actually let me clarify that it is not ASA to ASA but the authentication traffic is being sent across the tunnel between the router-to-ASA tunnel.
Regards, Tyson Scott - CCIE #13513 R&S, Security, and SP Managing Partner / Sr. Instructor - IPexpert, Inc. Mailto: <mailto:[email protected]> [email protected] Telephone: +1.810.326.1444, ext. 208 Live Assistance, Please visit: <http://www.ipexpert.com/chat> www.ipexpert.com/chat eFax: +1.810.454.0130 IPexpert is a premier provider of Self-Study Workbooks, Video on Demand, Audio Tools, Online Hardware Rental and Classroom Training for the Cisco CCIE (R&S, Voice, Security & Service Provider) certification(s) with training locations throughout the United States, Europe, South Asia and Australia. Be sure to visit our online communities at <http://www.ipexpert.com/communities> www.ipexpert.com/communities and our public website at <http://www.ipexpert.com/> www.ipexpert.com From: [email protected] [mailto:[email protected]] On Behalf Of Jimmy Larsson Sent: Thursday, April 14, 2011 11:36 AM To: OSL Security Subject: [OSL | CCIE_Security] ASA-generated traffic thru lan2lan-tunnel? Hi guys I have a question that I have tried to find time to lab out myself without success so I am throwing it out here in hope for a quick answer. Lets say that my ASA1 has a Lan2Lan-tunnel to ASA2. On the inside of ASA2 is a radius-server and ASA1 needs to authenticate vpn-clients on that radius server. Can I do that thru the vpn-tunnel? And if so, how do I define the crypto acl and which interface should I specify in ASA1 that the radius-server resides on? Topology: Radius-server .10 on Lan2 192.168.2.0/24 -----(.1) ASA2 =====VPN-tunnel over internet=====ASA1 .1 --- Lan1 192.168.1.0/24 How do I configure aaa-server for radius on ASA1? Thanks in advance! Best regards Jimmy Larsson -- ------- Jimmy Larsson Ryavagen 173 s-26030 Vallakra Sweden http://blogg.kvistofta.nu -------
_______________________________________________ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com
