1. Home
  2. Cisco Systems
  3. PIX 515E 7.1: VPN + Microsoft AD

PIX 515E 7.1: VPN + Microsoft AD

I'm a bit green, so I apologize of this is obvious:

I've come into a situation with a PIX configured for IPSec VPN. Authentication is configured for kerberos against their Win2k3 DCs. There is no authorization server configured. This setup allows any valid enabled AD user with the correct group PSK in their VPN client to authenticate and access any resource permitted under the group's ACLs.

What I'm looking to do is enable a method of denying VPN access for specific users in AD, regardless of the PCF they have installed in their Client, without restricting internal access. That is, I would like to be able to deny a specific user access to VPN without affecting internal access and without any invasive interaction (e.g. uninstalling their remote VPN client, deleting their PCF, changing the PSK, etc). With this current setup, I don't see how I can easily deny/grant VPN.

How would I go about [re]configuring for such capabilities? Is this what an authorization server is for?

Thanks!

Reply to
gt
Loading thread data ...

Install IAS on your DC, configure it for the groups you want to have vpn. Configure your pix's vpn for radius authentication. 1000's of examples all over the net, very easy stuff.

Reply to
Brian V

Not that I'm aware. IAS/Radius is the standard around here. Maybe 1 out of

1000 jobs would use kerberous. Why don't you want to use Radius/IAS?
Reply to
Brian V

Because I thought kerberos vs AD was a new enhanced feature. If it is less feature-rich, why was it added later as a new feature? I apologize if I'm not understanding things; like I said, I'm a bit of a noob.

I also would prefer not to use IAS because of server admin roles delegation reasons. Not worth going into. I could as a last resort, but I was under the impression that using kerberos instead was a more advanced, ez config?

Thanks!

Brian V wrote:

Reply to
gt

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.