Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been trying to get our Cisco ISR 2811 to authenticate the VPN clients towards an Active Directory server (so that the Cisco VPN client asks the user for username/password).

Googling around has only given me instructions on how to do it with a PIX/ASA, I would like to do the same on the router.

Thanks, Mattias

share|improve this question
up vote 1 down vote accepted

This article might be a good starting point:

share|improve this answer
Thank you! That article helped me through the issues I had, works now. – mnordstr Jun 10 '09 at 11:37

You will need to install IAS windows component on windows server (your dc is ok). Then declare it as radius server on your cisco Declare your cisco as radius client allow your users to do remote call (user properties in dsa.msc)

share|improve this answer

here are the commands i use on my cisco routers they are running IOS 12.2-K9 Image:

aaa authentication login default group radius local
radius-server host <server> auth-port 1812 acct-port 1813 key <your_key>

You need to be in aaa new-model mode to do this. the first command tells it to set the default login authentication to be readius- if that fails fall back to local. and trust me you want that local fall back

1812 and 1813 are MS's default RADIUS ports.

This is after you have setup IAS on the Windows server side

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.