Configure RADIUS Attribute Mapping for FlexVPN Remote Users

Available Languages

Download Options

  • PDF     (2.3 MB)
    View with Adobe Reader on a variety of devices
  • ePub     (2.3 MB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (1.9 MB)
    View on Kindle device or Kindle app on multiple devices
Updated:February 6, 2024
Document ID:221637

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

    Introduction

    This document describes how to configure FlexVPN using Cisco Identity Services Engine (ISE) to verify identities and perform attribute group mapping.

    Prerequisites

    Requirements

    Cisco recommends that you have knowledge of these topics:

    • Remote Access Virtual Private Network (RAVPN) with IKEV2/IPsec configuration on a Cisco IOS® XE Router through CLI
    • Cisco Identity Services Engine (ISE) configuration
    • Cisco Secure Client (CSC)
    • RADIUS protocol

    Components Used

    This document is based on these software and hardware versions:

    • Cisco CSR1000V (VXE) - Version 17.03.04a 
    • Cisco Identity Services Engine (ISE)  - 3.1
    • Cisco Secure Client (CSC) – Version 5.0.05040
    • Windows 11

    The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

    Configure

    Network Diagram

    Basic Network DiagramBasic Network Diagram

    Configurations

    Router Configuration

    Step 1. Configure a RADIUS server for authentication and local authorization on the device:

    aaa new-model
    aaa group server radius FlexVPN-Authentication-Server
    server-private 192.168.30.110 key Cisco123
    aaa authentication login FlexVPN-Authentication-List group FlexVPN-Authentication-Server
    aaa authorization network FlexVPN-Authorization-List local

    The aaa authentication login <list_name> command refers to the authentication, authorization, and accounting (AAA) group (which defines the RADIUS server).

    The aaa authorization network <list_name> local command states that locally defined users/groups are to be used. 

    Step 2.  Configure a trustpoint to store the router certificate. Since the local authentication of the router is type RSA, the device requires that the server authenticates itself using a certificate:

    crypto pki trustpoint FlexVPN-TP
    enrollment url http://192.168.50.230:80
    subject-name CN=192.168.50.225
    revocation-check none
    rsakeypair FlexVPN_KEY

    Step 3. Define an IP local pool  for each different user group:

    ip local pool group1 172.16.10.1 172.16.10.50
    ip local pool group2 172.16.20.1 172.16.20.50

    Step 4. Configure the local authorization policy:

    crypto ikev2 authorization policy FlexVPN-Local-Policy

    No configuration is required on the authorization policy since the authentication server is responsible for sending the relevant values (DNS, pool, protected routes and so on) based on the group the user belongs. However, it must be configured to define the username in our local authorization database.

    Step 5 (Optional). Create an IKEv2 proposal and policy (if not configured, smart defaults are used):

    crypto ikev2 proposal IKEv2-prop
     encryption aes-cbc-256
     integrity sha256
     group 14

    crypto ikev2 policy IKEv2-pol
     proposal IKEv2-prop

    Step 6 (Optional). Configure the transform-set (if not configured, smart defaults are used):

    crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac
     mode tunnel

    Step 7. Configure an IKEv2 profile with the proper local and remote identities, authentication methods (local and remote), trustpoint, AAA and the virtual template interface used for the connections:

    crypto ikev2 profile FlexVPN-IKEv2-Profile
    match identity remote key-id cisco.example
    identity local dn 
    authentication local rsa-sig
    authentication remote eap query-identity
    pki trustpoint FlexVPN-TP
    aaa authentication eap FlexVPN-Authentication-List
    aaa authorization group eap list FlexVPN-Authorization-List FlexVPN-Local-Policy
    aaa authorization user eap cached
    virtual-template 100

    The command aaa authorization user eap cached specifies that the attributes received during EAP authentication must be cached. This command is essential for the configuration because without it, the data sent by the authentication server is not used, leading to a failed connection.

    note-icon

    Note: The remote key-id must match the key-id value in the XML file. If it is not modified in the XML file, the default value (*$AnyConnectClient$*) is used and must be configured on the IKEv2 profile.

    Step 8. Configure an IPsec profile and assign the transform-set and the IKEv2 profile:

    crypto ipsec profile FlexVPN-IPsec-Profile
    set transform-set TS 
    set ikev2-profile FlexVPN-IKEv2-Profile

    Step 9. Configure a loopback interface. The Virtual-Access interfaces borrows the IP address from it:

    interface Loopback100
    ip address 10.0.0.1 255.255.255.255

    Step 10. Create the virtual template that is going to be used to create the different virtual-access interfaces and link the IPSec profile created on Step 8: 

    interface Virtual-Template100 type tunnel
    ip unnumbered Loopback100
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile FlexVPN-IPsec-Profile-1

    Step 11. Disable HTTP-URL based certificate lookup and HTTP server on the router:

    no crypto ikev2 http-url cert
    no ip http server
    no ip http secure-server

    Identity Services Engine (ISE) Configuration

    Step 1. Log into the ISE server and navigate to Administration > Network Resources > Network Devices:

    ISE General MenuISE General Menu

    Step 2. Click Add to configure the router as a AAA client:

    Adding a New Network DeviceAdding a New Network Device

    Enter the network device Name and IP Address fields and then check RADIUS Authentication Settings box and add the Shared Secret, this value must be the same one that was used when the RADIUS Server object on router was created.

    Name and IP AddressName and IP Address     

    Radius PasswordRadius Password

    Click Save.

    Step 3. Navigate to Administration > Identity Management > Groups: 

    ISE General MenuISE General Menu

    Step 4. Click User Identity Groups and then click Add:

    Add a New GroupAdd a New Group

    Enter the group Name and click Submit.

    Group InformationGroup Information

    note-icon

    Note: Repeat steps 3 and 4 to create as many groups as needed.

    Step 5. Navigate to Administration > Identity Management > Identities:

    ISE General MenuISE General Menu

    Step 6. Click Add in order to create a new user in the server local database: 

    Add a UserAdd a User

    Enter the Username and Login Password. Then, navigate to the end of this page and select the User Group:

    Username and PasswordUsername and Password      

    Assign the Correct Group to the UserAssign the Correct Group to the User

    Click Save.

    note-icon

    Note: Repeat steps 5 and 6 to create the users you need and to assign them to the corresponding group.

    Step 7.  Navigate to Policy > Policy Sets:

    ISE General MenuISE General Menu

    Select the default authorization policy by clicking the arrowon the right side of the screen: 

    Select the Authorization PolicySelect the Authorization Policy

    Step 8. Click the drop-down menu arrow next toAuthorization Policy to expand it. Then, Click the add (+)icon in order to add a new rule: 

    Add a New Authorization RuleAdd a New Authorization Rule

    Enter the name for the rule an select the add (+) icon under Conditions column: 

    Add a ConditionAdd a Condition

    Step 9. Click in the Attribute Editor textbox and click theIdentity groupicon. Select the Identity group - Name attribute:

    Select the ConditionSelect the Condition

    SelectEqualsas the operator then, click the drop-down menu arrow to show the available options and select User Identity Groups:<GROUP_NAME>.

    Select the GroupSelect the Group

    Click Save.

    Step 10.  In the Profiles column, click the add (+) icon and choose Create a New Authorization Profile:

    Create the Authorization ProfileCreate the Authorization Profile

    Enter the profile Name

    Profile InformationProfile Information

          

    Navigate to the end of this page to Advanced Attribute Settings and click on the drop-down menu arrow. Then click on Cisco and select cisco-av-pair--[1]:

    Select the Attribute TypeSelect the Attribute Type.   

    Add the cisco-av-pair attribute that you want to configure and click the add (+) icon to add another attribute:

    Configure the AttributeConfigure the Attribute

    note-icon

    Note: For attribute specifications (name, syntax, description, example, etc), please consult the FlexVPN RADIUS Attributes configuration guide:

    FlexVPN and Internet Key Exchange Version 2 Configuration Guide, Cisco IOS XE Fuji 16.9.x - Supported RADIUS Attributes

    note-icon

    Note: Repeat the previous step to create the necessary attributes.

    Click Save.

    The attributes that come next were assigned to each group:

    • Group 1 attributes:

    Group1 AttributeGroup1 Attribute

    • Group 2 attributes: 

    Group2 AttributesGroup2 Attributes

    Step 11.  Click on the drop-down menu arrow and select the authorization profile created on Step 10:

    Assign Authorization ProfileAssign Authorization Profile

    Click Save.

    note-icon

    Note: Repeat steps 8 to 11 to create the necessary authorization rules for each group.

    Step 12 (optional). If you need to edit the authorization profile navigate to  Policy > Results:

    ISE General MenuISE General Menu

    Navigate to Authorization > Authorization Profiles. Click on the check box of the profile you want to modify and then click Edit: 

    Edit the Authorization ProfileEdit the Authorization Profile

    Client Configuration

    Step 1. Create an XML profile using the XML profile editor. This example is the one used for the creation of this document: 


    <AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.xmlsoap.org/encoding/ AnyConnectProfile.xsd">
    <ClientInitialization>
    <UseStartBeforeLogon UserControllable="true">true</UseStartBeforeLogon>
    <AutomaticCertSelection UserControllable="false">true</AutomaticCertSelection>
    <ShowPreConnectMessage>false</ShowPreConnectMessage>
    <CertificateStore>All</CertificateStore>
    <CertificateStoreMac>All</CertificateStoreMac>
    <CertificateStoreLinux>All</CertificateStoreLinux>
    <CertificateStoreOverride>true</CertificateStoreOverride>
    <ProxySettings>Native</ProxySettings>
    <AllowLocalProxyConnections>true</AllowLocalProxyConnections>
    <AuthenticationTimeout>30</AuthenticationTimeout>
    <AutoConnectOnStart UserControllable="true">false</AutoConnectOnStart>
    <MinimizeOnConnect UserControllable="true">true</MinimizeOnConnect>
    <LocalLanAccess UserControllable="true">false</LocalLanAccess>
    <DisableCaptivePortalDetection UserControllable="true">false</DisableCaptivePortalDetection>
    <ClearSmartcardPin UserControllable="false">true</ClearSmartcardPin>
    <IPProtocolSupport>IPv4,IPv6</IPProtocolSupport>
    <AutoReconnect UserControllable="false">
    true
    <AutoReconnectBehavior UserControllable="false">ReconnectAfterResume</AutoReconnectBehavior>
    </AutoReconnect>
    <SuspendOnConnectedStandby>false</SuspendOnConnectedStandby>
    <AutoUpdate UserControllable="false">true</AutoUpdate>
    <RSASecurIDIntegration UserControllable="false">Automatic</RSASecurIDIntegration>
    <WindowsLogonEnforcement>SingleLocalLogon</WindowsLogonEnforcement>
    <LinuxLogonEnforcement>SingleLocalLogon</LinuxLogonEnforcement>
    <WindowsVPNEstablishment>AllowRemoteUsers</WindowsVPNEstablishment>
    <LinuxVPNEstablishment>LocalUsersOnly</LinuxVPNEstablishment>
    <AutomaticVPNPolicy>false</AutomaticVPNPolicy>
    <PPPExclusion UserControllable="false">
    Disable
    <PPPExclusionServerIP UserControllable="false"/>
    </PPPExclusion>
    <EnableScripting UserControllable="false">false</EnableScripting>
    <EnableAutomaticServerSelection UserControllable="false">
    false
    <AutoServerSelectionImprovement>20</AutoServerSelectionImprovement>
    <AutoServerSelectionSuspendTime>4</AutoServerSelectionSuspendTime>
    </EnableAutomaticServerSelection>
    <RetainVpnOnLogoff>false </RetainVpnOnLogoff>
    <CaptivePortalRemediationBrowserFailover>false</CaptivePortalRemediationBrowserFailover>
    <AllowManualHostInput>true</AllowManualHostInput>
    </ClientInitialization>
    <ServerList>
    <HostEntry>
    <HostName>FlexVPN HUB</HostName>
    <HostAddress>192.168.50.225</HostAddress>
    <PrimaryProtocol>
    IPsec
    <StandardAuthenticationOnly>
    true
    <AuthMethodDuringIKENegotiation>EAP-MD5</AuthMethodDuringIKENegotiation>
    <IKEIdentity>cisco.example</IKEIdentity>
    </StandardAuthenticationOnly>
    </PrimaryProtocol>
    </HostEntry>
    </ServerList>
    </AnyConnectProfile>

    • <HostName> - The alias used to refer to the host, IP address, or Full-Qualified Domain Name (FQDN). This is displayed in the CSC box.
    • <HostAddress> - IP address or FQDN of the FlexVPN hub.
    • <PrimaryProtocol> - Must be set to IPsec to force the client to use IKEv2/IPsec instead of SSL.
    • <AuthMethodDuringIKENegotiation> - Must be set to use EAP-MD5 within EAP. This is required for authentication against the ISE server.
    • <IKEIdentity> - This string is sent by the client as the ID_GROUP type ID payload. This can be used to match the client to a specific IKEv2 profile on the hub.

