1

Is it possible to setup the remote access VPN to athenticate to a RADIUS server that is on the other end of a Site to site VPN on the same ASA?

I have an ASA 5505 that is at a branch office with a site to site VPN to head office (with a 5510) i then want to setup remote access VPN on the 5505 for home users of this site that will authenticate to a RADIUS server located on the head office LAN.

Is this possible? This will same me setting up another RADIUS server on the Read only domain controller that is currently on site.

Usama Abdulrehman
  • 179
  • 1
  • 9
Dan
  • 91
  • 1
  • 3
  • 1
    I don't see why not, as long as the 5505 can talk to the RADIUS server across the tunnel. – gravyface Feb 04 '11 at 21:29
  • how do i get the ASA to talk to the RADIUS server accross the tunnel? I can ping the radius server from the LAN on the 5505 but not from the 5505 itself. You have to select the interface of the radius server when setting up the AAA-server i've tried both inside and outside but none work. – Dan Feb 04 '11 at 21:35
  • What if you try: `test aaa authentication radius host ` from the 5505? – gravyface Feb 04 '11 at 21:51
  • I get "ERROR: Authentication Server not responding: no error" – Dan Feb 04 '11 at 23:14
  • See http://serverfault.com/questions/346557/what-does-the-cisco-asa-command-management-access-do/346770#346770 – Shane Madden Jan 05 '12 at 01:57

1 Answers1

0

The Radius server IP needs to be included on ASA1 Site to Site tunnel with other ASA where ASA1 outside interface would be the source IP in the crypto acl and radius server IP would the destination.

ASA1<---------------------->ASA2

ASA1: 

Crypto acl- ASA_outside_IP to Radius_Server_IP
Nat- nat(out,out) source static ASA_OUtside_IP ASA_OUtside_IP destination static Radius_Server_IP Radius_Server_IP no-proxy-arp
route-lookup
same-security-permit intra-interface

ASA2: 

Crypto acl- Radius_Server_IP to ASA1_outside_IP
Nat- nat(inside,out) source static Radius_Server_IP Radius_Server_IPdestination 
static ASA_OUtside_IP ASA_OUtside_IP no-proxy-arp route-lookup
duenni
  • 2,959
  • 1
  • 23
  • 38
Linkson
  • 1