{"id":42118,"date":"2019-03-18T00:00:00","date_gmt":"2019-03-17T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/nastrojka-802-1x-na-kommutatorah-cisco-s-pomoshhyu-otkazoustojchivogo-nps-windows-radius-with-ad"},"modified":"2020-02-18T13:44:55","modified_gmt":"2020-02-18T10:44:55","slug":"nastrojka-802-1x-na-kommutatorah-cisco-s-pomoshhyu-otkazoustojchivogo-nps-windows-radius-with-ad","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/nastrojka-802-1x-na-kommutatorah-cisco-s-pomoshhyu-otkazoustojchivogo-nps-windows-radius-with-ad","title":{"rendered":"Nastaven\u00ed 802.1X na switche Cisco pomoc\u00ed odporov\u00e9ho NPS (Windows RADIUS s AD)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Nastaven\u00ed
\nPod\u00edv\u00e1me se na praktick\u00e9 vyu\u017eit\u00ed Windows Active Directory + NPS (2 servery pro zaji\u0161t\u011bn\u00ed vysok\u00e9 dostupnosti) + standard 802.1x pro kontrolu p\u0159\u00edstupu a autentizaci u\u017eivatel\u016f \u2013 dom\u00e9nov\u00fdch po\u010d\u00edta\u010d\u016f \u2013 za\u0159\u00edzen\u00ed. S teori\u00ed o tomto standardu se m\u016f\u017eete sezn\u00e1mit na Wikipedii na tomto odkazu: IEEE 802.1X<\/a><\/noindex><\/p>\n

Jeliko\u017e m\u00e1m \u201elaborato\u0159\u201c omezenou na zdroje, slou\u010d\u00edme role NPS a dom\u00e9nov\u00e9ho kontroleru, ale doporu\u010duji v\u00e1m tyto kritick\u00e9 slu\u017eby p\u0159esto odd\u011blit.<\/p>\n

Standardn\u00ed zp\u016fsoby synchronizace konfigurac\u00ed (politiky) Windows NPS nezn\u00e1m, proto pou\u017eijeme skripty PowerShell spou\u0161t\u011bn\u00e9 pl\u00e1nova\u010dem \u00faloh (autorem je m\u016fj b\u00fdval\u00fd kolega). Pro autentizaci dom\u00e9nov\u00fdch po\u010d\u00edta\u010d\u016f a pro za\u0159\u00edzen\u00ed, kter\u00e1 to neum\u00ed, 802.1x<\/b> (telefony, tisk\u00e1rny apod.), bude nastavena skupinov\u00e1 politika a vytvo\u0159eny bezpe\u010dnostn\u00ed skupiny.<\/p>\n

Na konci \u010dl\u00e1nku se pod\u011bl\u00edm o n\u011bkter\u00e9 zvl\u00e1\u0161tnosti pr\u00e1ce s 802.1x \u2013 jak lze pou\u017e\u00edt ne\u0159\u00edzen\u00e9 switche, dynamic ACL apod. Pod\u011bl\u00edm se o informace o zachycen\u00fdch \u201eprobl\u00e9mech\u201c...
\n<\/a><\/noindex>
\nZa\u010dneme s instalac\u00ed a nastaven\u00edm failover NPS na Windows Server 2012R2 (na 2016 je v\u0161e analogick\u00e9): p\u0159es Server Manager -> Pr\u016fvodce p\u0159id\u00e1n\u00edm rol\u00ed a funkc\u00ed vybereme pouze Network Policy Server.<\/p>\n

\"Nastaven\u00ed
\n
\nnebo pomoc\u00ed PowerShell:<\/p>\n

Install-WindowsFeature NPAS -IncludeManagementTools<\/code><\/pre>\n
<\/p>\n
Mal\u00e9 up\u0159esn\u011bn\u00ed \u2013 jeliko\u017e pro Protected EAP (PEAP)<\/b> budete pot\u0159ebovat certifik\u00e1t potvrzuj\u00edc\u00ed pravost serveru (s odpov\u00eddaj\u00edc\u00edmi pr\u00e1vy na pou\u017eit\u00ed), kter\u00fd bude d\u016fv\u011bryhodn\u00fd na klientsk\u00fdch po\u010d\u00edta\u010d\u00edch, pravd\u011bpodobn\u011b budete muset tak\u00e9 nainstalovat roli Certification Authority<\/b>. Ale budeme p\u0159edpokl\u00e1dat, \u017ee CA<\/b> u\u017e m\u00e1te nainstalov\u00e1no...<\/p><\/blockquote>\n
 Ud\u011bl\u00e1me tot\u00e9\u017e na druh\u00e9m serveru. Vytvo\u0159\u00edme slo\u017eku pro skript C:Scripts na obou serverech a s\u00ed\u0165ovou slo\u017eku na druh\u00e9m serveru SRV2NPS-config$<\/b><\/p>\n