    Verify

    Step 1. Navigate to the client machine where CSC is installed. Connect to the FlexVPN hub and enter the user1 credentials:

    User1 CredentialsUser1 Credentials

    Step 2. Once the connection is established, click the gear icon (lower left corner) and navigate to AnyConnectVPN > Statistics. Confirm in the Address Information section that the IP address assigned belongs to the pool configured for group1:

    User1 StatisticsUser1 Statistics

    Navigate to AnyConnectVPN > Route details and confirm the information displayed corresponds to the secure routes and DNS configured for group1:

    User1 Route DetailsUser1 Route Details

    Step 3. Repeat step 1 and 2 with user2 credentials to check the information matches the values configured on ISE Authorization policy for this group: 

    User2 CredentialsUser2 Credentials

    User2 StatisticsUser2 Statistics

    User2 Route DetailsUser2 Route Details

    Troubleshoot

    Debugs and Logs

    On Cisco router:

    1.  Use the IKEv2 and IPSec debugs to verify the negotiation between the headend and the client:

      debug crypto ikev2
      debug crypto ikev2 packet
      debug crypto ikev2 error
      debug crypto ikev2 internal
      debug crypto ipsec 
      debug crypto ipsec error
    2.  Use AAA debugs to verify the assignment of local and/or remote attributes:

      debug aaa authorization
      debug aaa authentication
      debug radius authentication

    On ISE:

    • RADIUS live logs

    Working Scenario

    The next outputs are examples of the successful connections:

    • User1 debug output:

