I upgraded my Pix 515e from 6.3.4 to 7.2.1 but the dynamic acl filter does not work more. I use Win2k IAS radius to authenticate vpn-ra users, the authenticate is ok but Pin doesn't apply the acl named in attribute
11 filter-id.
In ver. 6.3.4 all it was ok.
Waiting for your advice
Regards Fausto
--- debug radius --- ... Parsed packet data..... Radius: Code = 2 (0x02) Radius: Identifier = 93 (0x5D) Radius: Length = 238 (0x00EE) Radius: Vector: 523F29850299B09DC3CB212260A30000 Radius: Type = 11 (0x0B) Filter-Id Radius: Length = 27 (0x1B) Radius: Value (String) =
76 70 6e 2d 67 72 6f 75 70 5f 61 73 34 30 30 5f | vpn-group_as400_
61 63 63 65 73 73 5f 69 6e | access_in Radius: Type = 7 (0x07) Framed-Protocol Radius: Length = 6 (0x06) Radius: Value (Hex) = 0x1 ...
---- pix config ----- PIX Version 7.2(1) ... access-list vpn-group_as400_access_in extended deny tcp VPN-net
255.255.255.0 any eq 3389 access-list vpn-group_as400_access_in extended permit ip VPN-net
255.255.255.0 host itjas001 access-list vpn-group_as400_access_in extended permit ip VPN-net
255.255.255.0 host itjas00t access-list vpn-group_as400_access_in extended permit ip VPN-net
255.255.255.0 host wastest access-list vpn-group_as400_access_in extended deny ip any any ... global (outside) 1 interface nat (inside) 0 access-list nonat nat (inside) 1 0.0.0.0 0.0.0.0 ... aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius reactivation-mode depletion deadtime 15 aaa-server RADIUS host jassrv05 timeout 5 key xxxxxxxxxxxx aaa-server RADIUS host jassrv04 timeout 5 key xxxxxxxxxxxxxx group-policy DfltGrpPolicy attributes banner none wins-server none dns-server value xxx.xxx.xxx.xxx dhcp-network-scope none vpn-access-hours none vpn-simultaneous-logins 10 vpn-idle-timeout 30 vpn-session-timeout none vpn-filter none vpn-tunnel-protocol IPSec l2tp-ipsec password-storage disable ip-comp disable re-xauth disable group-lock none pfs disable ipsec-udp disable ipsec-udp-port 10000 split-tunnel-policy tunnelall split-tunnel-network-list none default-domain none split-dns none intercept-dhcp 255.255.255.255 disable secure-unit-authentication disable user-authentication disable user-authentication-idle-timeout 30 ip-phone-bypass disable leap-bypass disable nem disable backup-servers keep-client-config msie-proxy server none msie-proxy method no-modify msie-proxy except-list none msie-proxy local-bypass disable nac disable nac-sq-period 300 nac-reval-period 36000 nac-default-acl none address-pools none client-firewall none client-access-rule none sysopt connection timewait sysopt connection tcpmss minimum 48 sysopt noproxyarp outside sysopt noproxyarp inside service resetinbound service resetoutside crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport crypto dynamic-map outside_dyn_map 20 set transform-set TRANS_ESP_3DES_MD5 crypto dynamic-map outside_dyn_map 25 set transform-set TRANS_ESP_3DES_SHA crypto dynamic-map outside_dyn_map 30 set transform-set ESP-3DES-MD5 crypto dynamic-map outside_dyn_map 35 set transform-set ESP-3DES-SHA crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map crypto map outside_map interface outside crypto isakmp identity hostname crypto isakmp enable outside crypto isakmp policy 20 authentication pre-share encryption 3des hash md5 group 2 lifetime 86400 crypto isakmp policy 30 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto isakmp nat-traversal 20 tunnel-group DefaultL2LGroup ipsec-attributes pre-shared-key xxxxxxxxxxxxxxx tunnel-group DefaultRAGroup general-attributes address-pool l2tp-pool authentication-server-group RADIUS authorization-server-group RADIUS accounting-server-group RADIUS authorization-dn-attributes use-entire-name tunnel-group DefaultRAGroup ipsec-attributes pre-shared-key xxxxxxxxxxxxx tunnel-group DefaultRAGroup ppp-attributes no authentication chap authentication ms-chap-v2 no vpn-addr-assign aaa no vpn-addr-assign dhcp telnet segrate-net 255.255.240.0 inside telnet timeout 15 ssh segrate-net 255.255.240.0 inside ssh timeout 15 ssh version 1 console timeout 0 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns migrated_dns_map_1 parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns migrated_dns_map_1 inspect ftp inspect h323 h225 inspect h323 ras inspect http inspect ils inspect netbios inspect rsh inspect rtsp inspect skinny inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp ! service-policy global_policy global ...