How to configure NAC as RADIUS to authorize AD users

[Ilya_Semenov]

Hello, everybody,

please, give me a link to some manuals.

I want to use one of two existing NAC installations as RADIUS to authorize AD users for an external system (Fortigate FG-600 firewall).

So, the questions are:

1) How to configure NAC to send authorization requests to AD domain controllers?
2) How to configure NAC be RADIUS server

Many thanks in advance,
Ilya

[StephanH]

Here is another threat with a discussion about the differences about Radius and NAC:

https://community.extremenetworks.com/extreme/topics/nac-vs-seperate-radius-server

Best regards
Stephan

[StephanH]

Hello Ilya,

simplified the difference between proxying Radius to NPS and authenticate locally is the following.

If you use proxy all auth request are forwarded to the NPS and the NPS make the decision who comes in and what information's (e. g. radios attributes) are sent back to the client. But NAC can overwrite the information sent back to the client if needed!

If you use NAC as Radius, NAC make the decision who comes in and sent back all radius attributes for authorization. But the NAC can ask a directory like AD to do the correct decision.

Here are a lot of good informations how you can use NAC as Radius and ask the AD for more information.

https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-authorise-Windows-domain-user-compu...

In my opinion you are more flexible if you do the authentication and authorization direct on the NAC and you have not to ask a Windows Server admin for support.

But there are situation the proxy solution is more beneficial.

Best regards
Stephan

[Gareth_Mitchell]

Ilya

Please try this link if you are still having problems: https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-authorise-Windows-domain-user-compu...

-Gareth

[StephanH]

Hi,

I tested the link again with (different) devices some minutes ago. It works. Please test again.