    Jan 30 02:57:21.088: AAA/BIND(000000FF): Bind i/f 
    Jan 30 02:57:21.088: AAA/AUTHEN/LOGIN (000000FF): Pick method list 'FlexVPN-Authentication-List' 
    Jan 30 02:57:21.088: RADIUS/ENCODE(000000FF):Orig. component type = VPN IPSEC
    Jan 30 02:57:21.088: RADIUS/ENCODE(000000FF): dropping service type, "radius-server attribute 6 on-for-login-auth" is off
    Jan 30 02:57:21.088: RADIUS(000000FF): Config NAS IP: 0.0.0.0
    Jan 30 02:57:21.088: vrfid: [65535] ipv6 tableid : [0]
    Jan 30 02:57:21.088: idb is NULL
    Jan 30 02:57:21.088: RADIUS(000000FF): Config NAS IPv6: ::
    Jan 30 02:57:21.089: RADIUS/ENCODE(000000FF): acct_session_id: 4245
    Jan 30 02:57:21.089: RADIUS(000000FF): sending
    Jan 30 02:57:21.089: RADIUS/ENCODE: Best Local IP-Address 192.168.30.100 for Radius-Server 192.168.30.110
    Jan 30 02:57:21.089: RADIUS: Message Authenticator encoded
    Jan 30 02:57:21.089: RADIUS(000000FF): Send Access-Request to 192.168.30.110:1645 id 1645/85, len 229
    RADIUS: authenticator C9 82 15 29 AF 4B 17 61 - 27 F4 5C 27 C2 C3 50 34
    Jan 30 02:57:21.089: RADIUS: Service-Type [6] 6 Login [1]
    Jan 30 02:57:21.089: RADIUS: Vendor, Cisco [26] 26 
    Jan 30 02:57:21.089: RADIUS: Cisco AVpair [1] 20 "service-type=Login"
    Jan 30 02:57:21.089: RADIUS: Vendor, Cisco [26] 36 
    Jan 30 02:57:21.089: RADIUS: Cisco AVpair [1] 30 "isakmp-phase1-id=cisco.example"
    Jan 30 02:57:21.089: RADIUS: Calling-Station-Id [31] 13 "192.168.50.130"
    Jan 30 02:57:21.089: RADIUS: Vendor, Cisco [26] 64 
    Jan 30 02:57:21.089: RADIUS: Cisco AVpair [1] 58 "audit-session-id=L2L42F2F0116ZO2L42F2F016FZH1194CAE2ZN1F"
    Jan 30 02:57:21.089: RADIUS: User-Name [1] 7 "user1"
    Jan 30 02:57:21.089: RADIUS: Vendor, Cisco [26] 21 
    Jan 30 02:57:21.089: RADIUS: Cisco AVpair [1] 15 "coa-push=true"
    Jan 30 02:57:21.089: RADIUS: EAP-Message [79] 12 
    RADIUS: 02 3B 00 0A 01 75 73 65 72 31 [ ;user1]
    Jan 30 02:57:21.089: RADIUS: Message-Authenticato[80] 18 
    RADIUS: E7 22 65 E0 DC 03 3A 49 0B 01 49 2A D5 3F AD 4F [ "e:II*?O]
    Jan 30 02:57:21.089: RADIUS: NAS-IP-Address [4] 6 192.168.30.100 
    Jan 30 02:57:21.089: RADIUS(000000FF): Sending a IPv4 Radius Packet
    Jan 30 02:57:21.090: RADIUS(000000FF): Started 5 sec timeout
    Jan 30 02:57:21.094: RADIUS: Received from id 1645/85 192.168.30.110:1645, Access-Challenge, len 137
    RADIUS: authenticator 67 2B 9D 9C 4D 1F F3 E8 - F6 EC 9B EB 8E 49 C8 A5
    Jan 30 02:57:21.094: RADIUS: State [24] 91 
    RADIUS: 35 32 43 50 4D 53 65 73 73 69 6F 6E 49 44 3D 4C [52CPMSessionID=L]
    RADIUS: 32 4C 34 32 46 32 46 30 31 31 36 5A 4F 32 4C 34 [2L42F2F0116ZO2L4]
    RADIUS: 32 46 32 46 30 31 36 46 5A 48 31 31 39 34 43 41 [2F2F016FZH1194CA]
    RADIUS: 45 32 5A 4E 31 46 3B 33 31 53 65 73 73 69 6F 6E [E2ZN1F;31Session]
    RADIUS: 49 44 3D 49 53 45 2D 44 49 41 4E 2F 34 39 33 30 [ID=ISE-SERVER/4930]
    RADIUS: 38 30 30 31 38 2F 32 39 3B [ 80018/29;]
    Jan 30 02:57:21.094: RADIUS: EAP-Message [79] 8 
    RADIUS: 01 52 00 06 0D 20 [ R ]
    Jan 30 02:57:21.094: RADIUS: Message-Authenticato[80] 18 
    RADIUS: 38 8A B1 31 72 62 06 40 4F D4 58 48 E8 36 E7 80 [ 81rb@OXH6]
    Jan 30 02:57:21.094: RADIUS(000000FF): Received from id 1645/85
    RADIUS/DECODE: EAP-Message fragments, 6, total 6 bytes
    Jan 30 02:57:21.097: AAA/AUTHEN/LOGIN (000000FF): Pick method list 'FlexVPN-Authentication-List' 
    Jan 30 02:57:21.097: RADIUS/ENCODE(000000FF):Orig. component type = VPN IPSEC
    Jan 30 02:57:21.097: RADIUS/ENCODE(000000FF): dropping service type, "radius-server attribute 6 on-for-login-auth" is off
    Jan 30 02:57:21.097: RADIUS(000000FF): Config NAS IP: 0.0.0.0
    Jan 30 02:57:21.097: vrfid: [65535] ipv6 tableid : [0]
    Jan 30 02:57:21.097: idb is NULL
    Jan 30 02:57:21.097: RADIUS(000000FF): Config NAS IPv6: ::
    Jan 30 02:57:21.097: RADIUS/ENCODE(000000FF): acct_session_id: 4245
    Jan 30 02:57:21.097: RADIUS(000000FF): sending
    Jan 30 02:57:21.097: RADIUS/ENCODE: Best Local IP-Address 192.168.30.100 for Radius-Server 192.168.30.110
    Jan 30 02:57:21.097: RADIUS: Message Authenticator encoded
    Jan 30 02:57:21.097: RADIUS(000000FF): Send Access-Request to 192.168.30.110:1645 id 1645/86, len 316
    RADIUS: authenticator 93 07 42 CC D1 90 31 68 - 56 D0 D0 5A 35 C3 67 BC
    Jan 30 02:57:21.097: RADIUS: Service-Type [6] 6 Login [1]
    Jan 30 02:57:21.097: RADIUS: Vendor, Cisco [26] 26 
    Jan 30 02:57:21.098: RADIUS: Cisco AVpair [1] 20 "service-type=Login"
    Jan 30 02:57:21.098: RADIUS: Vendor, Cisco [26] 36 
    Jan 30 02:57:21.098: RADIUS: Cisco AVpair [1] 30 "isakmp-phase1-id=cisco.example"
    Jan 30 02:57:21.098: RADIUS: Calling-Station-Id [31] 13 "192.168.50.130"
    Jan 30 02:57:21.098: RADIUS: Vendor, Cisco [26] 64 
