11

I have a Cisco PIX, and have been using the Cisco VPN client on windows however I would like to enable this to work with the native Windows 8/10 VPN client. It works fine with the native clients for Android (using IPsec Xauth PSK) and iOS (IPsec). However there is no place in the Windows client for me to put the Group Id.

Is this authentication method simply not supported on windows?

Improve this question
3
  • IPsec in windows is implemented using the Windows Firewall with Advanced Security, under Connection Security settings.
    – ztk
    Aug 3, 2015 at 20:24
  • Thanks, This gave me some new areas to explore, and seems to be a far better solution (initiating a tunnel when requesting traffic for a specific ip range etc), however there doesn't seem to be anywhere for group authentication. any suggestions?
    – user2641043
    Aug 3, 2015 at 20:53
  • the firewall is configured with vpn-tunnel-protocol IPSec l2tp-ipsec. I am using radius to authenticate the users against my AD server. In order to initiate the connection i need the groupid, pre-shared-key and user credentials.
    – user2641043
    Aug 3, 2015 at 21:10

2 Answers 2

Reset to default
7

Is this authentication method simply not supported on windows?

Correct. The Windows VPN client simply does not support using Group Security in an IPSec VPN. Additionally, the Cisco IPSec VPN client is EoL, so they don't really support it anymore (preferring customers to pay for AnyConnect SSL VPN licenses).

There are some free alternatives out there, as well as a number of ways to get the old Cisco VPN client installed on Windows 10, (it installs fin on 8 and 8.1) but frankly, all the options for this type of VPN on newer versions of Windows leave a lot to be desired.

Improve this answer
2
  • Thank you for the definitive answer!, what authentication method would be best recommended for connecting windows 10 devices to my cisco device?
    – user2641043
    Sep 9, 2015 at 15:16
  • @user2641043 RADIUS (the NPS server role in Windows) is generally the go-to authentication method for network gear needing to authenticate Windows domain users or machines. I also know for a fact that it's possible to have an IPSec/L2TP VPN that doesn't ask for or use that "group name" field (as this is the type of VPN I've had access to at work for the last several jobs), but being a systems guy more than a network guy, I don't recall how to go about doing that (maybe that's one of the effects of using RADIUS authentication instead of authing against the network device, for all I know).
    – HopelessN00b
    Sep 16, 2015 at 15:17
4

It turned out that all I needed to do was setup the PIX with a group-policy named DefaultRAGroup.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .