PIX 515 Access VPN with Freeradius server

[cdowling]

Hello All,

Before I take the hammer to both my PIX and radius server, I was wondering if anyone has completed an installation such as this. I am not a well versed UNIX user but am desperately trying to get my VPN configuration working. I think the PIX is configured correctly but I would like to prove the VPN using the PIX as the authenticating server. Unfortunately, all the documents I have read refer to Radius servers which is why I have started looking at configuring it. Any ideas on how to get the AAA stuff working like this? Althought using a Radius server is the ultimate goal, it is an added complication at this stage and I am now spending hours and ours reading about how to configure Freeradius (frustration level increasing dangerously).

Can anyone offer some advice? I am running PIX version 6.2(2)and Freeradius v 1.123 (freeradius-0.8.1) on Solaris 8.

 

[yizhar]

HI.

Some tips:

* If you upgrade the pix to version 6.3x, you will be able to use local user accounts instead of RADIUS.

* When using RADIUS for VPN - the authentication is in PAP protocol, so the RADIUS server should be configurred to accept this kind of authentication protocol.

* I have implemented XAUTH (VPN authentication) with W2K server built in IAS and it works. If you have a W2K server to play with you can implement this first, and then switch to another solution if needed.

* Logging, Logging, Logging, Debug, Debug, Debug...
Work with the pix syslog messages and debug commands, and with the logs of the RADIUS server, to find the problems.

Bye


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar