Cisco IPsec VPN Active Directory Authentication

Question

I've been trying to get our Cisco ISR 2811 to authenticate the VPN clients towards an Active Directory server (so that the Cisco VPN client asks the user for username/password).

Googling around has only given me instructions on how to do it with a PIX/ASA, I would like to do the same on the router.

Thanks, Mattias

Answer 1

This article might be a good starting point:

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00800946b7.shtml

Answer 2

You will need to install IAS windows component on windows server (your dc is ok). Then declare it as radius server on your cisco Declare your cisco as radius client allow your users to do remote call (user properties in dsa.msc)

Answer 3

here are the commands i use on my cisco routers they are running IOS 12.2-K9 Image:

aaa authentication login default group radius local
radius-server host <server> auth-port 1812 acct-port 1813 key <your_key>

You need to be in aaa new-model mode to do this. the first command tells it to set the default login authentication to be readius- if that fails fall back to local. and trust me you want that local fall back

1812 and 1813 are MS's default RADIUS ports.

This is after you have setup IAS on the Windows server side