Skip to main content

Tutorial: Configure Active Directory (Windows Server) RADIUS Protocol for Access Server

Abstract

This guide provides information for configuring Access Server to authenticate against Active Directory (AD) using the Remote Authentication Dial-in

Overview

This guide provides information for configuring Access Server to authenticate against Active Directory (AD) using the Remote Authentication Dial-in User Service (RADIUS) protocol.

Prerequisites

  • Your Access Server's public IP address.

    Tip

    If you don't know the public IP address, issue an ifconfig command in the terminal of your Access Server instance.

  • Windows Server, Active Directory Domain Services, and Network Policy and Access Services roles installed.

Important

Be aware that using auto-login profiles doesn’t trigger RADIUS authentication and RADIUS accounting requests.

Step 1: Configure the Windows Server

Begin by configuring your RADIUS server.

Add a new RADIUS client

  1. Open Server Manager on your Windows Server.

  2. Click Tools > Network Policy Server.

  3. Under NPS, expand RADIUS Clients and Servers.

  4. Right-click RADIUS Clients and click New.

  5. Enter the information for your new RADIUS client:

    • Friendly name: Enter a descriptive name such as "Access Server."

    • Address (IP or DNS): Enter the public IP address of your Access Server.

    • Shared Secret: Click the Generate radio button, then click Generate below.

  6. Click OK.

Add a Network Policy

  1. From the Network Policy Server window, expand Policies, right-click on Network Policies, and click New.

  2. Enter the information for your new network policy:

    • Policy name: Enter a descriptive name such as "Access Server Policy."

    • Type of network access server: Leave this unspecified.

  3. Click Next.

  4. In the Specify Conditions window, click Add...

  5. Click Windows Groups and click Add...

  6. Click Add Groups... to add new group memberships.

  7. Specify the group names you want to grant access to; for example, we allow access to the group “VPN Users.” You can add multiple groups.

  8. Click OK for the Select Group window and OK for the Windows Groups window.

  9. From the Specify Conditions window, click Add… to (optionally) also specify the IP address of the RADIUS client that forwards connection requests to the network policy server.

  10. Under RADIUS Client Properties, click Client IPv4 Address and click Add…

  11. Specify your Access Server's IP address and click OK.

  12. From the Specify Conditions window, click Next.

  13. Leave the default permissions selected with Access granted and click Next.

  14. In the Configuration Authentication Methods window, under EAP Types click Add…

  15. Click Microsoft: Secured password (EAP-MSCHAP V2) and click OK.

  16. From the Configure Authentication Methods windows, click Next.

  17. Accept the default constraints and click Next.

  18. Accept the default settings for the network policy and click Next.

  19. Click Finish to complete the new network policy.

Tip

We recommend including the Client IPv4 Address condition in your network policy, especially if you have other resources on your network besides your VPN server. Otherwise, it’s possible anyone listed in the group(s) added to the Windows Groups condition can access all your other network resources.

Ensure your policy is accessible

From the Network Policy Server window, ensure that your new policy is listed above any blocked policy. A blocked policy is denoted with a red X. If your new policy appears at the bottom of the blocked policies, your clients can’t authenticate against the server. To fix this:

  1. Right-click on the new policy.

  2. Click Move Up until your policy is above the blocked policies.

Step 2: Configure Access Server

Now you’re ready to configure your Access Server for RADIUS access.

  1. Sign in to your Admin Web UI.

  2. Click Authentication > RADIUS.

  3. If RADIUS isn't enabled, set Enable RADIUS Authentication to Yes.

  4. Enter your RADIUS settings:

    • Hostname or IP Address: Enter your domain controller's IP address.

    • Shared Secret: Enter the long text string shared secret saved from earlier.

    • Verify Message-Authenticator Attribute: Set to No.

      Message-Authenticator not currently supported

      At the time of publication, this RADIUS service doesn't currently return a Message-Authenticator as part of its response.

  5. Under RADIUS Authentication Method set MS-CHAP v2 to Yes.

    • Access Server should now authenticate users against your Active Directory users.

Important

Be aware that using auto-login profiles doesn’t trigger RADIUS authentication and RADIUS accounting requests. The first time a user signs in to download an auto-login connection profile, they can authenticate against the RADIUS server, but after that, auto-login connection profiles authenticate using only a certificate and bypass credential-based authentication of the RADIUS server.

In this section: