topic RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise. in ExtremeWireless (General)

Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

Helio_Jose_Erha — Thu, 25 Feb 2016 02:16:00 GMT

Good afternoon.
I trying to accomplish Radius authentication, configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.
How should the settings on XOS and the NPS?
We have already used successfully authenticating switches EOS.
I thank the support.

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

Ronald_Dvorak — Thu, 25 Feb 2016 02:36:00 GMT

I was also looking for that as I'd need to test it in my lab.

Here a article that I've found - haven't tried it today as I run out of time....

https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-configure-802-1x-based-Netlogin-wit...

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

Henrique — Thu, 25 Feb 2016 02:46:00 GMT

Hi Helio,

If you need to authenticate the users to get access to manage the switch, you can use the commands below for the switch:

configure radius mgmt-access primary server client-ip {vr vr_name}
configure radius mgmt-access primary shared-secret
enable radius mgmt-access

For NPS, you can find an example in the GTAC Knowledge link below:

https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-configure-Windows-2008-NPS-for-auth...

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

Gowtham_Elamuru — Thu, 25 Feb 2016 02:46:00 GMT

Hi, Can you please send the document link again

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

Helio_Jose_Erha — Thu, 03 Mar 2016 01:31:00 GMT

Hi Henrique,

The authentication is working, however the Active Directory user always gets RO permission. How to have RW permission?
No need something similar to Filter-Id, as used with EOS switches (Enterasys: version = 1: mgmt = rw)?

Thank you

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

Ronald_Dvorak — Thu, 03 Mar 2016 01:37:00 GMT

So here the article for mgmt access for the switch...

Service-Type = Administrative-User

https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-configure-RADIUS-authentication-for...

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

Helio_Jose_Erha — Thu, 03 Mar 2016 01:51:00 GMT

Hi Ronald,

It is already configured as Service-Type = Administrative-User
See screenshot.

Thanks

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

Ronald_Dvorak — Thu, 03 Mar 2016 02:07:00 GMT

Please take a look into this post - it includes a pdf link with screenshots of my working setup

https://community.extremenetworks.com/extreme/topics/microsoft-nps-server-vsa-configuration-for-extr...

Please doublecheck the settings and if it still doens't work post a screenshot of the Windows event log message of the authentication - I'd like to see whether the right network policy is choosen.

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

Helio_Jose_Erha — Thu, 03 Mar 2016 21:00:00 GMT

Hi Ronald,

See screenshots.

Thanks

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

Helio_Jose_Erha — Thu, 03 Mar 2016 21:01:00 GMT

Screenshot 2

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

Helio_Jose_Erha — Thu, 03 Mar 2016 21:03:00 GMT

Screenshot 3

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

Helio_Jose_Erha — Thu, 03 Mar 2016 21:03:00 GMT

Screenshot 4

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

Helio_Jose_Erha — Thu, 03 Mar 2016 21:03:00 GMT

Hi Ronald,

Do you have some more help to give?
You checked the screenshots ?

Thank you

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

dflouret — Wed, 16 Mar 2016 20:03:00 GMT

Jose,

VSA 201 (Extreme-CLI-Authorization) set to Enable in Screenshot 2 forces EXOS to send each command to the RADIUS server for checking it against a profile to see if the user is authorized to issue that command or not. This feature is only available with a modified FreeRadius server.

Either delete this VSA or set it to 0 (Disable).

What you need to include in your user profile is the default Radius attribute Service-Type set to Administrative...

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

Helio_Jose_Erha — Wed, 16 Mar 2016 20:03:00 GMT

Hi Daniel,
Retired VSA.
Service-Type attribute is setted as Administrative, however it continues authentication as user USER. How to do to be authenticated as ADMIN?

Thanks..

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

Henrique — Wed, 16 Mar 2016 20:03:00 GMT

Can you try using "RADIUS Standard" for Network Access Server Vendor in "Vendor Specific Attribute Information" window instead of 1916 (Extreme vendor ID)?

Also, use "Administrative" attribute as mentioned by Daniel.

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

Helio_Jose_Erha — Wed, 16 Mar 2016 20:03:00 GMT

Hi Henrique,

Unsuccessfully.

Other any suggestions ?

Thanks

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

Henrique — Wed, 16 Mar 2016 20:03:00 GMT

Hi Helio, just a confirmation.

Is Slot-1 Stack Master node?

Can you please send a show stacking output?

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

Helio_Jose_Erha — Wed, 16 Mar 2016 20:03:00 GMT

Hi Henrique,

Yes, slot-1 is master node.

RE: Radius Authentication configuring switch x440 as a client in NPS-Windows Server 2008 Enterprise.

dflouret — Thu, 17 Mar 2016 01:44:00 GMT

Helio,

Did you restart NPS server? Changes don't usually take effect until you restart the server.

To stop it, right click on the NPS server name and select Stop NPS Service.

To restart, do the same but now the option will say Start NPS Service.