{"id":6188,"date":"2013-04-08T07:00:00","date_gmt":"2013-04-08T05:00:00","guid":{"rendered":"http:\/\/nolabnoparty.com\/?p=6188"},"modified":"2014-09-19T09:33:38","modified_gmt":"2014-09-19T07:33:38","slug":"setup-nps-for-radius-authentication-in-active-directory","status":"publish","type":"post","link":"https:\/\/nolabnoparty.com\/en\/setup-nps-for-radius-authentication-in-active-directory\/","title":{"rendered":"Setup NPS for RADIUS authentication in Active Directory"},"content":{"rendered":"

\"radiusad01\"<\/p>\n

The Network Policy Services<\/strong> (NPS) is a service included in Windows Server 2008 acting as RADIUS<\/strong> to authenticate remote clients against Active Directory.<\/p>\n

In Active Directory<\/strong> environment is possible to setup the authentication process through RADIUS<\/strong> with existing accounts configured in the network setting NPS service properly.<\/p>\n

\"radiusad02\"<\/p>\n

 <\/p>\n

Installing NPS service<\/span><\/h2>\n

First step is the installation of the NPS service<\/strong> on the Windows 2008 R2 server. Open the Server Manager<\/strong> and click the option Add Roles<\/strong> to add the new role to the server.<\/p>\n

\"radiusad03\"<\/p>\n

Click Next<\/strong>.<\/p>\n

\"radiusad04\"<\/p>\n

Select Network Policy and Access Services<\/strong> and click Next<\/strong>.<\/p>\n

\"radiusad05\"<\/p>\n

Click Next<\/strong>.<\/p>\n

\"radiusad06\"<\/p>\n

Select Network Policy Server<\/strong> option and click Next<\/strong>.<\/p>\n

\"radiusad07\"<\/p>\n

To perform the installation, click the Install<\/strong> button.<\/p>\n

\"radiusad08\"<\/p>\n

Service components<\/strong> are installed in the server.<\/p>\n

\"radiusad09\"<\/p>\n

Once the procedure ends, the installation result<\/strong> is shown. Click Close<\/strong> button to exit the window.<\/p>\n

\"radiusad10\"<\/p>\n

The service is now installed but needs to be configured<\/strong> to properly work.<\/p>\n

 <\/p>\n

NPS configuration<\/span><\/h2>\n

To proceed with the configuration, access the service from Start > Administrative Tools > Network Policy Server<\/strong>.<\/p>\n

\"radiusad11\"<\/p>\n

Right click on RADIUS Client<\/strong> item to create a new client and select option New<\/strong>.<\/p>\n

\"radiusad12\"<\/p>\n

In the Settings<\/strong> panel, enable the client by flagging option Enable this RADIUS client<\/strong>. Assign a Friendly Name<\/strong> and the server\/router VPN Address (IP or DNS)<\/strong>. To generate the shared secret<\/strong> for the RADIUS <-> Server VPN communication, use the option Generate<\/strong> to automatically create the key paying attention to VPN server specifications because sometimes long strings keys could create some problems. Use option Manual<\/strong> to enter a manual string instead.<\/p>\n

\"radiusad13\"<\/p>\n

Click Advanced<\/strong> and set value RADIUS Standard<\/strong> as Vendor name<\/strong> if the VPN server vendor didn\u2019t provide different advices.<\/p>\n

\"radiusad14\"<\/p>\n

Once the client has been created, from main window of NPS right-click item Network Policies<\/strong> and select option New<\/strong> to create a new policy.<\/p>\n

\"radiusad15\"<\/p>\n

In Policy Name<\/strong> field specify the new policy name. Leave default Unspecified<\/strong> value in Type of network access server<\/strong> field. Click Next<\/strong> to continue.<\/p>\n

\"radiusad16\"<\/p>\n

Click Add<\/strong> button to specify what conditions are evaluated during authentication process.<\/p>\n

\"radiusad17\"<\/p>\n

If the account is authenticated through Active Directory group membership<\/strong>, select Windows Groups<\/strong> item and click Add<\/strong>.<\/p>\n

\"radiusad18\"<\/p>\n

Click Add Groups<\/strong> button to specify the AD group.<\/p>\n

\"radiusad19\"<\/p>\n

Insert AD group and click OK<\/strong>.<\/p>\n

\"radiusad20\"<\/p>\n

Selected AD group is now on the list of Windows Groups<\/strong>. Click OK<\/strong> to continue.<\/p>\n

\"radiusad21\"<\/p>\n

To setup additional conditions, click Add<\/strong> button.<\/p>\n

\"radiusad22\"<\/p>\n

In order to limit authentication requests<\/strong> to a specific VPN server, select condition Client IPv4 Address<\/strong> and click Add<\/strong>.<\/p>\n

