RSA Ace Server Authentication Problem

have you created the IOS ROuter as a agent host in the RSA Server ? Are there any "node secret created" ?

/Martin

Hey Martin,

Thanks for your reply!

I have set the router up as a "Communications Server" and set" Open to all locally known users" to on. All the addresses and ports all line up (I'm pretty sure)

The "Node Secret Created" box is greyed out.

As far as I can tell, the requests get to the Radius server (running on Windows 2003 server with SP1), but get rejected for some reason. Under the Ace Server Log Monitor the error I get is "Node verification failed". They keys set on the router and the Radius server also are the same.

Suggestions?

Steve

"RPO83" skrev i en meddelelse news: snipped-for-privacy@f14g2000cwb.googlegroups.com...

that is correct

means the router havent talk succesfully with the SDI yet - the very first time it does this, it will create the secret. This is your issue

Means tha the secret is wrong. ... Under the Agent setup screen, what happends if you , only for the test of it, delete the "netwrok address" (IP address) and the "Name", and the just try type in the hostname under "Name" and press TAB-key ? (You should see t hat the name get resolved into a IP address) If notthing happens, then try add the name and IP to the servers hosts-file

Radius keys, right ? are the ports the same as on the server ?

not really ... maybe something with namesolution or filters inbetween. but the fact that you get log entries, indikate that the IOS is ok.

hmmm.....

I take your point with the node secret. So how do I get the router to talk with the SDI and exchange the secret?

The key is definately correct. I've verified this on numerous occasions bot on the router and the ACE Server. So is the name resolution.

I have also tried the configuration with the default ports (1645 and

Once again thanks for your help!

could it be your ioS version ?

I have shortly tried to google ... 8)

Just for info: Do you have ANY device that are currently operation with the ACE/Server ?

Hey Martin

Again thanks for your assistance!

I've fixed the problem, but I dont know how or why its fixed.

Basically I kept the same Router Config, but rebuilt the RSA ACE server in accordance with the Cisco document called "Cisco Security Associate Design Guide for RSA SecurID"

I still have one small problem, that being I havent worked out the passcode part of the authentication (I've got straight user passwords without the keyfob working) but thats a realtively minor thing.

So in short, IOS was fine, the ACE Server was the drama. I cant put my finger on the exact problem, except since I was using RSA on Windows

Cheers! Steve

ok - i have to have look at that - do you have a URL, you could spare ?

If I recall correctly, you have to setup the modem clients to "bring up terminal" after connect, and in there you can authenticate themselfs, and after that continue, by closing the term-window.

I will have to dig into the "old" doc-storage on my PC to find the old, but i will try

Yes, I think you are right - recently I noticed a RSA mail, mention that, in some specific patch had to be installed in a special way, without reboot win2k3sp1 is kinda special - I have my doubts aswell, as I have to get LMS2.5 running on one of these soon ...

SKÅL !

Martin

I cant seem to find the URL of that specific file, but I have a copy of it that I can send to you to your email address if you like.

As for the dialin problem, thats all sorted out now. Now off to see how to integrate this into a PIX firewall More fun! hahahah :)

off to learn firewalls....

Steve

Please do email it to me - reply to this and edit the email for the obvious PIX firewalls are a peace of cake ... you need this as a VPN RAS User setup or ?

You get the file OK?

yes, thank you. I did recieve it just fine I am currently working on a Ciscoworks LMS installation, so I have to wait with the RSA upgrade.