Tiyeni tikambirane mchitidwe ntchito Windows Active Directory + NPS (2 maseva kuonetsetsa zolakwika kulolerana) + 802.1x muyezo kulamulira mwayi ndi kutsimikizika kwa owerenga - ankalamulira makompyuta - zipangizo. Mutha kudziwa bwino chiphunzitsocho malinga ndi muyezo wa Wikipedia, pa ulalo:
Popeza "laboratory" yanga ili yochepa pazinthu, maudindo a NPS ndi woyang'anira dera amagwirizana, koma ndikupangira kuti mulekanitsebe mautumiki ovuta.
Sindikudziwa njira zoyenera zolumikizira masinthidwe a Windows NPS (ndondomeko), kotero tidzagwiritsa ntchito zolemba za PowerShell zoyambitsidwa ndi wokonza ntchito (wolembayo ndi mnzanga wakale). Kwa kutsimikizika kwa makompyuta apakompyuta ndi zida zomwe sizingatheke 802.1x (mafoni, osindikiza, ndi zina zotero), ndondomeko yamagulu idzakonzedwa ndipo magulu achitetezo adzapangidwa.
Pamapeto pa nkhaniyi, ndikuuzani za zovuta zina zogwirira ntchito ndi 802.1x - momwe mungagwiritsire ntchito masiwichi osayendetsedwa, ma ACL amphamvu, ndi zina zotero. Ndidzagawana zambiri za "glitches" zomwe zinagwidwa .. .
Tiyeni tiyambe ndi kukhazikitsa ndi kukonza failover NPS pa Windows Server 2012R2 (zonse ndi zofanana mu 2016): kudzera pa Server Manager -> Add Roles and Features Wizard, sankhani Network Policy Server yokha.
kapena kugwiritsa ntchito PowerShell:
Install-WindowsFeature NPAS -IncludeManagementToolsKufotokozera pang'ono - kuyambira kwa Chitetezo cha EAP (PEAP) mudzafunika satifiketi yotsimikizira kutsimikizika kwa seva (yokhala ndi ufulu wogwiritsa ntchito), yomwe idali yodalirika pamakompyuta a kasitomala, ndiye kuti mungafunike kukhazikitsa gawolo. Certification Authority. Koma ife tidzaganiza zimenezo CA mwaiyika kale...
Tiyeni tichite zomwezo pa seva yachiwiri. Tiyeni tipange foda ya C:Scripts script pa maseva onse ndi foda ya netiweki pa seva yachiwiri SRV2NPS-config$
Tiyeni tipange script ya PowerShell pa seva yoyamba C:ScriptsExport-NPS-config.ps1 ndi izi:
Export-NpsConfiguration -Path "SRV2NPS-config$NPS.xml"Pambuyo pake, tiyeni tikonze ntchitoyo mu Task Sheduler: "Kutumiza kunja-NpsConfiguration"
powershell -executionpolicy unrestricted -f "C:ScriptsExport-NPS-config.ps1"
Thamangani kwa ogwiritsa ntchito onse - Thamangani ndi ufulu wapamwamba kwambiri
Tsiku ndi tsiku - Bwerezani ntchitoyi mphindi 10 zilizonse. mkati mwa maola 8
Pa zosunga zobwezeretsera za NPS, sinthani zosintha (ndondomeko):
Tiyeni tipange script ya PowerShell:
echo Import-NpsConfiguration -Path "c:NPS-configNPS.xml" >> C:ScriptsImport-NPS-config.ps1ndi ntchito yoti muchite mphindi 10 zilizonse:
powershell -executionpolicy unrestricted -f "C:ScriptsImport-NPS-config.ps1"
Thamangani kwa ogwiritsa ntchito onse - Thamangani ndi ufulu wapamwamba kwambiri
Tsiku ndi tsiku - Bwerezani ntchitoyi mphindi 10 zilizonse. mkati mwa maola 8
Tsopano, kuti tiwone, tiyeni tiwonjezere ku NPS pa imodzi mwama seva(!) Zosintha zingapo mwamakasitomala a RADIUS (IP ndi Chinsinsi Chogawana), mfundo ziwiri zopempha zolumikizira: WIRED-Connect (Mkhalidwe: "mtundu wa doko la NAS ndi Ethernet") ndi WiFi-Enterprise (Mkhalidwe: "Mtundu wa doko la NAS ndi IEEE 802.11"), komanso ndondomeko ya intaneti Pezani Cisco Network Devices (Network Admins):
Π£ΡΠ»ΠΎΠ²ΠΈΡ:
ΠΡΡΠΏΠΏΡ Windows - domainsg-network-admins
ΠΠ³ΡΠ°Π½ΠΈΡΠ΅Π½ΠΈΡ:
ΠΠ΅ΡΠΎΠ΄Ρ ΠΏΡΠΎΠ²Π΅ΡΠΊΠΈ ΠΏΠΎΠ΄Π»ΠΈΠ½Π½ΠΎΡΡΠΈ - ΠΡΠΎΠ²Π΅ΡΠΊΠ° ΠΎΡΠΊΡΡΡΡΠΌ ΡΠ΅ΠΊΡΡΠΎΠΌ (PAP, SPAP)
ΠΠ°ΡΠ°ΠΌΠ΅ΡΡΡ:
ΠΡΡΠΈΠ±ΡΡΡ RADIUS: Π‘ΡΠ°Π½Π΄Π°ΡΡ - Service-Type - Login
ΠΠ°Π²ΠΈΡΡΡΠΈΠ΅ ΠΎΡ ΠΏΠΎΡΡΠ°Π²ΡΠΈΠΊΠ° - Cisco-AV-Pair - Cisco - shell:priv-lvl=15Pa mbali ya switch, zoikamo zotsatirazi:
aaa new-model
aaa local authentication attempts max-fail 5
!
!
aaa group server radius NPS
server-private 192.168.38.151 auth-port 1812 acct-port 1813 key %shared_secret%
server-private 192.168.10.151 auth-port 1812 acct-port 1813 key %shared_secret%
!
aaa authentication login default group NPS local
aaa authentication dot1x default group NPS
aaa authorization console
aaa authorization exec default group NPS local if-authenticated
aaa authorization network default group NPS
!
aaa session-id common
!
identity profile default
!
dot1x system-auth-control
!
!
line vty 0 4
exec-timeout 5 0
transport input ssh
escape-character 99
line vty 5 15
exec-timeout 5 0
logging synchronous
transport input ssh
escape-character 99Pambuyo pokonza, pakatha mphindi 10, makasitomala onse ogwirizana nawo ayenera kuwonekera pa zosunga zobwezeretsera za NPS ndipo tidzatha kulowa ma switch pogwiritsa ntchito akaunti ya ActiveDirectory, membala wa gulu la domainsg-network-admins (lomwe tidapanga pasadakhale).
Tiyeni tipitirire kukhazikitsa Active Directory - pangani mfundo zamagulu ndi mawu achinsinsi, pangani magulu ofunikira.
Gulu Policy Makompyuta-8021x-Zikhazikiko:
Computer Configuration (Enabled)
Policies
Windows Settings
Security Settings
System Services
Wired AutoConfig (Startup Mode: Automatic)
Wired Network (802.3) Policies
NPS-802-1x
Name NPS-802-1x
Description 802.1x
Global Settings
SETTING VALUE
Use Windows wired LAN network services for clients Enabled
Shared user credentials for network authentication Enabled
Network Profile
Security Settings
Enable use of IEEE 802.1X authentication for network access Enabled
Enforce use of IEEE 802.1X authentication for network access Disabled
IEEE 802.1X Settings
Computer Authentication Computer only
Maximum Authentication Failures 10
Maximum EAPOL-Start Messages Sent
Held Period (seconds)
Start Period (seconds)
Authentication Period (seconds)
Network Authentication Method Properties
Authentication method Protected EAP (PEAP)
Validate server certificate Enabled
Connect to these servers
Do not prompt user to authorize new servers or trusted certification authorities Disabled
Enable fast reconnect Enabled
Disconnect if server does not present cryptobinding TLV Disabled
Enforce network access protection Disabled
Authentication Method Configuration
Authentication method Secured password (EAP-MSCHAP v2)
Automatically use my Windows logon name and password(and domain if any) Enabled
Tiyeni tipange gulu lachitetezo sg-makompyuta-8021x-vl100, komwe tidzawonjezera makompyuta omwe tikufuna kugawa ku vlan 100 ndikusintha kusefa kwa mfundo zamagulu zomwe zidapangidwa kale za gululi:
Mukhoza kutsimikizira kuti ndondomekoyi yagwira ntchito bwino potsegula "Network and Sharing Center (Network and Internet Settings) - Kusintha makonzedwe a adaputala (Kukonza zosintha za adaputala) - Zida za Adapter ", kumene tingawone "Kutsimikizika" tabu:
Mukatsimikiza kuti ndondomekoyi ikugwiritsidwa ntchito bwino, mukhoza kupitiriza kukhazikitsa ndondomeko ya netiweki pa NPS ndi madoko osinthira ofikira.
