Is it possible to setup the remote access VPN to athenticate to a RADIUS server that is on the other end of a Site to site VPN on the same ASA?

I have an ASA 5505 that is at a branch office with a site to site VPN to head office (with a 5510) i then want to setup remote access VPN on the 5505 for home users of this site that will authenticate to a RADIUS server located on the head office LAN.

Is this possible? This will same me setting up another RADIUS server on the Read only domain controller that is currently on site.

  • 1
    I don't see why not, as long as the 5505 can talk to the RADIUS server across the tunnel. – gravyface Feb 4 '11 at 21:29
  • how do i get the ASA to talk to the RADIUS server accross the tunnel? I can ping the radius server from the LAN on the 5505 but not from the 5505 itself. You have to select the interface of the radius server when setting up the AAA-server i've tried both inside and outside but none work. – Dan Feb 4 '11 at 21:35
  • What if you try: test aaa authentication radius host <your_radius_server_ip> from the 5505? – gravyface Feb 4 '11 at 21:51
  • I get "ERROR: Authentication Server not responding: no error" – Dan Feb 4 '11 at 23:14

The Radius server IP needs to be included on ASA1 Site to Site tunnel with other ASA where ASA1 outside interface would be the source IP in the crypto acl and radius server IP would the destination.



Crypto acl- ASA_outside_IP to Radius_Server_IP
Nat- nat(out,out) source static ASA_OUtside_IP ASA_OUtside_IP destination static Radius_Server_IP Radius_Server_IP no-proxy-arp
same-security-permit intra-interface


Crypto acl- Radius_Server_IP to ASA1_outside_IP
Nat- nat(inside,out) source static Radius_Server_IP Radius_Server_IPdestination 
static ASA_OUtside_IP ASA_OUtside_IP no-proxy-arp route-lookup

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.