authentication mac
    nas 172.27.44.1 key 0 123456
    user test1 nthash 0 B151E8FF684B4F376C018E632A247D84
    user test2 nthash 0 F2EEAE1D895645B819C9FD217D0CA1F9
    user test3 nthash 0 0CB6948805F797BF2A82807973B89537
    radius-server host 172.27.44.1 auth-port 1812 acct-port 1813 key 123456
    radius-server vsa send accounting

  • ISE 1.1.1 (Fallback to local Vlan if radius server is found to be dead) not working

    We have configured following commands on switch to fallback to local Vlan if both radius server (policy persona's) is found dead. For test purpose we shutdown both servers (policy persona's) but fallback didn't work. We have 3750 switch running image 12.2(55)SE6 having following configuration.
    We do not know whether we configured switch in proper way or do we need to modify it.
    aaa new-model
    aaa authentication dot1x default group radius
    aaa authorization network default group radius
    aaa authorization auth-proxy default group radius
    aaa accounting update periodic 5
    aaa accounting auth-proxy default start-stop group radius
    aaa accounting dot1x default start-stop group radius
    aaa accounting system default start-stop group radius
    aaa server radius dynamic-author
    client 10.10.10.10 server-key 7 12345678 (Policy Persona 1)
    client 10.10.10.11 server-key 7 12345678 (Policy Persona 2)
    server-key 7 12345678
    ip device tracking
    epm logging
    radius-server attribute 6 on-for-login-auth
    radius-server attribute 6 support-multiple
    radius-server attribute 8 include-in-access-req
    radius-server attribute 25 access-request include
    radius-server dead-criteria time 30 tries 3
    radius-server host 10.10.10.10 auth-port 1812 acct-port 1813 key 7 12345678 (Policy Persona 1)
    radius-server host 10.10.10.11 auth-port 1812 acct-port 1813 key 7 12345678 (Policy Persona 2)
    radius-server vsa send accounting
    radius-server vsa send authentication
    Port Configuration
    interface GigabitEthernet0/1
    switchport access vlan 305
    switchport mode access
    ip access-group ACL-DEFAULT in
    authentication event fail action next-method
    authentication event server dead action reinitialize vlan 305
    authentication event server alive action reinitialize
    authentication host-mode multi-auth
    authentication open
    authentication order mab dot1x
    authentication priority dot1x mab
    authentication port-control auto
    authentication periodic
    authentication timer reauthenticate server
    mab
    dot1x pae authenticator
    dot1x timeout tx-period 10
    spanning-tree portfast
    Please help....
    Thanks

    Tabish-
    The pre-auth ACL that you have on your port is used for what's called a "Low-Impact" mode type of setup. With Low-Impact mode you are allowing services defined in the pre-auth ACL until the user/devices is authenticated. Once authenticated the pre-auth ACL gets replaced with the dACL/authorization policy that you have defined in the authorization profile. As a result, it is not possible to use "fail-open" configuration with low-impact as there is nothing to replace that pre-auth ACL since your NAD device(s) are unavailable.
    If you want to use the "fail-open" features you will have to use the "High Securty/Closed Mode." In that mode you cannot utilize the pre-auth ACL and essentially only EPoL traffic is allowed on port until authenticated.
    For more info you should reference the TrustSec design guide located at:
    http://www.cisco.com/en/US/solutions/ns340/ns414/ns742/ns744/landing_DesignZone_TrustSec.html
    Thank you for rating!

  • Can't authenticate Mac VPN client from RADIUS server

    Hello,
    I'm a real noob here so please bear with me.
    I have been able to configure my PIX 515E to allow VPN connections onto my network, but what I need to do is set up some sort of user authentication to control access at a user level. From what I've read here and in the Configuration Guide I should be able to do this authentication with a RADIUS server. I'm running a Corriente Networks Elektron Security server which has RADIUS server capabilities. It is running on my (inside) interface at IP 192.168.10.26.
    I thought that I had everything configured properly but it never seems to authenticate. I connect, the XAUTH window pops up, I add my username and password as it's configured on my RADIUS server, but when I click OK it just cycles the progress bar at the bottom and eventually times out. The client log doesn't show me anything and the log on the RADIUS server shows me nothing. Any ideas? this seems like it should be simple because I can connect until I attempt to authenticate to the RADIUS server.
    TIA for any direction you can provide me.
    Christine

