PIX radius outbound authentication question

We have an antivirus hardware device needs to be installed on our LAN and it needs to bypass the PIX radius logon to access external website and get updated periodically. How can I set its IP address

192.168.150.50 in PIX so it can bypass the radius logon prompt? Attached is the config file. Thanks in advance.

-jesk

--------------------------------------------------------- PIX Version 6.0(1)

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 pix/intf2 security10

nameif ethernet3 pix/intf3 security15

nameif ethernet4 pix/intf4 security20

nameif ethernet5 pix/intf5 security25

fixup protocol ftp 21

fixup protocol http 80

fixup protocol h323 1720

fixup protocol rsh 514

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol sip 5060

fixup protocol skinny 2000

names

access-list 101 permit ip 192.168.150.0 255.255.255.0 192.168.11.0

255.255.255.0

access-list 110 deny tcp host 192.168.150.10 any eq smtp

access-list 110 permit ip host 192.168.150.10 any

access-list 110 deny udp host 192.168.150.11 any eq domain

access-list 110 permit ip host 192.168.150.11 any

access-list 110 deny udp host 192.168.150.12 any eq domain

access-list 110 permit ip host 192.168.150.12 any

access-list 110 permit ip host 192.168.150.13 any

access-list 111 permit tcp any any eq www

access-list 111 permit tcp any any eq 443

pager lines 24

logging on

logging timestamp

logging monitor informational

logging buffered informational

interface ethernet0 auto

interface ethernet1 100full

interface ethernet2 auto

interface ethernet3 auto

interface ethernet4 auto

interface ethernet5 auto

mtu outside 1500

mtu inside 1500

mtu pix/intf2 1500

mtu pix/intf3 1500

mtu pix/intf4 1500

mtu pix/intf5 1500

ip address outside ----

ip address inside 192.168.150.1 255.255.255.0

ip address pix/intf2 127.0.0.1 255.255.255.255

ip address pix/intf3 127.0.0.1 255.255.255.255

ip address pix/intf4 127.0.0.1 255.255.255.255

ip address pix/intf5 127.0.0.1 255.255.255.255

ip audit info action alarm

ip audit attack action alarm

ip local pool vpnpool 192.168.11.1-192.168.11.254

no failover

failover timeout 0:00:00

failover poll 15

failover ip address outside 0.0.0.0

failover ip address inside 0.0.0.0

failover ip address pix/intf2 0.0.0.0

failover ip address pix/intf3 0.0.0.0

failover ip address pix/intf4 0.0.0.0

failover ip address pix/intf5 0.0.0.0

pdm location 192.168.150.11 255.255.255.255 inside

pdm location 192.168.150.27 255.255.255.255 inside

pdm location 192.168.150.10 255.255.255.255 inside

pdm location 192.168.150.200 255.255.255.255 inside

------

pdm logging alerts 100

pdm history enable

arp timeout 14400

global (outside) ----

nat (inside) 0 access-list 101

nat (inside) 1 192.168.150.11 255.255.255.255 0 0

nat (inside) 1 192.168.150.12 255.255.255.255 0 0

nat (inside) 1 192.168.150.13 255.255.255.255 0 0

nat (inside) 1 192.168.150.14 255.255.255.255 0 0

conduit permit icmp any any

route outside 0.0.0.0 0.0.0.0 ----

timeout xlate 12:00:01

timeout conn 12:00:00 half-closed 0:10:00 udp 0:05:00 rpc 0:10:00 h323

0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 12:00:00 absolute uauth 4:00:00 inactivity

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server AuthOutbound protocol radius

aaa-server AuthOutbound (inside) host 192.168.150.12 myauth timeout 3

aaa-server AuthOutbound (inside) host 192.168.150.11 myauth timeout 3

aaa authentication match 110 inside AuthOutbound

http server enable

http 192.168.150.200 255.255.255.255 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

virtual http 192.168.100.1

floodguard enable

sysopt connection permit-ipsec

no sysopt route dnat

service resetinbound

crypto ipsec transform-set myset esp-des esp-md5-hmac

crypto dynamic-map dynmap 10 set transform-set myset

crypto map mymap 10 ipsec-isakmp dynamic dynmap

crypto map mymap interface outside

isakmp enable outside

isakmp identity address

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption des

isakmp policy 10 hash md5

isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption des

isakmp policy 20 hash md5

isakmp policy 20 group 1

isakmp policy 20 lifetime 86400

vpngroup lwvpn address-pool vpnpool

vpngroup lwvpn dns-server 192.168.150.12

vpngroup lwvpn wins-server 192.168.150.12

vpngroup lwvpn default-domain mydomain

vpngroup lwvpn split-tunnel 101

vpngroup lwvpn idle-time 1800

------------------------------------------------------------

Reply to
jesk
Loading thread data ...

If I'm reading this right you should simply need to add .50 to ACL110

conf t access-list 110 permit ip host 192.168.150.50 any wr mem

Reply to
Brian V

That didn't work. It says: Please type your user name and password. Site: 192.168.100.1 Realm HTTP Authentication (ID38018) User Name Password

- OK / Cancel buttons

Question: how to config so .50 can connect to Internet without going through this dialog box?

Brian V wrote:

Reply to
jesk

Would "aaa mac-exempt" command work in this case? I saw it in the PIX configuration documentation but never try that before. -jesk

jesk wrote:

Reply to
jesk

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.