Prompted Everytime For Cisco VPN Password After iphone 3G 3.0 OS Update FIX

Question

Level 1

0 points

Prompted Everytime For Cisco VPN Password After iphone 3G 3.0 OS Update FIX

I did the 3.0 OS update for my iphone 3G. All works great except when at home or on the 3G network, I dicovered that trying to VPN to work for Microsoft Outlook Exchange, I keep getting asked for my password. The firewall at work is a Cisco ASA 5505 with the latest firmware. The fix was to configure the Cisco firewall VPN user account to allow the client to save the password locally. The default for Cisco is "iherit". you must goto the user account and un-check the "inherit" and then the option of "NO" or "YES" can be selected. I set this setting to "YES". Then go back and recreate the VPN account on the iphone entering the username, password, group name and secret (IPSEC For Cisco) and save the settings. Test VPN using G3 and all should be good! The Older 2.2.1 OS actually had a security bug that allowed the iphone to save the password regardless of the firewall's settings but in the 3.0 OS upgrade it is actually fixed. Richie

Iphone 3G ---3.0 OS

Posted on Jun 19, 2009 9:03 AM

Reply

Answer 1

Gesux

Level 1

5 points

Jul 20, 2009 2:52 PM in response to Eldeboron

Thanks for your post, I have the same problem, but when I asked IT about this, they told me that we authenticate users in a different way.

You wrote: "*The fix was to configure the Cisco firewall VPN user account to allow the client to save the password locally, you must goto the user account and un-check the "inherit" and then the option of "NO" or "YES" can be selected*"

I'm not from IT, but they told me we are using a Cisco ASA 5520 and using user validation by Radius authentication against Active Directory and IAS (Internet authentication Service)
That we don't handle user authentication by Cisco, so there is no way to tell Cisco to allow the users to store the passwords. What Cisco validates is a Group and then passes the rest to the AD.

Any suggestion?

Reply

Answer 2

Gesux

Level 1

5 points

Jul 21, 2009 11:57 AM in response to Gesux

This is the actual setup we have at our company

It's a Clientless WebVPN access on Cisco ASA 5520. The authentication process for the VPN is configured to use RADIUS (Windows 2003 IAS) for Active Directory authenication.

Reply