Tutorial: Configure Active Directory (Windows Server) RADIUS Protocol for Access Server⁠

Add a new RADIUS client⁠

1. Open Server Manager on your Windows Server.

2. Click Tools > Network Policy Server.

3. Under NPS, expand RADIUS Clients and Servers.

4. Right-click RADIUS Clients and click New.

5. Enter the information for your new RADIUS client:

   • Friendly name: Enter a descriptive name such as "Access Server."

   • Address (IP or DNS): Enter the public IP address of your Access Server.

   • Shared Secret: Click the Generate radio button, then click Generate below.

6. Click OK.

Add a Network Policy⁠

1. From the Network Policy Server window, expand Policies, right-click on Network Policies, and click New.

2. Enter the information for your new network policy:

   • Policy name: Enter a descriptive name such as "Access Server Policy."

   • Type of network access server: Leave this unspecified.

3. Click Next.

4. In the Specify Conditions window, click Add...

5. Click Windows Groups and click Add...

6. Click Add Groups... to add new group memberships.

7. Specify the group names you want to grant access to; for example, we allow access to the group “VPN Users.” You can add multiple groups.

8. Click OK for the Select Group window and OK for the Windows Groups window.

9. From the Specify Conditions window, click Add… to (optionally) also specify the IP address of the RADIUS client that forwards connection requests to the network policy server.

10. Under RADIUS Client Properties, click Client IPv4 Address and click Add…

11. Specify your Access Server's IP address and click OK.

12. From the Specify Conditions window, click Next.

13. Leave the default permissions selected with Access granted and click Next.

14. In the Configuration Authentication Methods window, under EAP Types click Add…

15. Click Microsoft: Secured password (EAP-MSCHAP V2) and click OK.

16. From the Configure Authentication Methods windows, click Next.

17. Accept the default constraints and click Next.

18. Accept the default settings for the network policy and click Next.

19. Click Finish to complete the new network policy.

Ensure your policy is accessible⁠

From the Network Policy Server window, ensure that your new policy is listed above any blocked policy. A blocked policy is denoted with a red X. If your new policy appears at the bottom of the blocked policies, your clients can’t authenticate against the server. To fix this:

1. Right-click on the new policy.

2. Click Move Up until your policy is above the blocked policies.