Windows Server 2008: how to configure Network Policy Server or Radius Server

lb20309

Step1: Prepare AAA Environment

• 　　Windows Server 2008 SP2 or Windows Server 2008 R2
  
• 　　Active Directory Domain Services
  
• 　　Active Directory Certificate Services
  
• 　　DHCP
  
• 　　Radius i.e. NPS must be a member of domain
  
• 　　Computer certificate installed in Radius Server
  
• 　　Windows 7, Windows XP or Mac OSX 10.5.8 Client
  
• 　　Cisco Wireless Access Point
  

Step2: Installation
　　Start menu>Administrative Tools>Server manager>Roles>Add Roles

http://araihan.files.wordpress.com/2009/11/114.jpghttp://araihan.files.wordpress.com/2009/11/213.jpghttp://araihan.files.wordpress.com/2009/11/33.jpghttp://araihan.files.wordpress.com/2009/11/43.jpghttp://araihan.files.wordpress.com/2009/11/53.jpghttp://araihan.files.wordpress.com/2009/11/63.jpghttp://araihan.files.wordpress.com/2009/11/73.jpghttp://araihan.files.wordpress.com/2009/11/82.jpghttp://araihan.files.wordpress.com/2009/11/93.jpg

Step3: Setup Clients
　　Administrative Tools>Network Policy Server>Radius Client>Right Click>New Radius Client

http://araihan.files.wordpress.com/2009/11/103.jpghttp://araihan.files.wordpress.com/2009/11/115.jpg

　　Radius Secret mentioned here must be same in Cisco Wireless Access Point. You must verify connection by clicking verify.
Step4: Setup Policy
　　Network Policy Server>Policies>network Policies>Right Click>New

http://araihan.files.wordpress.com/2009/11/133.jpghttp://araihan.files.wordpress.com/2009/11/143.jpg

　　This is highly important part of entire config. Based on your need, you have to choose desire config type among all.
　　*** Tunnel Type:L2TP
　　NASPort Type: *** or Wireless
　　EAP Type: EAP-TLS, MSChap v2 or PEAP
　　AD Group: Wireless User Group or *** User Group

http://araihan.files.wordpress.com/2009/11/153.jpghttp://araihan.files.wordpress.com/2009/11/163.jpghttp://araihan.files.wordpress.com/2009/11/173.jpghttp://araihan.files.wordpress.com/2009/11/183.jpghttp://araihan.files.wordpress.com/2009/11/193.jpghttp://araihan.files.wordpress.com/2009/11/203.jpg

　　Here, you can choose one or both depending on your infrastructure. I have shown both *** and Wireless Client.

http://araihan.files.wordpress.com/2009/11/214.jpghttp://araihan.files.wordpress.com/2009/11/222.jpghttp://araihan.files.wordpress.com/2009/11/232.jpghttp://araihan.files.wordpress.com/2009/11/242.jpg

　　Here, I am showing both EAP type for this article. But you have to choose only one again depending on your infrastructure.

http://araihan.files.wordpress.com/2009/11/252.jpghttp://araihan.files.wordpress.com/2009/11/262.jpghttp://araihan.files.wordpress.com/2009/11/271.jpghttp://araihan.files.wordpress.com/2009/11/281.jpg

　　Smart card or Certificate is the best option. For Windows 7 and XP, only certificates will work smooth as silk. However, if you have Macintosh Client then you have choose Certificate and PEAP.

http://araihan.files.wordpress.com/2009/11/291.jpghttp://araihan.files.wordpress.com/2009/11/30.jpg

　　If you want *** client to authenticate via Radius i.e. NPS then select Tunnel type.

http://araihan.files.wordpress.com/2009/11/311.jpghttp://araihan.files.wordpress.com/2009/11/321.jpghttp://araihan.files.wordpress.com/2009/11/331.jpghttp://araihan.files.wordpress.com/2009/11/34.jpghttp://araihan.files.wordpress.com/2009/11/35.jpghttp://araihan.files.wordpress.com/2009/11/36.jpghttp://araihan.files.wordpress.com/2009/11/37.jpghttp://araihan.files.wordpress.com/2009/11/38.jpghttp://araihan.files.wordpress.com/2009/11/39.jpg

　　Here, I explained  standard Radius config. I would recommend following for two different situations:

• 　　L2TP, Certificate and EAP for *** Client
  
• 　　Certificate, PEAP and MSChap v2 for Wireless Client.
  

　　You can have more then one policy in NPS. A single server can be used to authenticate both *** and Wireless Client. For some weird reason, my Macintosh client did not work with only user and machine certificate. Apple support advised me to use user cert and Radius shared secret instead. But for Windows 7 and XP client, certificates and EAP will work smooth as silk.
　　Further Help:
　　Microsoft Technet
　　Keywords: L2TP, Radius, NPS, Windows Server 2008, Certificates