    If it helps, here is my config with a some of the non-related bits deleted:
    interface ethernet0 auto
    interface ethernet1 auto
    interface ethernet2 auto
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    nameif ethernet2 DMZ security50
    enable password ********* encrypted
    passwd ******* encrypted
    hostname pixfirewall
    domain-name acme.com
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol http 80
    fixup protocol http 82
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    access-list inside_outbound_nat0_acl permit ip any 192.168.10.0 255.255.255.0
    access-list inside_outbound_nat0_acl permit ip host 192.168.10.26 192.168.10.192 255.255.255.224
    access-list inside_outbound_nat0_acl permit ip host 192.168.10.69 192.168.10.192 255.255.255.224
    access-list outside_cryptomap_dyn_20 permit ip any 192.168.10.0 255.255.255.0
    access-list outside_cryptomap_dyn_40 permit ip any 192.168.10.192 255.255.255.224
    mtu outside 1500
    mtu inside 1500
    mtu DMZ 1500
    ip address outside 207.XXX.XXX.130 255.255.255.0
    ip address inside 192.168.10.1 255.255.255.0
    ip address DMZ 192.168.100.1 255.255.255.0
    multicast interface inside
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool CBI_VPN_Pool 192.168.10.201-192.168.10.220
    pdm location 192.168.10.50 255.255.255.255 inside
    pdm group CBI_Servers inside
    pdm logging warnings 100
    pdm history enable
    arp timeout 14400
    global (outside) 200 interface
    global (DMZ) 200 interface
    nat (inside) 0 access-list inside_outbound_nat0_acl
    nat (inside) 200 192.168.10.0 255.255.255.0 0 0
    static (inside,outside) 207.XXX.XXX.150 192.168.10.27 netmask 255.255.255.255 0 0
    static (inside,outside) 207.XXX.XXX.132 192.168.10.26 dns netmask 255.255.255.255 0 0
    access-group 100 in interface outside
    route outside 0.0.0.0 0.0.0.0 207.XXX.XXX.129 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server radius-authport 1812
    aaa-server radius-acctport 1812
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server RADIUS (inside) host 192.168.10.26 ************* timeout 10
    aaa-server LOCAL protocol local
    http server enable
    http 192.168.10.3 255.255.255.255 inside
    no floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-DES-MD5
    crypto dynamic-map outside_dyn_map 40 match address outside_cryptomap_dyn_40
    crypto dynamic-map outside_dyn_map 40 set transform-set ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map client authentication RADIUS
    crypto map outside_map interface outside
    crypto map inside_map interface inside
    isakmp enable outside
    isakmp nat-traversal 3600
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption des
    isakmp policy 20 hash md5
    isakmp policy 20 group 2
    isakmp policy 20 lifetime 86400
    vpngroup Test_VPN address-pool CBI_VPN_Pool
    vpngroup Test_VPN dns-server 142.77.2.101 142.77.2.36
    vpngroup Test_VPN default-domain acme.com
    vpngroup Test_VPN idle-time 1800
    vpngroup Test_VPN authentication-server RADIUS
    vpngroup Test_VPN user-authentication
    vpngroup Test_VPN user-idle-timeout 1200
    vpngroup Test_VPN password ********
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.10.100-192.168.10.254 inside
    dhcpd dns 142.77.2.101 142.77.2.36
    dhcpd lease 3600
    dhcpd ping_timeout 750
    dhcpd auto_config outside
    dhcpd enable inside

  • SSL VPN IP Address Assignment from IAS radius server

    Can I use SSL VPN IP Address Assignment from IAS radius server?it can be done with acs server.are there some differ from the acs and IAS?

    Hi,
    I will suggest to setup a sniffer capture with ACS and look for the attribute that ACS sends for IP Address Assignment, once you know the attribute apply it on the IAS.
    If you have any question do not hesitate to contact me.

Maybe you are looking for