topic Zone Director and NPS/Radius for Admin authentication in SmartZone and Virtual SmartZone

Zone Director and NPS/Radius for Admin authentication

dave_bauman — Sat, 19 Jan 2019 16:26:10 GMT

I am trying to find documentation on how to properly configure Windows(2016) Server with AD/NPS/Radius to authenticate administrators on our ZD (and eventually SZ) controllers. We are NOT looking to authenticate WiFi users.

Are there any special attributes we need to add? Assuming Service-Type:Login and removing any Framed statements(PPP) Anything else?

Re: Zone Director and NPS/Radius for Admin authentication

dave_bauman — Sun, 20 Jan 2019 21:11:13 GMT

Update: I've found that the authentication appears to succeed on NPS, but the ZD1200 controller doesn't seem to think so

Re: Zone Director and NPS/Radius for Admin authentication

jukka_somiska — Mon, 21 Jan 2019 12:51:26 GMT

Hi, have you tried following this guide: https://support.ruckuswireless.com/articles/000008283 ?

Re: Zone Director and NPS/Radius for Admin authentication

dave_bauman — Tue, 22 Jan 2019 03:53:14 GMT

I've looked at it. The SCG is a bit different than a ZD, but I was able to apply similar principals, no luck though. The Radius test on the ZD works, but logging in does not. My AD/NPS logs show the login as successful

Re: Zone Director and NPS/Radius for Admin authentication

jukka_somiska — Tue, 22 Jan 2019 07:19:41 GMT

I'd check Roles in ZD configuration, verify that you have Role which allows ZD administration. Since RADIUS test works, verify that user is assigned correct Role. You probably have done it, but also remember to enable external admin authentication under Administration-> Preferences.

If everything looks correct and still not working, then I'd try changing to Active Directory type of authentication profile instead of RADIUS, at least as troubleshooting method narrowing the problem. I've found AD authentication easier to implement, especially if you wan't to allow ZoneDirector admin only for members of specific AD group. I'm currently trying to achieve that on SmartZone platform, without success...

Re: Zone Director and NPS/Radius for Admin authentication

gordon_taylor_6 — Tue, 22 Jan 2019 17:00:36 GMT

at my school we use 802.1x and NPS on server 2016/2012R2 (auth against computer accounts) i have two docs with screenshots of every step of both the NPS setup and the GPO to make the laptops joint the WiFi i can share them if you like

Re: Zone Director and NPS/Radius for Admin authentication

edward_toovey — Thu, 14 Feb 2019 13:56:14 GMT

@Gordon Taylor I would be very interested to share those documents, just in the process of setting up something similar at our school.

Re: Zone Director and NPS/Radius for Admin authentication

gordon_taylor_6 — Thu, 14 Feb 2019 14:03:04 GMT

give me your email address... i cant see how to PM on here 😕

Re: Zone Director and NPS/Radius for Admin authentication

dave_bauman — Thu, 14 Feb 2019 14:21:29 GMT

My biggest issue with this process right now is getting the SSL certificate working on the AD server.

Re: Zone Director and NPS/Radius for Admin authentication

edward_toovey — Thu, 14 Feb 2019 14:49:41 GMT

Hi Gordon my email is my first name {period} last name {at} durlstoncourt.co.uk. Thanks for your help.

Re: Zone Director and NPS/Radius for Admin authentication

gordon_taylor_6 — Thu, 14 Feb 2019 14:57:05 GMT

ok i got that if you want to delete it

Re: Zone Director and NPS/Radius for Admin authentication

gordon_taylor_6 — Thu, 14 Feb 2019 15:48:23 GMT

Dave Bauman, you do ideally need an internal AD CA that issues certificates to your NPS servers and probably your workstations and DCs too. and the CA is in Trusted Root Certificate Authority on the connecting workstations ( which an AD CA Cert is automatically added to by AD to all domain joined workstations.)

to issue to workstations...
GPO Computer Config > Policies >Windows Settings> Security Settings > Public Key Policies/Automatic Certificate Request Settings > Automatic Certificate Request > Computer...

Re: Zone Director and NPS/Radius for Admin authentication

dave_bauman — Thu, 14 Feb 2019 15:52:39 GMT

We don't really use AD for workstations or at all at this time. We have a lot of gear in the field and are moving away from a single admin login/password as it has become unmanageable. The only purpose for AD/Radius at this time is to authenticate our admins in the field.

Re: Zone Director and NPS/Radius for Admin authentication

gordon_taylor_6 — Thu, 14 Feb 2019 15:58:57 GMT

fair enough i do use 802.1X for BYOD but the devices complain about the cert and windows PCs wont even connect unless you put the Root ADCA in the trusted root or use a publicly trusted cert (but not a wildcard) but then it complains about the name miss match... but it does work.... just a bit clunky on first connect.

Re: Zone Director and NPS/Radius for Admin authentication

gordon_taylor_6 — Thu, 14 Feb 2019 16:39:57 GMT

thats my byod radius setup... not perfect but does work i don't think the vendor specific bit isnt needed i think that was me trying to use one NPS server for both computer auth and byod user auth in the end i split them

Re: Zone Director and NPS/Radius for Admin authentication

brian_powers — Thu, 14 Feb 2019 18:01:16 GMT

Dave,

You're trying to actually log into the ZD/SZ, yes? If you have it all configured and you're getting the proper accept message within your NPS logs, are logging in with your full AD address (email basically)? We log in to a vSZ via our AD/NPS/RADIUS but the vSZ only support PAP/CHAP and we had to make some adjustments to our NPS policy and even then we still have to use the full account name (@).