    Jan 30 02:57:21.098: RADIUS: Cisco AVpair [1] 58 "audit-session-id=L2L42F2F0116ZO2L42F2F016FZH1194CAE2ZN1F"
    Jan 30 02:57:21.098: RADIUS: User-Name [1] 7 "user1"
    Jan 30 02:57:21.098: RADIUS: Vendor, Cisco [26] 21 
    Jan 30 02:57:21.098: RADIUS: Cisco AVpair [1] 15 "coa-push=true"
    Jan 30 02:57:21.098: RADIUS: EAP-Message [79] 8 
    RADIUS: 02 52 00 06 03 04 [ R]
    Jan 30 02:57:21.098: RADIUS: Message-Authenticato[80] 18 
    RADIUS: E0 67 24 D3 BB CF D9 E0 EE 44 98 8A 26 64 AC C9 [ g$D&d]
    Jan 30 02:57:21.098: RADIUS: State [24] 91 
    RADIUS: 35 32 43 50 4D 53 65 73 73 69 6F 6E 49 44 3D 4C [52CPMSessionID=L]
    RADIUS: 32 4C 34 32 46 32 46 30 31 31 36 5A 4F 32 4C 34 [2L42F2F0116ZO2L4]
    RADIUS: 32 46 32 46 30 31 36 46 5A 48 31 31 39 34 43 41 [2F2F016FZH1194CA]
    RADIUS: 45 32 5A 4E 31 46 3B 33 31 53 65 73 73 69 6F 6E [E2ZN1F;31Session]
    RADIUS: 49 44 3D 49 53 45 2D 44 49 41 4E 2F 34 39 33 30 [ID=ISE-SERVER/4930]
    RADIUS: 38 30 30 31 38 2F 32 39 3B [ 80018/29;]
    Jan 30 02:57:21.098: RADIUS: NAS-IP-Address [4] 6 192.168.30.100 
    Jan 30 02:57:21.098: RADIUS(000000FF): Sending a IPv4 Radius Packet
    Jan 30 02:57:21.099: RADIUS(000000FF): Started 5 sec timeout
    Jan 30 02:57:21.101: RADIUS: Received from id 1645/86 192.168.30.110:1645, Access-Challenge, len 161
    RADIUS: authenticator 42 A3 5F E0 92 13 51 13 - B2 80 56 A3 91 36 BD A1
    Jan 30 02:57:21.101: RADIUS: State [24] 91 
    RADIUS: 35 32 43 50 4D 53 65 73 73 69 6F 6E 49 44 3D 4C [52CPMSessionID=L]
    RADIUS: 32 4C 34 32 46 32 46 30 31 31 36 5A 4F 32 4C 34 [2L42F2F0116ZO2L4]
    RADIUS: 32 46 32 46 30 31 36 46 5A 48 31 31 39 34 43 41 [2F2F016FZH1194CA]
    RADIUS: 45 32 5A 4E 31 46 3B 33 31 53 65 73 73 69 6F 6E [E2ZN1F;31Session]
    RADIUS: 49 44 3D 49 53 45 2D 44 49 41 4E 2F 34 39 33 30 [ID=ISE-SERVER/4930]
    RADIUS: 38 30 30 31 38 2F 32 39 3B [ 80018/29;]
    Jan 30 02:57:21.101: RADIUS: EAP-Message [79] 32 
    RADIUS: 01 53 00 1E 04 10 D7 61 AE 69 3B 88 A1 83 E4 EC 0F B6 EF 68 58 16 49 53 45 2D 44 49 41 4E [ Sai;hXISE-SERVER]
    Jan 30 02:57:21.101: RADIUS: Message-Authenticato[80] 18 
    RADIUS: 3E C9 C1 E1 F2 3B 4E 4C DF CF AC 21 AA E9 C3 F0 [ >;NL!]
    Jan 30 02:57:21.101: RADIUS(000000FF): Received from id 1645/86
    RADIUS/DECODE: EAP-Message fragments, 30, total 30 bytes
    Jan 30 02:57:21.103: AAA/AUTHEN/LOGIN (000000FF): Pick method list 'FlexVPN-Authentication-List' 
    Jan 30 02:57:21.103: RADIUS/ENCODE(000000FF):Orig. component type = VPN IPSEC
    Jan 30 02:57:21.103: RADIUS/ENCODE(000000FF): dropping service type, "radius-server attribute 6 on-for-login-auth" is off
    Jan 30 02:57:21.103: RADIUS(000000FF): Config NAS IP: 0.0.0.0
    Jan 30 02:57:21.103: vrfid: [65535] ipv6 tableid : [0]
    Jan 30 02:57:21.104: idb is NULL
    Jan 30 02:57:21.104: RADIUS(000000FF): Config NAS IPv6: ::
    Jan 30 02:57:21.104: RADIUS/ENCODE(000000FF): acct_session_id: 4245
    Jan 30 02:57:21.104: RADIUS(000000FF): sending
    Jan 30 02:57:21.104: RADIUS/ENCODE: Best Local IP-Address 192.168.30.100 for Radius-Server 192.168.30.110
    Jan 30 02:57:21.104: RADIUS: Message Authenticator encoded
    Jan 30 02:57:21.104: RADIUS(000000FF): Send Access-Request to 192.168.30.110:1645 id 1645/87, len 332
    RADIUS: authenticator 89 35 9C C5 06 FB 04 B7 - 4E A3 B2 5F 2B 15 4F 46
    Jan 30 02:57:21.104: RADIUS: Service-Type [6] 6 Login [1]
    Jan 30 02:57:21.104: RADIUS: Vendor, Cisco [26] 26 
    Jan 30 02:57:21.104: RADIUS: Cisco AVpair [1] 20 "service-type=Login"
    Jan 30 02:57:21.104: RADIUS: Vendor, Cisco [26] 36 
    Jan 30 02:57:21.104: RADIUS: Cisco AVpair [1] 30 "isakmp-phase1-id=cisco.example"
    Jan 30 02:57:21.104: RADIUS: Calling-Station-Id [31] 13 "192.168.50.130"
    Jan 30 02:57:21.104: RADIUS: Vendor, Cisco [26] 64 
    Jan 30 02:57:21.104: RADIUS: Cisco AVpair [1] 58 "audit-session-id=L2L42F2F0116ZO2L42F2F016FZH1194CAE2ZN1F"
    Jan 30 02:57:21.104: RADIUS: User-Name [1] 7 "user1"
    Jan 30 02:57:21.104: RADIUS: Vendor, Cisco [26] 21 
    Jan 30 02:57:21.104: RADIUS: Cisco AVpair [1] 15 "coa-push=true"
    Jan 30 02:57:21.104: RADIUS: EAP-Message [79] 24 
    RADIUS: 02 53 00 16 04 10 B0 BB 3E D5 B1 D6 01 FC 9A B7 4A DB AB F7 2F B6 [ S>J/]
    Jan 30 02:57:21.104: RADIUS: Message-Authenticato[80] 18 
    RADIUS: 79 43 97 A7 26 17 3E 3B 54 B4 90 D4 76 0F E0 14 [ yC&>;Tv]
    Jan 30 02:57:21.104: RADIUS: State [24] 91 
    RADIUS: 35 32 43 50 4D 53 65 73 73 69 6F 6E 49 44 3D 4C [52CPMSessionID=L]
    RADIUS: 32 4C 34 32 46 32 46 30 31 31 36 5A 4F 32 4C 34 [2L42F2F0116ZO2L4]
    RADIUS: 32 46 32 46 30 31 36 46 5A 48 31 31 39 34 43 41 [2F2F016FZH1194CA]
    RADIUS: 45 32 5A 4E 31 46 3B 33 31 53 65 73 73 69 6F 6E [E2ZN1F;31Session]