Na prvn\u00edm serveru vytvo\u0159\u00edme skript PowerShell C:ScriptsExport-NPS-config.ps1<\/i> s n\u00e1sleduj\u00edc\u00edm obsahem:<\/p>\n
Export-NpsConfiguration -Path \"SRV2NPS-config$NPS.xml\"<\/code><\/pre>\n
\nPot\u00e9 nastav\u00edme \u00falohu v Pl\u00e1nova\u010di \u00faloh: \"Export-NpsConfiguration<\/i>\u201d<\/p>\n
powershell -executionpolicy unrestricted -f \"C:ScriptsExport-NPS-config.ps1\"<\/code><\/pre>\n
\nProv\u00e1d\u011bt pro v\u0161echny u\u017eivatele \u2013 Spustit s nejvy\u0161\u0161\u00edmi pr\u00e1vy
\nDenn\u011b \u2013 Opakovat \u00falohu ka\u017ed\u00fdch 10 minut po dobu 8 hodin.<\/i><\/p>\n
Na z\u00e1lo\u017en\u00edm NPS nastav\u00edme import konfigurace (politiky):
\nvytvo\u0159\u00edme skript PowerShell:<\/p>\n
echo Import-NpsConfiguration -Path \"c:NPS-configNPS.xml\" >> C:ScriptsImport-NPS-config.ps1<\/code><\/pre>\n
\na \u00falohu pro jeho spu\u0161t\u011bn\u00ed ka\u017ed\u00fdch 10 minut:<\/p>\n
powershell -executionpolicy unrestricted -f \"C:ScriptsImport-NPS-config.ps1\"<\/code><\/pre>\n
\nProv\u00e1d\u011bt pro v\u0161echny u\u017eivatele \u2013 Spustit s nejvy\u0161\u0161\u00edmi pr\u00e1vy
\nDenn\u011b \u2013 Opakovat \u00falohu ka\u017ed\u00fdch 10 minut po dobu 8 hodin.<\/i><\/p>\n
Nyn\u00ed, pro kontrolu, p\u0159id\u00e1me do NPS na jednom ze server\u016f (!) p\u00e1r p\u0159ep\u00edna\u010d\u016f do RADIUS klient\u016f (IP a Shared Secret), dv\u011b politiky \u017e\u00e1dost\u00ed o p\u0159ipojen\u00ed: WIRED-Connect<\/b> (Podm\u00ednka: \u201eTyp portu NAS \u2013 Ethernet\u201c) a WiFi-Enterprise<\/b> (Podm\u00ednka: \u201eTyp portu NAS \u2013 IEEE 802.11\u201c), a tak\u00e9 s\u00ed\u0165ovou politiku Access Cisco Network Devices<\/i><\/b> (s\u00ed\u0165ov\u00ed administr\u00e1to\u0159i):<\/p>\n
Podm\u00ednky:\nSkupiny Windows - domainsg-network-admins\nOmezen\u00ed:\nMetody ov\u011b\u0159ov\u00e1n\u00ed - Ov\u011b\u0159en\u00ed otev\u0159en\u00fdm textem (PAP, SPAP)\nParametry:\nAtributy RADIUS: Standard - Service-Type - Login\nZ\u00e1visl\u00e9 na dodavateli - Cisco-AV-Pair - Cisco - shell:priv-lvl=15<\/code><\/pre>\n
Z pohledu p\u0159ep\u00edna\u010d\u016f n\u00e1sleduj\u00edc\u00ed nastaven\u00ed:<\/b><\/p>\n
aaa new-model\naaa local authentication attempts max-fail 5\n!\n!\naaa group server radius NPS\n server-private 192.168.38.151 auth-port 1812 acct-port 1813 key %shared_secret%\n server-private 192.168.10.151 auth-port 1812 acct-port 1813 key %shared_secret%\n!\naaa authentication login default group NPS local\naaa authentication dot1x default group NPS\naaa authorization console\naaa authorization exec default group NPS local if-authenticated\naaa authorization network default group NPS\n!\naaa session-id common\n!\nidentity profile default\n!\ndot1x system-auth-control\n!\n!\nline vty 0 4\n exec-timeout 5 0\n transport input ssh\n escape-character 99\nline vty 5 15\n exec-timeout 5 0\n logging synchronous\n transport input ssh\n escape-character 99<\/code><\/pre>\n
Po nastaven\u00ed, po 10 minut\u00e1ch, by m\u011bly v\u0161echny klientsk\u00e9 politiky parametry objevit i na z\u00e1lo\u017en\u00edm NPS a budeme se moci autorizovat na p\u0159ep\u00edna\u010d\u00edch pomoc\u00ed \u00fa\u010dtu Active Directory, \u010dlena skupiny domainsg-network-admins (kterou jsme vytvo\u0159ili p\u0159edem).<\/p>\n
