{"id":42118,"date":"2019-03-18T00:00:00","date_gmt":"2019-03-17T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/nastrojka-802-1x-na-kommutatorah-cisco-s-pomoshhyu-otkazoustojchivogo-nps-windows-radius-with-ad"},"modified":"2020-02-18T13:44:55","modified_gmt":"2020-02-18T10:44:55","slug":"nastrojka-802-1x-na-kommutatorah-cisco-s-pomoshhyu-otkazoustojchivogo-nps-windows-radius-with-ad","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/nastrojka-802-1x-na-kommutatorah-cisco-s-pomoshhyu-otkazoustojchivogo-nps-windows-radius-with-ad","title":{"rendered":"Configuring 802.1X on Cisco Switches Using Redundant NPS (Windows RADIUS with AD)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Configuring
\nLet's explore the practical use of Windows Active Directory + NPS (2 servers for redundancy) + the 802.1x standard for access control and user authentication \u2013 domain computers \u2013 devices. You can familiarize yourself with the theory of the standard in Wikipedia, through the link: IEEE 802.1X<\/a><\/noindex><\/p>\n

Since my lab has limited resources, I will combine the roles of NPS and domain controller, but I recommend that you separate such critical services.<\/p>\n

I am not aware of any standard ways to synchronize configurations (policies) for Windows NPS, so we will use PowerShell scripts that are triggered by the task scheduler (the author is my former colleague). For authenticating domain computers and for devices that cannot do so, 802.1x<\/b> (phones, printers, etc.), a group policy will be configured and security groups will be created.<\/p>\n

At the end of the article, I will discuss some nuances of working with 802.1x \u2013 how unmanaged switches, dynamic ACLs, etc. can be utilized. I will share information about encountered 'glitches'\u2026
\n<\/a><\/noindex>
\nLet's start by installing and configuring failover NPS on Windows Server 2012R2 (it\u2019s similar on 2016): through Server Manager -> Add Roles and Features Wizard, we only select Network Policy Server.<\/p>\n

