Summary of the content on the page No. 1
RSA SecurID Ready Implementation Guide
Last Modified: September 30, 2005
Partner Information
Product Information
Partner Name Cisco
Web Site www.cisco.com
Product Name
Cisco PIX Security Appliance
Version & Platform PIX IOS 7.0(2)
Product Description The market-leading Cisco PIX Security Appliance Series delivers robust
user and application policy enforcement, mutlivector attack protection, and
secure connectivity services in cost-effective, easy-to-deploy solutions.
These purpose-
Summary of the content on the page No. 2
Solution Summary The Cisco PIX® Security Appliance Series delivers robust user and application policy enforcement, multi- vector attack protection, and secure connectivity services in cost-effective, easy-to-deploy solutions. The Cisco PIX® Security Appliance Series provides convenient methods for authenticating VPN users through native integration with popular authentication services, including RADIUS and RSA SecurID authentication (without requiring a separate RADIUS/TACACS+ server to act
Summary of the content on the page No. 3
Product Requirements Partner Product Requirements: Cisco PIX Security Appliance Memory See Cisco PIX Security Appliance documentation Firmware Version 7.0(2) Additional Software Requirements Application Additional Patches Cisco Secure VPN Client 4.6 Important: If you are configuring the PIX Security Appliance to use IPSec you will also need to configure the Cisco VPN client. Information on how to configure the Cisco VPN client can be found in the Cisco VPN client imple
Summary of the content on the page No. 4
Agent Host Configuration To facilitate communication between the Cisco PIX Security Appliance and the RSA Authentication Manager / RSA SecurID Appliance, an Agent Host record must be added to the RSA Authentication Manager database and RADIUS Server database if using RADIUS. The Agent Host record identifies the Cisco PIX Security Appliance within its database and contains information about communication and encryption. To create the Agent Host record, you will need the following informatio
Summary of the content on the page No. 5
Partner Authentication Agent Configuration Before You Begin This section provides instructions for integrating the partners’ product with RSA SecurID Authentication. This document is not intended to suggest optimum installations or configurations. It is assumed that the reader has both working knowledge of all products involved, and the ability to perform the tasks outlined in this section. Administrators should have access to the product documentation for all products in order to insta
Summary of the content on the page No. 6
address-pool test authentication-server-group AuthMan6 tunnel-group AuthMan6Group ipsec-attributes pre-shared-key * 6
Summary of the content on the page No. 7
RADIUS authentication configuration: RADIUS Server: aaa-server inauth protocol radius aaa-server inauth host 10.100.50.37 key secret aaa-server inauth host 10.100.50.36 key secret aaa-server inauth host 10.100.50.35 key secret VPN Policy: ip local pool test 173.16.16.1-173.16.16.254 group-policy ScottRAD internal group-policy ScottRAD attributes crypto ipsec transform-set RADIUSset esp-3des esp-sha-hmac crypto dynamic-map RADIUSmap 30 set transform-set RADIUSset cry
Summary of the content on the page No. 8
Certification Checklist: Firewall Date Tested: September 29, 2005 Certification Environment Product Name Version Information Operating System 6.1 Windows 2003 RSA Authentication Manager 3.0.4 Windows 2000 RSA Software Token 7.0(2) IOS Cisco Pix Security Appliance Mandatory Functionality RSA Native Protocol RADIUS Protocol New PIN Mode N/A Force Authentication After New PIN Force Authentication After New PIN N/A System Generated PIN System Generated PIN N/A User De
Summary of the content on the page No. 9
Certification Checklist: VPN Date Tested: September 29, 2005 Certification Environment Product Name Version Information Operating System 6.1 Windows 2003 RSA Authentication Manager 3.0.4 Windows 2000 RSA Software Token 7.0(2) IOS Cisco Pix Security Appliance 4.6 Windows 2000 Cisco VPN Client Mandatory Functionality RSA Native Protocol RADIUS Protocol New PIN Mode Force Authentication After New PIN Force Authentication After New PIN System Generated PIN System Generate
Summary of the content on the page No. 10
Known Issues 1. Failed PIN creation via RADIUS with VPN Client. When a user fails to enter a PIN that matches the PIN criteria they will be prompted to enter their password again but will always fail as the information the user enters will not be sent to the RADIUS Server. The user needs to disconnect and reconnect to attempt to create the PIN again. Appendix Node Secret: The Node Secret file is stored in flash on the Cisco PIX Security Appliance. To see this file run show flash. The
