Pix 501 With Radius VPN Auth. Problem if radius server is unavailable 1

[overdraft015]

I have a pix 501 setup (for testing only so the config is not complete in some areas) and a windows 2003 server with IAS.

I can connect to the VPN using radius auth just fine, if the radius server goes down i have set it up to use local users as a backup (this will be IT users only)

I try and connect using the radius user while the radius server is unavailable (i sumulated this by pulling the inside network from the pix) it fails ok thats good. i then retry connecting using one of the local accounts and i can connect again good.

the problem is if i then reconnect the inside network (again to simulate the radius server is back up) i can no longer connect using any radius auth.

has anyone come across this? is there some kind of timeout that it needs to re-establish the radius server is backup and stable?

Conf available if it helps

Regards,

Michael

 

[North323]

are you getting an error message when you try to connect when the radius server is back up? what is the time out on a user locally? have you run a packet capture, does it even hit the radius server?

i'd post your config

 

[overdraft015]

Yes i get the error message when the radius is back up. it is as if the pix then doesnt try again to auth through the radius.

Server Grou - Max failed attemps 3, Dead Time 10.
Radius Server - Timeout 5.

Not run a packet trace (not used it before really)

Conf
-------------------
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password ****** encrypted
passwd ***** encrypted
hostname NBL000214
domain-name EMEA.dmai.net
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list inside_outbound_nat0_acl permit ip any 192.168.63.0 255.255.255.0
access-list outside_cryptomap_dyn_20 permit ip any 192.168.63.0 255.255.255.0
access-list outside_cryptomap_dyn_40 permit ip any 192.168.63.0 255.255.255.0
access-list outside_cryptomap_dyn_60 permit ip any 192.168.63.0 255.255.255.0
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
ip address outside ****** 255.255.255.248
ip address inside 192.168.21.4 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool VPNPOOL 192.168.63.101-192.168.63.254
pdm location 192.168.21.0 255.255.255.0 inside
pdm location 192.168.21.98 255.255.255.255 inside
pdm location 192.168.24.0 255.255.255.0 inside
pdm location 192.168.63.0 255.255.255.0 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
nat (inside) 0 access-list inside_outbound_nat0_acl
route outside 0.0.0.0 0.0.0.0 ****** 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server RADIUS (inside) host 192.168.21.98 ****** timeout 5
aaa-server LOCAL protocol local
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.21.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-AES-256-MD5
crypto dynamic-map outside_dyn_map 40 match address outside_cryptomap_dyn_40
crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-MD5
crypto dynamic-map outside_dyn_map 60 match address outside_cryptomap_dyn_60
crypto dynamic-map outside_dyn_map 60 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client authentication RADIUS LOCAL
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 20 authentication rsa-sig
isakmp policy 20 encryption aes-256
isakmp policy 20 hash md5
isakmp policy 20 group 5
isakmp policy 20 lifetime 86400
isakmp policy 40 authentication pre-share
isakmp policy 40 encryption 3des
isakmp policy 40 hash md5
isakmp policy 40 group 2
isakmp policy 40 lifetime 86400
vpngroup AITUKVPN address-pool VPNPOOL
vpngroup AITUKVPN dns-server 192.168.21.100 172.22.181.101
vpngroup AITUKVPN wins-server 192.168.21.100
vpngroup AITUKVPN default-domain ******
vpngroup AITUKVPN idle-time 1800
vpngroup AITUKVPN password ********
telnet timeout 5
ssh 192.168.21.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
username ****** password ****** encrypted privilege 15
terminal width 80
Cryptochecksum:98697d47a634e4043226d5a0308ba3e0

 

[overdraft015]

sorry forgot to mention the error from the vpn client.

Reason 413: User Authentication Failed.

 

[North323]

what is the time frame between when you try it locally and reconnect the radius? is the account locked out or disabled?

aaa-server RADIUS deadtime 10
aaa-server RADIUS (inside) host 192.168.21.98 ****** timeout 5

can you lower these times for testing?

 

[overdraft015]

I think you've hit the nail on the head there. reduced the dead time to 1min (for testing)

I wasnt aware of the dead time field. (until you suggested it that it)

but thats what i needed to do

Thank you for your help.