\"Configuring
\n
\nor using PowerShell:<\/p>\n

Install-WindowsFeature NPAS -IncludeManagementTools<\/code><\/pre>\n
<\/p>\n
A small clarification \u2013 since for Protected EAP (PEAP)<\/b> you will definitely need a certificate that confirms the authenticity of the server (with the appropriate rights for use), which will be on the trusted client computers, you will probably need to install the Certification Authority<\/b>. But let's assume that CA<\/b> it is already installed\u2026<\/p><\/blockquote>\n
 We will do the same on the second server. Create a folder for the script C:\\Scripts on both servers and a network folder on the second server SRV2NPS-config$<\/b><\/p>\n
On the first server, we will create a PowerShell script C:\\Scripts\\Export-NPS-config.ps1<\/i> with the following content:<\/p>\n
Export-NpsConfiguration -Path \"SRV2NPS-config$\\NPS.xml\"<\/code><\/pre>\n
\nAfter that, we will set up a task in Task Scheduler: \"Export-NpsConfiguration<\/i>\u201d<\/p>\n
powershell -executionpolicy unrestricted -f \"C:\\Scripts\\Export-NPS-config.ps1\"<\/code><\/pre>\n
\nRun for all users \u2014 Run with highest privileges
\nDaily \u2014 Repeat task every 10 minutes for 8 hours.<\/i><\/p>\n
On the backup NPS, we will configure the import of the configuration (policies):
\nlet's create a PowerShell script:<\/p>\n
echo Import-NpsConfiguration -Path \"c:\\NPS-config\\NPS.xml\" >> C:\\Scripts\\Import-NPS-config.ps1<\/code><\/pre>\n
\nand set a task to execute it every 10 minutes:<\/p>\n
powershell -executionpolicy unrestricted -f \"C:ScriptsImport-NPS-config.ps1\"<\/code><\/pre>\n
\nRun for all users \u2014 Run with highest privileges
\nDaily \u2014 Repeat task every 10 minutes for 8 hours.<\/i><\/p>\n
Now, to verify, let's add a couple of switches in NPS on one of the servers (!) as RADIUS clients (IP and Shared Secret), two connection request policies: WIRED-Connect<\/b> (Condition: \u201cNAS Port Type \u2013 Ethernet\u201d) and WiFi-Enterprise<\/b> (Condition: \u201cNAS Port Type \u2013 IEEE 802.11\u201d), as well as the network policy Access Cisco Network Devices<\/i><\/b> (Network Admins):<\/p>\n
Conditions:\nWindows Groups - domainsg-network-admins\nConstraints:\nAuthentication methods - Clear text authentication (PAP, SPAP)\nAttributes:\nRADIUS Attributes: Standard - Service-Type - Login\nVendor-specific - Cisco-AV-Pair - Cisco - shell:priv-lvl=15<\/code><\/pre>\n
From the switches, the following settings:<\/b><\/p>\n
aaa new-model\naaa local authentication attempts max-fail 5\n!\n!\naaa group server radius NPS\n server-private 192.168.38.151 auth-port 1812 acct-port 1813 key %shared_secret%\n server-private 192.168.10.151 auth-port 1812 acct-port 1813 key %shared_secret%\n!\naaa authentication login default group NPS local\naaa authentication dot1x default group NPS\naaa authorization console\naaa authorization exec default group NPS local if-authenticated\naaa authorization network default group NPS\n!\naaa session-id common\n!\nidentity profile default\n!\ndot1x system-auth-control\n!\n!\nline vty 0 4\n exec-timeout 5 0\n transport input ssh\n escape-character 99\nline vty 5 15\n exec-timeout 5 0\n logging synchronous\n transport input ssh\n escape-character 99<\/code><\/pre>\n
After the configuration, in about 10 minutes, all clients policy parameters should appear on the backup NPS, and we will be able to authenticate on the switches using an Active Directory account that is a member of the domainsg-network-admins group (which we created in advance).<\/p>\n
Let's proceed to configuring Active Directory \u2013 we will create group and password policies, and establish the necessary groups.<\/p>\n
Group Policy Computers-8021x-Settings<\/b><\/i>:<\/p>\n
<\/p>\n
Computer Configuration (Enabled)\n   Policies\n     Windows Settings\n        Security Settings\n          System Services\n     Wired AutoConfig (Startup Mode: Automatic)\nWired Network (802.3) Policies<\/code><\/pre>\n
<\/b>
\nNPS-802-1x<\/b><\/p>\n