P\u0159ejdeme k nastaven\u00ed Active Directory \u2013 vytvo\u0159\u00edme skupinovou a heslovou politiku, vytvo\u0159\u00edme pot\u0159ebn\u00e9 skupiny.<\/p>\n
Skupinov\u00e1 politika Computers-8021x-Settings<\/b><\/i>:<\/p>\n
<\/p>\n
Konfigurace po\u010d\u00edta\u010de (Povolen\u00e1)\n   Politiky\n     Windows Settings\n        Bezpe\u010dnostn\u00ed nastaven\u00ed\n          Syst\u00e9mov\u00e9 slu\u017eby\n     Wired AutoConfig (Re\u017eim spu\u0161t\u011bn\u00ed: Automatick\u00fd)\nWired Network (802.3) Politiky<\/code><\/pre>\n
<\/b>
\nNPS-802-1x<\/b><\/p>\n
N\u00e1zev\tNPS-802-1x\nPopis\t802.1x\nGlob\u00e1ln\u00ed nastaven\u00ed\nNASTAVEN\u00cd\tHODNOTA\nPou\u017eijte slu\u017eby s\u00edt\u011b LAN pro dr\u00e1tov\u00e9 klienty\tPovoleno\nSd\u00edlen\u00e9 u\u017eivatelsk\u00e9 \u00fadaje pro s\u00ed\u0165ov\u00e9 ov\u011b\u0159ov\u00e1n\u00ed\tPovoleno\nProfil s\u00edt\u011b\nBezpe\u010dnostn\u00ed nastaven\u00ed\nPovolit pou\u017eit\u00ed ov\u011b\u0159ov\u00e1n\u00ed IEEE 802.1X pro p\u0159\u00edstup k s\u00edti\tPovoleno\nVynutit pou\u017eit\u00ed ov\u011b\u0159ov\u00e1n\u00ed IEEE 802.1X pro p\u0159\u00edstup k s\u00edti\tZak\u00e1z\u00e1no\nNastaven\u00ed IEEE 802.1X\nOv\u011b\u0159en\u00ed po\u010d\u00edta\u010de\tPouze po\u010d\u00edta\u010d\nMaxim\u00e1ln\u00ed selh\u00e1n\u00ed ov\u011b\u0159ov\u00e1n\u00ed\t10\nMaxim\u00e1ln\u00ed EAPOL-Start zpr\u00e1vy odeslan\u00e9\t \nZadr\u017een\u00e9 obdob\u00ed (sekundy)\t \nStartovac\u00ed obdob\u00ed (sekundy)\t \nOv\u011b\u0159ovac\u00ed obdob\u00ed (sekundy)\t \nVlastnosti metody s\u00ed\u0165ov\u00e9ho ov\u011b\u0159ov\u00e1n\u00ed\nMetoda ov\u011b\u0159ov\u00e1n\u00ed\tOchr\u00e1n\u011bn\u00fd EAP (PEAP)\nOv\u011b\u0159it certifik\u00e1t serveru\tPovoleno\nP\u0159ipojit k t\u011bmto server\u016fm\t \nNepo\u017eadovat po u\u017eivateli autorizaci nov\u00fdch server\u016f nebo d\u016fv\u011bryhodn\u00fdch certifika\u010dn\u00edch autorit\tZak\u00e1z\u00e1no\nPovolit rychl\u00e9 op\u011btovn\u00e9 p\u0159ipojen\u00ed\tPovoleno\nOdpojit, pokud server nep\u0159edlo\u017e\u00ed kryptobinding TLV\tZak\u00e1z\u00e1no\nVynutit ochranu p\u0159\u00edstupu k s\u00edti\tZak\u00e1z\u00e1no\nKonfigurace metody ov\u011b\u0159ov\u00e1n\u00ed\nMetoda ov\u011b\u0159ov\u00e1n\u00ed\tZabezpe\u010den\u00e9 heslo (EAP-MSCHAP v2)\nAutomaticky pou\u017e\u00edt m\u00e9 u\u017eivatelsk\u00e9 jm\u00e9no a heslo Windows (a dom\u00e9nu, pokud n\u011bjak\u00e1)\tPovoleno<\/code><\/pre>\n
\"Nastaven\u00ed
\n
\nVytvo\u0159\u00edme skupinu zabezpe\u010den\u00ed sg-computers-8021x-vl100<\/i><\/b>, where we will add the computers that we want to distribute into VLAN 100 and configure filtering for the previously created group policy on this group:<\/p>\n
\"Nastaven\u00ed
\n
\nTo ensure that the policy has been successfully applied, you can open the \u201cNetwork and Sharing Center (Network and Internet Settings) \u2013 Change Adapter Settings (Adapter Settings) \u2013 Adapter Properties,\u201d where we will see the \u201cAuthentication\u201d tab:<\/p>\n
\"Nastaven\u00ed
\n
\nOnce we have confirmed that the policy is being successfully applied, we can proceed to configure the network policy on NPS and access switch ports.<\/p>\n
