VPN 3000 , Domain Controller, ACS

[zillah]

I have got this scenario, Backup Domain Controller resides within my LAN, cisco secure ACS (uses RADUIS protocol) resides within my LAN as well.

ACS configuration
--------------------
As you can see (Top figure) that VPN server -192.168.5.254- (concentrator 3000) was configured to be authenticated by ACS -192.168.5.50-.


VPN 3000 Configuration
---------------------------
In the bottom figure VPN server was pointed to "Server Type" as: RADUIS , and "server authentication" is : 192.168.2.11 (Backup Domain Controller ) ? Why has it not been pointed to Cisco Secure ACS 192.168.5.50 ?

http://img105.imageshack.us/img105/8...aduisdcrn6.jpg

VPN 3000 and Cisco Secure ACS both of them are connected to cisco core switch 4000,,,,,,,,default gateway should be switch.

VPN 3000 and Cisco Secure ACS both of them are running in parallel (i.e not behind not infront)

[zillah]

Any idea ?

[Raiden]

Was the 192.168.2.11 already configured ? If so, does the ACS have multiple interfaces ? Does any aaa from the concentrator ? If so, then you just might have to change the authentication server ip to 192.168.5.50, but be careful if its an operational concentrator. Changing the aaa-server might give problems. Anyway I'd sort out what for device 192.168.2.11 is.

If I understand your problem correctly, you have added the concentrator in the ACS and don't understand why the 192.168.2.11 is in the Concentrator config ? Please clarify your problem a bit.

[mmelby]

We are doing almost exactly the same thing you are... You have not really provided enough information.

A couple of things come to mind:

The timeout setting on the VPN concentrator is a little short for Radius authentication. Ours is set to 20 (instead of 4)

Have you tested the authentication process from the ACS box to AD?

What do the logs (under Reports and Activity) indicate when you attempt an authentication?

On the VPN concentrator you have the option to test the radius authentication. Have you done this? What do the logs say?


Hopefully this points you in the right direction.

[zillah]

Was the 192.168.2.11 already configured ?

Yes. as you see here :
http://img405.imageshack.us/img405/6...rraduiscj1.jpg

does the ACS have multiple interfaces

No

Does any aaa from the concentrator ?

I will check that

If I understand your problem correctly, you have added the concentrator in the ACS

No, I have not done anything , the configuration was there and network was setup by someone else, I am just try to study the design

don't understand why the 192.168.2.11 is in the Concentrator config

I try to figure out why 192.168.2.11 was there.

Please clarify your problem a bit.

Hopefully I have clarified all the ambiguities

[zillah]

You have not really provided enough information.

I will be glad to provide any information

The timeout setting on the VPN concentrator is a little short for Radius authentication. Ours is set to 20 (instead of 4)

I will study that.

1- Have you tested the authentication process from the ACS box to AD?
2- What do the logs (under Reports and Activity) indicate when you attempt an authentication?

i will check that and let you know

On the VPN concentrator you have the option to test the radius authentication. Have you done this? What do the logs say?

No. I have not done that yet.

Hopefully this points you in the right direction.

Great , I will do all the test and post the output if there are any.

[zillah]

On the VPN concentrator you have the option to test the radius authentication. Have you done this?

I followed step 5 in the link below:
http://www.cisco.com/en/US/products/...80094a03.shtml


But I received the below error message :
http://img247.imageshack.us/img247/4...gintestkl1.jpg

At work (not remotely) I tried to test VPN , by entering my Active Directory's username and password but I received the error message in the link above, thought with same username and password I can access the VPN from remote area.

[zillah]

2- What do the logs (under Reports and Activity) indicate when you attempt an authentication?

When I checked the Cisco Secure ACS --> Reports and Activity --> Failed Attempts,,,,,,,Nothing was written to these reports.Doesn't that mean that ACS is not used ?

[mmelby]

When I checked the Cisco Secure ACS --> Reports and Activity --> Failed Attempts,,,,,,,Nothing was written to these reports.Doesn't that mean that ACS is not used ?

If you are not getting anything under Failed Attempts that would indicate that ACS is not being used for authentication.

In the VPN concentrator under Configuration--> System --> Servers --> Authentication. You should have a server identified as your Radius server. It should look something like

192.168.2.2 (Radius/User Authentication)

If you select that server and press the Test button to test the authentication what is returned in the test?

[zillah]

If you select that server and press the Test button to test the authentication what is returned in the test?

The answer would be :

But I received the below error message :
http://img247.imageshack.us/img247/4...gintestkl1.jpg