    RADIUS: 49 44 3D 49 53 45 2D 44 49 41 4E 2F 34 39 33 30 [ID=ISE-SERVER/4930]
    RADIUS: 38 30 30 31 38 2F 32 39 3B [ 80018/29;]
    Jan 30 02:57:21.104: RADIUS: NAS-IP-Address [4] 6 192.168.30.100 
    Jan 30 02:57:21.105: RADIUS(000000FF): Sending a IPv4 Radius Packet
    Jan 30 02:57:21.105: RADIUS(000000FF): Started 5 sec timeout
    Jan 30 02:57:21.170: RADIUS: Received from id 1645/87 192.168.30.110:1645, Access-Accept, len 233
    RADIUS: authenticator 75 F6 05 85 1D A0 C3 EE - F8 81 F9 02 38 AC C1 B6
    Jan 30 02:57:21.170: RADIUS: User-Name [1] 7 "user1"
    Jan 30 02:57:21.170: RADIUS: Class [25] 68 
    RADIUS: 43 41 43 53 3A 4C 32 4C 34 32 46 32 46 30 31 31 [CACS:L2L42F2F011]
    RADIUS: 36 5A 4F 32 4C 34 32 46 32 46 30 31 36 46 5A 48 [6ZO2L42F2F016FZH]
    RADIUS: 31 31 39 34 43 41 45 32 5A 4E 31 46 3A 49 53 45 [1194CAE2ZN1F:ISE]
    RADIUS: 2D 44 49 41 4E 2F 34 39 33 30 38 30 30 31 38 2F [-DIAN/493080018/]
    RADIUS: 32 39 [ 29]
    Jan 30 02:57:21.170: RADIUS: EAP-Message [79] 6 
    RADIUS: 03 53 00 04 [ S]
    Jan 30 02:57:21.170: RADIUS: Message-Authenticato[80] 18 
    RADIUS: 8A A9 CC 07 61 A2 6D BA E4 EB B5 B7 73 0E EC 28 [ ams(]
    Jan 30 02:57:21.170: RADIUS: Vendor, Cisco [26] 37 
    Jan 30 02:57:21.170: RADIUS: Cisco AVpair [1] 31 "ipsec:dns-servers=10.0.50.101"
    Jan 30 02:57:21.170: RADIUS: Vendor, Cisco [26] 47 
    Jan 30 02:57:21.170: RADIUS: Cisco AVpair [1] 41 "ipsec:route-set=prefix 192.168.100.0/24"
    Jan 30 02:57:21.170: RADIUS: Vendor, Cisco [26] 30 
    Jan 30 02:57:21.170: RADIUS: Cisco AVpair [1] 24 "ipsec:addr-pool=group1"
    Jan 30 02:57:21.171: RADIUS(000000FF): Received from id 1645/87
    RADIUS/DECODE: EAP-Message fragments, 4, total 4 bytes
    Jan 30 02:57:21.175: AAA/BIND(00000100): Bind i/f 
    Jan 30 02:57:21.175: AAA/AUTHOR (0x100): Pick method list 'FlexVPN-Authorization-List'
    Jan 30 02:57:21.176: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1, changed state to down
    Jan 30 02:57:21.192: %SYS-5-CONFIG_P: Configured programmatically by process Crypto INT from console as console
    Jan 30 02:57:21.376: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1, changed state to up
    • User2 debug output:
    Jan 30 03:28:58.102: AAA/BIND(00000103): Bind i/f 
    Jan 30 03:28:58.102: AAA/AUTHEN/LOGIN (00000103): Pick method list 'FlexVPN-Authentication-List' 
    Jan 30 03:28:58.103: RADIUS/ENCODE(00000103):Orig. component type = VPN IPSEC
    Jan 30 03:28:58.103: RADIUS/ENCODE(00000103): dropping service type, "radius-server attribute 6 on-for-login-auth" is off
    Jan 30 03:28:58.103: RADIUS(00000103): Config NAS IP: 0.0.0.0
    Jan 30 03:28:58.103: vrfid: [65535] ipv6 tableid : [0]
    Jan 30 03:28:58.103: idb is NULL
    Jan 30 03:28:58.103: RADIUS(00000103): Config NAS IPv6: ::
    Jan 30 03:28:58.103: RADIUS/ENCODE(00000103): acct_session_id: 4249
    Jan 30 03:28:58.103: RADIUS(00000103): sending
    Jan 30 03:28:58.103: RADIUS/ENCODE: Best Local IP-Address 192.168.30.100 for Radius-Server 192.168.30.110
    Jan 30 03:28:58.103: RADIUS: Message Authenticator encoded
    Jan 30 03:28:58.103: RADIUS(00000103): Send Access-Request to 192.168.30.110:1645 id 1645/88, len 229
    RADIUS: authenticator 71 99 09 63 19 F7 D7 0B - 1D A9 4E 64 28 6F A5 64
    Jan 30 03:28:58.103: RADIUS: Service-Type [6] 6 Login [1]
    Jan 30 03:28:58.103: RADIUS: Vendor, Cisco [26] 26 
    Jan 30 03:28:58.103: RADIUS: Cisco AVpair [1] 20 "service-type=Login"
    Jan 30 03:28:58.103: RADIUS: Vendor, Cisco [26] 36 
    Jan 30 03:28:58.104: RADIUS: Cisco AVpair [1] 30 "isakmp-phase1-id=cisco.example"
    Jan 30 03:28:58.104: RADIUS: Calling-Station-Id [31] 13 "192.168.50.130"
    Jan 30 03:28:58.104: RADIUS: Vendor, Cisco [26] 64 
    Jan 30 03:28:58.104: RADIUS: Cisco AVpair [1] 58 "audit-session-id=L2L42F2F0116ZO2L42F2F016FZH1194E444ZN20"
    Jan 30 03:28:58.104: RADIUS: User-Name [1] 7 "user2"
    Jan 30 03:28:58.104: RADIUS: Vendor, Cisco [26] 21 
    Jan 30 03:28:58.104: RADIUS: Cisco AVpair [1] 15 "coa-push=true"
    Jan 30 03:28:58.104: RADIUS: EAP-Message [79] 12 
    RADIUS: 02 3B 00 0A 01 75 73 65 72 32 [ ;user2]
    Jan 30 03:28:58.104: RADIUS: Message-Authenticato[80] 18 
    RADIUS: 12 62 2F 51 12 FC F7 EC F0 87 E0 34 1E F1 AD E5 [ b/Q4]
    Jan 30 03:28:58.104: RADIUS: NAS-IP-Address [4] 6 192.168.30.100 
    Jan 30 03:28:58.104: RADIUS(00000103): Sending a IPv4 Radius Packet
    Jan 30 03:28:58.105: RADIUS(00000103): Started 5 sec timeout
    Jan 30 03:28:58.109: RADIUS: Received from id 1645/88 192.168.30.110:1645, Access-Challenge, len 137
    RADIUS: authenticator 98 04 01 EA CD 9B 1E A9 - DC 6F 2F 17 1F 2A 5F 43
    Jan 30 03:28:58.109: RADIUS: State [24] 91 