Name\tNPS-802-1x\nDescription\t802.1x\nGlobal Settings\nSETTING\tVALUE\nUse Windows wired LAN network services for clients\tEnabled\nShared user credentials for network authentication\tEnabled\nNetwork Profile\nSecurity Settings\nEnable use of IEEE 802.1X authentication for network access\tEnabled\nEnforce use of IEEE 802.1X authentication for network access\tDisabled\nIEEE 802.1X Settings\nComputer Authentication\tComputer only\nMaximum Authentication Failures\t10\nMaximum EAPOL-Start Messages Sent\t \nHeld Period (seconds)\t \nStart Period (seconds)\t \nAuthentication Period (seconds)\t \nNetwork Authentication Method Properties\nAuthentication method\tProtected EAP (PEAP)\nValidate server certificate\tEnabled\nConnect to these servers\t \nDo not prompt user to authorize new servers or trusted certification authorities\tDisabled\nEnable fast reconnect\tEnabled\nDisconnect if server does not present cryptobinding TLV\tDisabled\nEnforce network access protection\tDisabled\nAuthentication Method Configuration\nAuthentication method\tSecured password (EAP-MSCHAP v2)\nAutomatically use my Windows logon name and password(and domain if any)\tEnabled<\/code><\/pre>\n
\"Configuring
\n
\nLet's create a security group sg-computers-8021x-vl100<\/i><\/b>, where we will add the computers that we want to assign to VLAN 100 and configure filtering for the previously created group policy for this group:<\/p>\n
\"Configuring
\n
\nTo verify that the policy has been applied successfully, open the \u201cNetwork and Sharing Center (Network and Internet settings) \u2013 Change adapter settings (Configure adapter settings) \u2013 Adapter properties,\u201d where we can see the \u201cAuthentication\u201d tab:<\/p>\n
\"Configuring
\n
\nOnce we have confirmed that the policy is being applied successfully, we can move on to configuring the network policy on the NPS and the access switch ports.<\/p>\n
Let's create a network policy neag-computers-8021x-vl100<\/i><\/b>:<\/p>\n
Conditions:\n  Windows Groups - sg-computers-8021x-vl100\n  NAS Port Type - Ethernet\nConstraints:\n  Authentication Methods - Microsoft: Protected EAP (PEAP) - Unencrypted authentication (PAP, SPAP)\n  NAS Port Type - Ethernet\nSettings:\n  Standard:\n   Framed-MTU 1344\n   TunnelMediumType 802 (includes all 802 media plus Ethernet canonical format)\n   TunnelPrivateGroupId  100\n   TunnelType  Virtual LANs (VLAN)<\/code><\/pre>\n
\n\"Configuring
\n
\nTypical settings for the switch port (note that a multi-domain authentication type is used \u2013 Data & Voice, and there is also the possibility of authentication by MAC address. During the \u201ctransition period,\u201d it makes sense to use the parameters:<\/p>\n
\nauthentication event fail action authorize vlan 100\nauthentication event no-response action authorize vlan 100\n<\/code><\/pre>\n
\nthe VLAN ID is not 'quarantine', but the same one that the user\u2019s computer should enter upon successful authorization \u2013 until we ensure that everything works correctly. These parameters can also be used in other scenarios, for example, when an unmanaged switch is plugged into this port and you want all devices connected to it that have not passed authentication to enter a specific VLAN ('quarantine').<\/p>\n
settings for the switch port in 802.1x mode host-mode multi-domain<\/b><\/p>\n
default int range Gi1\/0\/39-41\nint range Gi1\/0\/39-41\nshu\ndes PC-IPhone_802.1x\nswitchport mode access\nswitchport nonegotiate\nswitchport voice vlan 55\nswitchport port-security maximum 2\nauthentication event fail action authorize vlan 100\nauthentication event no-response action authorize vlan 100\nauthentication host-mode multi-domain\nauthentication port-control auto\nauthentication violation restrict\nmab\ndot1x pae authenticator\ndot1x timeout quiet-period 15\ndot1x timeout tx-period 3\nstorm-control broadcast level pps 100\nstorm-control multicast level pps 110\nno vtp\nlldp receive\nlldp transmit\nspanning-tree portfast\nno shu\nexit<\/code><\/pre>\n
You can confirm that the computer\/phone has been authenticated successfully with the command:<\/p>\n
sh authentication sessions int Gi1\/0\/39 det<\/code><\/pre>\n
\nNow let's create a group (for example, sg-fgpp-mab<\/i> ) in Active Directory for phones and we'll add one device for testing (in my case, this is Grandstream GXP2160<\/i><\/b> with the MAC address 000b.82ba.a7b1<\/b> and the corresponding account domain 00b82baa7b1<\/b>). <\/p>\n
For the created group, we will lower the password policy requirements (using Fine-Grained Password Policies<\/a><\/noindex> through Active Directory Administrative Center -> domain -> System -> Password Settings Container) with the following parameters Password-Settings-for-MAB<\/i><\/b>:<\/p>\n
\"Configuring
\n
\nthus allowing the use of device MAC addresses as passwords. After this, we will be able to create a network policy for 802.1x authentication method mab, naming it neag-devices-8021x-voice. The parameters are as follows:<\/p>\n