Microsoft IAS Configuration for RADIUS Authorization

Transcription

1 Microsoft IAS Configuration for RADIUS Authorization Purpose To illustrate how to create a Microsoft IAS Remote Access Policy that utilizes an Uplogix vendor specific attribute that contains a user group to be sent to the Uplogix Control Center or Local Manager when performing RADIUS authorization. Assumptions 1. Active Directory is already running 2. CHAP enabled for user authentication see following notes that should be helpful if CHAP needs to be enabled With CHAP, reversibly encrypted password storage is required. You can enable reversibly encrypted password storage per user account or for all accounts in a domain using Group Policy. To enable reversibly encrypted password storage for a user account, obtain the properties of a user account in AD DS, click the Account tab, and then select the Store password using reversible encryption check box. To allow reversibly encrypted password storage for all user accounts in the domain, add the Group Policy Management Editor snap-in to the Microsoft Management Console (MMC) and enable the default domain policy setting Store password using reversible encryption at the following path: Computer Configuration Policies Windows Settings Security Settings Account Policies Password Policies. 3. IAS (Internet Authentication Service) is running 4. The SecurityOperations user group with appropriate permissions is defined in the Uplogix Local Manager. Create IAS Remote Access Policy 1. Open the IAS application, select Remote Access Policies in the left navigation bar, right click in the right pane and select New Remote Access Policy.

2 2. Set up a custom policy and name the policy. In this example, the policy is named Security Operations. 3. Now click on the Add button to add a condition or set of conditions that will be used to match this policy to RADIUS Authentication requests. Microsoft IAS Configuration Guide 2

3 4. In this example, the Windows-Groups attribute will be used to match request to this policy. Select the attribute and click the Add button. 5. Now add a User group to this attribute by clicking the Add button. Microsoft IAS Configuration Guide 3

4 6. Type the name of the Windows Group into the object names field and click the Check Names button. Then click OK to continue. 7. Set this policy to Grant remote access permission and then click the Next button. Microsoft IAS Configuration Guide 4

5 8. Now edit the policy profile by clicking the Edit Profile button. 9. Select the Authentication tab and select the authentication method to be used here we are using CHAP. 10. Now select the Advanced tab and remove each of the predefined attributes below by selecting one at a time and clicking the Remove button. Microsoft IAS Configuration Guide 5

6 11. Now click the Add button to add the Uplogix vender specific attribute. 12. Select the Vender-Specific attribute, then click Add. Microsoft IAS Configuration Guide 6

7 13. Click the Add button to add the Uplogix user group attribute to this policy. Microsoft IAS Configuration Guide 7

8 14. Enter the Uplogix vendor code of into the Vendor Code field below, indicate that it conforms to the RADIUS RFC and select Configure Attribute. 15. Set the Vendor-assigned attribute number to 3 (which indicates this is the Uplogix user group attribute), leave the Attribute format as a string and then set the Attribute value to the name of the Uplogix user group the authenticating user is to be associated with when logging into the UCC or Uplogix Local Manager (note that this value cannot have spaces in it). Note that the group name must be defined with permissions in the Uplogix Local Manager or UCC. Then click the OK button. Microsoft IAS Configuration Guide 8

9 16. Now apply the newly provisioned profile settings by clicking the Apply button and then click the OK button to continue. 17. Now click the OK button to complete the policy configuration process. This policy will be applied to any user authenticating who is a member of Security Engineers group. Microsoft IAS Configuration Guide 9

10 18. Remote access policy placement is important, as the first policy to match the authenticating user will be applied. Be sure to position policies appropriately. 19. Now create RADIUS Clients for each Uplogix Local Manager and UCC in your network. Select RADIUS Clients in the left pane and then right click in the right pane and select New RADIUS Client from the menu. Microsoft IAS Configuration Guide 10

11 20. Name the client and enter its management IP address or hostname in the Client address field. 21. Set the Client-Vendor field to RADIUS Standard and then enter the shared secret for this client in the Shared secret fields below. Then click the Finish button. Microsoft IAS Configuration Guide 11

12 22. The final step is to configure the Uplogix Local Manager or UCC for RADIUS authentication and authorization. Here is an example of the configuration entered via the command line interface (config system authentication) on the Uplogix Local Manager for this example. Microsoft IAS Configuration Guide 12