\"radiusad23\"<\/p>\n

Enter the VPN server IP Address <\/strong>and click OK<\/strong>.<\/p>\n

\"radiusad24\"<\/p>\n

Completed all the entries, click Next<\/strong> to continue.<\/p>\n

\"radiusad25\"<\/p>\n

Click option Access Granted<\/strong> to enable the access to the system.<\/p>\n

\"radiusad26\"<\/p>\n

In this screen, you define the protocol type<\/strong> used for authentication. Check vendor specifications of your VPN server to select required authentication protocols. To perform EAP authentication for instance, EAP Types<\/strong> must be configured by clicking the Add<\/strong> button.<\/p>\n

\"radiusad27\"<\/p>\n

Select required protocol then click OK<\/strong>.<\/p>\n

\"radiusad28\"<\/p>\n

When authentication protocols have been entered, click Next<\/strong>.<\/p>\n

\"radiusad29\"<\/p>\n

Specify Constraints<\/strong> if requested. Click Next<\/strong>.<\/p>\n

\"radiusad30\"<\/p>\n

From Settings<\/strong> window, set additional attributes requested by the VPN server. For example, Watchguard<\/a> firewalls require Filter-ID<\/strong> attribute to grant VPN access. Click Add<\/strong> button to add a new attribute.<\/p>\n

\"radiusad31\"<\/p>\n

From attributes list select value Filter-ID<\/strong> and click Add<\/strong>.<\/p>\n

\"radiusad32\"<\/p>\n

Click Add<\/strong> to define the attribute information requested by the VPN server for the attribute previously selected.<\/p>\n

\"radiusad33\"<\/p>\n

From the VPN server vendor instructions, insert the right Attribute Information<\/strong> (L2TP-Users in the example) and click OK<\/strong> to confirm.<\/p>\n

\"radiusad34\"<\/p>\n

If some attributes are not longer needed, select and remove them with Remove<\/strong> button.<\/p>\n

\"radiusad35\"<\/p>\n

When the setup is complete, click OK<\/strong>.<\/p>\n

\"radiusad36\"<\/p>\n

A configuration summary<\/strong> is shown with policy conditions and settings. Click Finish<\/strong> to complete the procedure.<\/p>\n

\"radiusad37\"<\/p>\n

To process in the right way the just created policy, move it at the top of the list.<\/strong><\/p>\n

\"radiusad38\"<\/p>\n

For the correct functionality of RADIUS authentication, server must be registered in Active Directory. From main screen of NPS right-click NPS (local)<\/strong> and select option Register server in Active Directory<\/strong>.<\/p>\n

\"radiusad39\"<\/p>\n

Click OK<\/strong> to authorize the local server in AD.<\/p>\n

\"radiusad40\"<\/p>\n

Click OK<\/strong> to complete the server registration step.<\/p>\n

\"radiusad41\"<\/p>\n

RADIUS server configuration<\/strong> is now complete.<\/p>\n

 <\/p>\n

Enable RADIUS authentication<\/span><\/h2>\n

To enable VPN clients authentication in the system, the RADIUS authentication type<\/strong> must be configured in the VPN server.<\/p>\n

\"radiusad42\"<\/p>\n

Enable and insert the correct IP Address<\/strong> of your RADIUS server. Type the Shared Secret<\/strong> previously created. Be careful that typed characters in the Secret field must be the same as defined in the RADIUS server settings otherwise authentication process will fail.<\/p>\n

\"radiusad43\"<\/p>\n

When a VPN connection starts, the client is authenticated through the RADIUS<\/strong> server checking the Active Directory group membership and granting the network access as shown in the Windows log<\/strong>.<\/p>\n

\"radiusad44\"<\/p>\n

If some authentication issues<\/strong> are experienced, looking at the Windows log you can identify where the problem reside.<\/p>\n

\"radiusad45\"<\/p>\n

This solution allows a good authentication management<\/strong> process of remote clients giving the network a higher security level.<\/p>\n

\"\"<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

The Network Policy Services (NPS) is a service included in Windows Server 2008 acting as RADIUS to authenticate remote clients against Active Directory. In Active Directory environment is possible to setup the authentication process through RADIUS with existing accounts configured in the network setting NPS service properly.<\/p>\n","protected":false},"author":3,"featured_media":5929,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":{"linkedin_93tdZWzMZc_93tdZWzMZc":"","facebook_2879994398731222_17841400390232720":"","twitter_113568041_113568041":"","mastodon_115463926174894442_115463926174894442":""},"rop_publish_now_history":[],"rop_publish_now_status":"pending","footnotes":""},"categories":[913,1065],"tags":[668,575,576,578],"class_list":["post-6188","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-active-directory-en","category-microsoft-en","tag-authentication-en","tag-nps-en","tag-radius-en","tag-vpn-en","has_thumb"],"_links":{"self":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/6188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/comments?post=6188"}],"version-history":[{"count":0,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/6188\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media\/5929"}],"wp:attachment":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media?parent=6188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/categories?post=6188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/tags?post=6188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}