    RADIUS: 35 32 43 50 4D 53 65 73 73 69 6F 6E 49 44 3D 4C [52CPMSessionID=L]
    RADIUS: 32 4C 34 32 46 32 46 30 31 31 36 5A 4F 32 4C 34 [2L42F2F0116ZO2L4]
    RADIUS: 32 46 32 46 30 31 36 46 5A 48 31 31 39 34 45 34 [2F2F016FZH1194E4]
    RADIUS: 34 34 5A 4E 32 30 3B 33 31 53 65 73 73 69 6F 6E [44ZN20;31Session]
    RADIUS: 49 44 3D 49 53 45 2D 44 49 41 4E 2F 34 39 33 30 [ID=ISE-SERVER/4930]
    RADIUS: 38 30 30 31 38 2F 33 30 3B [ 80018/30;]
    Jan 30 03:28:58.110: RADIUS: EAP-Message [79] 8 
    RADIUS: 01 35 00 06 0D 20 [ 5 ]
    Jan 30 03:28:58.110: RADIUS: Message-Authenticato[80] 18 
    RADIUS: E3 A6 88 B1 B6 3D 93 1F 39 B3 AE 9E EA 1D BB 15 [ =9]
    Jan 30 03:28:58.110: RADIUS(00000103): Received from id 1645/88
    RADIUS/DECODE: EAP-Message fragments, 6, total 6 bytes
    Jan 30 03:28:58.112: AAA/AUTHEN/LOGIN (00000103): Pick method list 'FlexVPN-Authentication-List' 
    Jan 30 03:28:58.112: RADIUS/ENCODE(00000103):Orig. component type = VPN IPSEC
    Jan 30 03:28:58.112: RADIUS/ENCODE(00000103): dropping service type, "radius-server attribute 6 on-for-login-auth" is off
    Jan 30 03:28:58.112: RADIUS(00000103): Config NAS IP: 0.0.0.0
    Jan 30 03:28:58.112: vrfid: [65535] ipv6 tableid : [0]
    Jan 30 03:28:58.113: idb is NULL
    Jan 30 03:28:58.113: RADIUS(00000103): Config NAS IPv6: ::
    Jan 30 03:28:58.113: RADIUS/ENCODE(00000103): acct_session_id: 4249
    Jan 30 03:28:58.113: RADIUS(00000103): sending
    Jan 30 03:28:58.113: RADIUS/ENCODE: Best Local IP-Address 192.168.30.100 for Radius-Server 192.168.30.110
    Jan 30 03:28:58.113: RADIUS: Message Authenticator encoded
    Jan 30 03:28:58.113: RADIUS(00000103): Send Access-Request to 192.168.30.110:1645 id 1645/89, len 316
    RADIUS: authenticator 56 BD F0 9A 4B 16 5C 6C - 4E 41 00 56 8D C0 3A 8C
    Jan 30 03:28:58.113: RADIUS: Service-Type [6] 6 Login [1]
    Jan 30 03:28:58.113: RADIUS: Vendor, Cisco [26] 26 
    Jan 30 03:28:58.113: RADIUS: Cisco AVpair [1] 20 "service-type=Login"
    Jan 30 03:28:58.113: RADIUS: Vendor, Cisco [26] 36 
    Jan 30 03:28:58.113: RADIUS: Cisco AVpair [1] 30 "isakmp-phase1-id=cisco.example"
    Jan 30 03:28:58.113: RADIUS: Calling-Station-Id [31] 13 "192.168.50.130"
    Jan 30 03:28:58.113: RADIUS: Vendor, Cisco [26] 64 
    Jan 30 03:28:58.113: RADIUS: Cisco AVpair [1] 58 "audit-session-id=L2L42F2F0116ZO2L42F2F016FZH1194E444ZN20"
    Jan 30 03:28:58.113: RADIUS: User-Name [1] 7 "user2"
    Jan 30 03:28:58.113: RADIUS: Vendor, Cisco [26] 21 
    Jan 30 03:28:58.113: RADIUS: Cisco AVpair [1] 15 "coa-push=true"
    Jan 30 03:28:58.113: RADIUS: EAP-Message [79] 8 
    RADIUS: 02 35 00 06 03 04 [ 5]
    Jan 30 03:28:58.113: RADIUS: Message-Authenticato[80] 18 
    RADIUS: 47 1F 36 A7 C3 9B 90 6E 03 2C B8 D7 FE A7 13 44 [ G6n,D]
    Jan 30 03:28:58.113: RADIUS: State [24] 91 
    RADIUS: 35 32 43 50 4D 53 65 73 73 69 6F 6E 49 44 3D 4C [52CPMSessionID=L]
    RADIUS: 32 4C 34 32 46 32 46 30 31 31 36 5A 4F 32 4C 34 [2L42F2F0116ZO2L4]
    RADIUS: 32 46 32 46 30 31 36 46 5A 48 31 31 39 34 45 34 [2F2F016FZH1194E4]
    RADIUS: 34 34 5A 4E 32 30 3B 33 31 53 65 73 73 69 6F 6E [44ZN20;31Session]
    RADIUS: 49 44 3D 49 53 45 2D 44 49 41 4E 2F 34 39 33 30 [ID=ISE-SERVER/4930]
    RADIUS: 38 30 30 31 38 2F 33 30 3B [ 80018/30;]
    Jan 30 03:28:58.114: RADIUS: NAS-IP-Address [4] 6 192.168.30.100 
    Jan 30 03:28:58.114: RADIUS(00000103): Sending a IPv4 Radius Packet
    Jan 30 03:28:58.114: RADIUS(00000103): Started 5 sec timeout
    Jan 30 03:28:58.116: RADIUS: Received from id 1645/89 192.168.30.110:1645, Access-Challenge, len 161
    RADIUS: authenticator 84 A3 30 3D 80 BC 71 42 - 1B 9B 49 EF 0B 1B 02 02
    Jan 30 03:28:58.116: RADIUS: State [24] 91 
    RADIUS: 35 32 43 50 4D 53 65 73 73 69 6F 6E 49 44 3D 4C [52CPMSessionID=L]
    RADIUS: 32 4C 34 32 46 32 46 30 31 31 36 5A 4F 32 4C 34 [2L42F2F0116ZO2L4]
    RADIUS: 32 46 32 46 30 31 36 46 5A 48 31 31 39 34 45 34 [2F2F016FZH1194E4]
    RADIUS: 34 34 5A 4E 32 30 3B 33 31 53 65 73 73 69 6F 6E [44ZN20;31Session]
    RADIUS: 49 44 3D 49 53 45 2D 44 49 41 4E 2F 34 39 33 30 [ID=ISE-SERVER/4930]
    RADIUS: 38 30 30 31 38 2F 33 30 3B [ 80018/30;]
    Jan 30 03:28:58.116: RADIUS: EAP-Message [79] 32 
    RADIUS: 01 36 00 1E 04 10 EB 9F A5 AC 70 1F 4D D6 48 05 9D EC 1F 29 67 AE 49 53 45 2D 44 49 41 4E [ 6pMH)gISE-SERVER]
    Jan 30 03:28:58.116: RADIUS: Message-Authenticato[80] 18 
    RADIUS: 08 5E BC EF E5 38 50 CD FB 3C B3 E9 99 0A 51 B3 [ ^8P<Q]
    Jan 30 03:28:58.116: RADIUS(00000103): Received from id 1645/89
    RADIUS/DECODE: EAP-Message fragments, 30, total 30 bytes
    Jan 30 03:28:58.118: AAA/AUTHEN/LOGIN (00000103): Pick method list 'FlexVPN-Authentication-List' 
    Jan 30 03:28:58.118: RADIUS/ENCODE(00000103):Orig. component type = VPN IPSEC
