802.1x authentication using NPS policies- vSZ/Smartzone

Ambika-leimapok — Fri, 05 Apr 2024 22:22:51 GMT

Network Environment:

vSZ-H version : 6.1.2.0.404
Windows Server 2016

Setup Procedure:

This demo explains the configuration steps to authenticate wireless clients using 802.1x- SZ/vSZ by configuring NPs policy on a Windows server.

1-Make sure if the below features are installed.

2-Navigate to the Network Policy Server tab, access NPS (local), and choose the 'Radius server for 802.1x' option for both wireless and wired connections. Finally, select 'Configure 802.1x'

3-In this step, select 'Secure wireless connections' and customize the policy name to your preference. In this case, append 'DEMO' at the end of the policy name.

4-In this step, you need to configure the Radius Client by providing a friendly name, entering the IP address of the vSZ IP address, and optionally setting a password or using a password generation tool. Remember to save this configuration as it will be used in Step 9.

5-In this step, choose 'Microsoft Protect EAP (PEAP)' as the network access method

6- Next, leave the remaining options at their default settings, and conclude the configuration by clicking on the 'Finish' button.

7-Configure the “Connection Request Policies”

To configure the connection request policy, navigate to the 'Policies' section. Then, access the 'Connection Request Policy' folder and locate the policy is created with the same name. Double-click on it to access its properties. In the 'Properties' window, navigate to the 'Conditions' tab. Remove the 'Current' condition and any others if present. Add the 'Time' condition and select 'Permit all time'. Finally, click 'Apply' and then 'OK' to save the changes.

8-Configure Network policies

To configure the Network Policies access to “Network Policy” folder and locate the policy is created on the folder and locate the policy is created with the same name. Double-click on it to access its properties. In the 'Properties' window for this example, I choose to ignore the user properties dial and proceed to the 'Conditions' section. Here, I add the 'User Groups' option to use the Active Directory users.

In this part, you have the option to either use an existing group and its users or create a new group along with its users.

Optional step

How to create a group and users

Navigate to the Active Directory of users and computers, then left-click on it. Next, select 'New,' followed by 'Group,' and proceed to fill in the required information.

How to create an user

Navigate to the Active Directory of users and computers, then left-click on it. Next, select 'New,' followed by 'user’, and proceed to fill in the required information (username and password ).

In this case, we need to edit the 'Member of' properties of this user. Since I want this user to belong to the earlier created 'DEMO' group, we navigate to the user's properties, specifically the 'Member of' section. Subsequently, we add the group and configure it as the primary group.

Continue with the network policies configuration next, we will select the desired group and proceed to the 'Constraints' tab. Here, we will add CHAP as the authentication method.

9-Smartzone/ Virtual Smartzone configuration

In the SZ/vSZ configuration, navigate to “Security” ->Authentication->Proxy(SZ Authenticator)/ Non-Proxy(AP Authenticator)(I am using ' Proxy(SZ Authenticator) in my example

NOTE: Proxy(SZ Authenticator) is used when APs send authentication or accounting messages to the controller and the controller forwards these messages to an external AAA server. A non-proxy (AP Authenticator)AAA server is used when APs connect to the external AAA server directly.

Click on “+Create “ button

Enter the NPS server details and make sure that you enter the same shared secret as you have entered in NPS server

10- WLAN Creation

Navigate to “Network-> Wireless LANs”and select the desire zone and click on “Create” tab . Fill in the necessary information accordingly.

In my demo, I used High scale hence the Realm Proxy profile must be created so that the Realm Proxy profile would show in the drop down under the Authentication Service

How the Realm Proxy profile can be created? please check the below details

Click on First Realm ->“Configure” -> Under “Service”, make sure, you select the right NPS server

11-Wireless Client

After creating the wireless network, it's important to check the connectivity. Connect to the network and when prompted, enter the credentials of the created DEMO-USER along with the corresponding password. If the credentials match, you should be able to connect to the network without any issues.

Regards,

Leimapokpam Ambika

topic 802.1x authentication using NPS policies- vSZ/Smartzone in RUCKUS Self-Help

802.1x authentication using NPS policies- vSZ/Smartzone