Let's create a network policy neag-computers-8021x-vl100<\/i><\/b>:<\/p>\n
Conditions:\n  Windows Groups - sg-computers-8021x-vl100\n  NAS Port Type - Ethernet\nConstraints:\n  Authentication Methods - Microsoft: Protected EAP (PEAP) - Unencrypted authentication (PAP, SPAP)\n  NAS Port Type - Ethernet\nSettings:\n  Standard:\n   Framed-MTU 1344\n   TunnelMediumType 802 (includes all 802 media plus Ethernet canonical format)\n   TunnelPrivateGroupId  100\n   TunnelType  Virtual LANs (VLAN)<\/code><\/pre>\n
\n\"Nastaven\u00ed
\n
\nTypical settings for the switch port (note that multi-domain authentication type is used \u2013 Data & Voice, and there is also the possibility of MAC address authentication. During the 'transition period', it's reasonable to use the following parameters:<\/p>\n
\nauthentication event fail action authorize vlan 100\nauthentication event no-response action authorize vlan 100\n<\/code><\/pre>\n
\nthe VLAN ID is not 'quarantine' but the same as the one the user's computer should enter after successful authentication \u2013 until we are sure everything is working correctly. These parameters can also be used in other scenarios, for example, when an unmanaged switch is plugged into this port and you want all devices connected to it that have not passed authentication to be placed in a specific VLAN (\u2018quarantine\u2019).<\/p>\n
switch port settings in 802.1x mode host-mode multi-domain<\/b><\/p>\n
default int range Gi1\/0\/39-41\nint range Gi1\/0\/39-41\nshu\ndes PC-IPhone_802.1x\nswitchport mode access\nswitchport nonegotiate\nswitchport voice vlan 55\nswitchport port-security maximum 2\nauthentication event fail action authorize vlan 100\nauthentication event no-response action authorize vlan 100\nauthentication host-mode multi-domain\nauthentication port-control auto\nauthentication violation restrict\nmab\ndot1x pae authenticator\ndot1x timeout quiet-period 15\ndot1x timeout tx-period 3\nstorm-control broadcast level pps 100\nstorm-control multicast level pps 110\nno vtp\nlldp receive\nlldp transmit\nspanning-tree portfast\nno shu\nexit<\/code><\/pre>\n
You can verify that the computer\/telephone has successfully authenticated using the command:<\/p>\n
sh authentication sessions int Gi1\/0\/39 det<\/code><\/pre>\n
\nNow let's create a group (for example, sg-fgpp-mab<\/i> ) v Active Directory pro telefony a p\u0159id\u00e1me do n\u00ed jedno za\u0159\u00edzen\u00ed pro testov\u00e1n\u00ed (v m\u00e9m p\u0159\u00edpad\u011b to je Grandstream GXP2160<\/i><\/b> s MAC adresou 000b.82ba.a7b1<\/b> a odpov\u00eddaj\u00edc\u00edm u\u017eivatelsk\u00fdm \u00fa\u010dtem domain 00b82baa7b1<\/b>). <\/p>\n
Pro vytvo\u0159enou skupinu sn\u00ed\u017e\u00edme po\u017eadavky na z\u00e1sady hesel (pou\u017eit\u00edm Fine-Grained Password Policies<\/a><\/noindex> p\u0159es Active Directory Administrative Center -> domain -> System -> Password Settings Container) s t\u011bmito parametry Nastaven\u00ed-hesla-pro-MAB<\/i><\/b>:<\/p>\n
\"Nastaven\u00ed
\n
\nt\u00edmto povol\u00edme pou\u017e\u00edvat MAC adresy za\u0159\u00edzen\u00ed jako hesla. Po tomto budeme moci vytvo\u0159it s\u00ed\u0165ovou politiku pro autentizaci 802.1x method mab, nazveme ji neag-devices-8021x-voice. Parametry jsou n\u00e1sleduj\u00edc\u00ed:<\/p>\n