    Jan 30 03:28:58.118: RADIUS/ENCODE(00000103): dropping service type, "radius-server attribute 6 on-for-login-auth" is off
    Jan 30 03:28:58.118: RADIUS(00000103): Config NAS IP: 0.0.0.0
    Jan 30 03:28:58.118: vrfid: [65535] ipv6 tableid : [0]
    Jan 30 03:28:58.118: idb is NULL
    Jan 30 03:28:58.118: RADIUS(00000103): Config NAS IPv6: ::
    Jan 30 03:28:58.118: RADIUS/ENCODE(00000103): acct_session_id: 4249
    Jan 30 03:28:58.118: RADIUS(00000103): sending
    Jan 30 03:28:58.118: RADIUS/ENCODE: Best Local IP-Address 192.168.30.100 for Radius-Server 192.168.30.110
    Jan 30 03:28:58.119: RADIUS: Message Authenticator encoded
    Jan 30 03:28:58.119: RADIUS(00000103): Send Access-Request to 192.168.30.110:1645 id 1645/90, len 332
    RADIUS: authenticator A1 62 1A FB 18 58 7B 47 - 5C 8A 64 FA B7 23 9B BE
    Jan 30 03:28:58.119: RADIUS: Service-Type [6] 6 Login [1]
    Jan 30 03:28:58.119: RADIUS: Vendor, Cisco [26] 26 
    Jan 30 03:28:58.119: RADIUS: Cisco AVpair [1] 20 "service-type=Login"
    Jan 30 03:28:58.119: RADIUS: Vendor, Cisco [26] 36 
    Jan 30 03:28:58.119: RADIUS: Cisco AVpair [1] 30 "isakmp-phase1-id=cisco.example"
    Jan 30 03:28:58.119: RADIUS: Calling-Station-Id [31] 13 "192.168.50.130"
    Jan 30 03:28:58.119: RADIUS: Vendor, Cisco [26] 64 
    Jan 30 03:28:58.119: RADIUS: Cisco AVpair [1] 58 "audit-session-id=L2L42F2F0116ZO2L42F2F016FZH1194E444ZN20"
    Jan 30 03:28:58.119: RADIUS: User-Name [1] 7 "user2"
    Jan 30 03:28:58.119: RADIUS: Vendor, Cisco [26] 21 
    Jan 30 03:28:58.119: RADIUS: Cisco AVpair [1] 15 "coa-push=true"
    Jan 30 03:28:58.119: RADIUS: EAP-Message [79] 24 
    RADIUS: 02 36 00 16 04 10 73 B7 F2 42 09 5B AB 21 D8 77 96 A2 F7 C7 83 AD [ 6sB[!w]
    Jan 30 03:28:58.119: RADIUS: Message-Authenticato[80] 18 
    RADIUS: B1 68 3C 25 9E FE 52 13 10 69 E6 BB 17 67 6F 18 [ h<?Rigo]
    Jan 30 03:28:58.119: RADIUS: State [24] 91 
    RADIUS: 35 32 43 50 4D 53 65 73 73 69 6F 6E 49 44 3D 4C [52CPMSessionID=L]
    RADIUS: 32 4C 34 32 46 32 46 30 31 31 36 5A 4F 32 4C 34 [2L42F2F0116ZO2L4]
    RADIUS: 32 46 32 46 30 31 36 46 5A 48 31 31 39 34 45 34 [2F2F016FZH1194E4]
    RADIUS: 34 34 5A 4E 32 30 3B 33 31 53 65 73 73 69 6F 6E [44ZN20;31Session]
    RADIUS: 49 44 3D 49 53 45 2D 44 49 41 4E 2F 34 39 33 30 [ID=ISE-SERVER/4930]
    RADIUS: 38 30 30 31 38 2F 33 30 3B [ 80018/30;]
    Jan 30 03:28:58.119: RADIUS: NAS-IP-Address [4] 6 192.168.30.100 
    Jan 30 03:28:58.119: RADIUS(00000103): Sending a IPv4 Radius Packet
    Jan 30 03:28:58.119: RADIUS(00000103): Started 5 sec timeout
    Jan 30 03:28:58.186: RADIUS: Received from id 1645/90 192.168.30.110:1645, Access-Accept, len 233
    RADIUS: authenticator 48 A5 A0 11 ED B8 C2 87 - 35 30 17 D5 6D D7 B4 FD
    Jan 30 03:28:58.186: RADIUS: User-Name [1] 7 "user2"
    Jan 30 03:28:58.186: RADIUS: Class [25] 68 
    RADIUS: 43 41 43 53 3A 4C 32 4C 34 32 46 32 46 30 31 31 [CACS:L2L42F2F011]
    RADIUS: 36 5A 4F 32 4C 34 32 46 32 46 30 31 36 46 5A 48 [6ZO2L42F2F016FZH]
    RADIUS: 31 31 39 34 45 34 34 34 5A 4E 32 30 3A 49 53 45 [1194E444ZN20:ISE]
    RADIUS: 2D 44 49 41 4E 2F 34 39 33 30 38 30 30 31 38 2F [-DIAN/493080018/]
    RADIUS: 33 30 [ 30]
    Jan 30 03:28:58.186: RADIUS: EAP-Message [79] 6 
    RADIUS: 03 36 00 04 [ 6]
    Jan 30 03:28:58.186: RADIUS: Message-Authenticato[80] 18 
    RADIUS: 9E A6 D9 56 40 C8 EB 08 69 8C E1 35 35 53 18 83 [ V@i55S]
    Jan 30 03:28:58.187: RADIUS: Vendor, Cisco [26] 37 
    Jan 30 03:28:58.187: RADIUS: Cisco AVpair [1] 31 "ipsec:dns-servers=10.0.50.202"
    Jan 30 03:28:58.187: RADIUS: Vendor, Cisco [26] 47 
    Jan 30 03:28:58.187: RADIUS: Cisco AVpair [1] 41 "ipsec:route-set=prefix 192.168.200.0/24"
    Jan 30 03:28:58.187: RADIUS: Vendor, Cisco [26] 30 
    Jan 30 03:28:58.187: RADIUS: Cisco AVpair [1] 24 "ipsec:addr-pool=group2"
    Jan 30 03:28:58.187: RADIUS(00000103): Received from id 1645/90
    RADIUS/DECODE: EAP-Message fragments, 4, total 4 bytes
    Jan 30 03:28:58.190: AAA/BIND(00000104): Bind i/f 
    Jan 30 03:28:58.190: AAA/AUTHOR (0x104): Pick method list 'FlexVPN-Authorization-List'
    Jan 30 03:28:58.192: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to down
    Jan 30 03:28:58.209: %SYS-5-CONFIG_P: Configured programmatically by process Crypto INT from console as console
    Jan 30 03:28:58.398: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access2, changed state to up

    Related Information

    Revision History

    Revision Publish Date Comments
    1.0
    06-Feb-2024
    Initial Release
    TAC Authored

    Contributed by Cisco Engineers

    • Diana Aguilar Martinez
      Cisco Security Technical Consulting Engineer

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco

    This Document Applies to These Products