Tiyeni tipange ndondomeko ya netiweki neag-makompyuta-8021x-vl100:
Conditions:
Windows Groups - sg-computers-8021x-vl100
NAS Port Type - Ethernet
Constraints:
Authentication Methods - Microsoft: Protected EAP (PEAP) - Unencrypted authentication (PAP, SPAP)
NAS Port Type - Ethernet
Settings:
Standard:
Framed-MTU 1344
TunnelMediumType 802 (includes all 802 media plus Ethernet canonical format)
TunnelPrivateGroupId 100
TunnelType Virtual LANs (VLAN)
Zokonda zofananira za doko losinthira (chonde dziwani kuti mtundu wotsimikizika wa "multi-domain" umagwiritsidwa ntchito - Data & Voice, komanso pali mwayi wotsimikizira ndi adilesi ya mac. Pa "nthawi yosinthira" ndizomveka kugwiritsa ntchito magawo:
authentication event fail action authorize vlan 100
authentication event no-response action authorize vlan 100
Id ya vlan si "yotsekereza", koma yomweyi pomwe kompyuta ya wosuta iyenera kupita ikalowa bwino - mpaka titatsimikiza kuti zonse zikuyenda momwe ziyenera kukhalira. Magawo omwewa atha kugwiritsidwa ntchito pazinthu zina, mwachitsanzo, pomwe chosinthira chosayendetsedwa chikalumikizidwa padoko ili ndipo mukufuna kuti zida zonse zolumikizidwa nazo zomwe sizinadutse kutsimikizika zigwere mu vlan inayake ("quarantine").
sinthani makonda adoko mu 802.1x host-mode multi-domain mode
default int range Gi1/0/39-41
int range Gi1/0/39-41
shu
des PC-IPhone_802.1x
switchport mode access
switchport nonegotiate
switchport voice vlan 55
switchport port-security maximum 2
authentication event fail action authorize vlan 100
authentication event no-response action authorize vlan 100
authentication host-mode multi-domain
authentication port-control auto
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout quiet-period 15
dot1x timeout tx-period 3
storm-control broadcast level pps 100
storm-control multicast level pps 110
no vtp
lldp receive
lldp transmit
spanning-tree portfast
no shu
exitMutha kutsimikiza kuti kompyuta yanu ndi foni yanu zapambana kutsimikizika ndi lamulo ili:
sh authentication sessions int Gi1/0/39 detTsopano tiyeni tipange gulu (mwachitsanzo, sg-fgpp-mab ) mu Active Directory pama foni ndikuwonjezera chipangizo chimodzi kuti chiyesedwe (kwa ine ndi Chithunzi cha Grandstream GXP2160 ndi mas adilesi 000b.82ba.a7b1 ndi resp. akaunti Chithunzi cha 00b82baa7b1).
Pagulu lomwe lapangidwa, tidzachepetsa zofunikira za mfundo zachinsinsi (pogwiritsa ntchito kudzera pa Active Directory Administrative Center -> domain -> System -> Password Settings Container) yokhala ndi magawo otsatirawa Zokonda-zokonda-za-MAB:
Chifukwa chake, tidzalola kugwiritsa ntchito ma adilesi a chipangizo ngati mawu achinsinsi. Pambuyo pake titha kupanga ndondomeko ya netiweki ya 802.1x njira mab kutsimikizika, tiyeni tiziyitcha neag-devices-8021x-voice. Ma parameters ndi awa:
- Mtundu wa Port wa NAS - Ethernet
- Magulu a Windows - sg-fgpp-mab
- Mitundu ya EAP: Kutsimikizika kosadziwika (PAP, SPAP)
- RADIUS Attributes - Vendor Special: Cisco - Cisco-AV-Pair - Mtengo wamtengo: chipangizo-traffic-class=voice
Pambuyo potsimikizira bwino (musaiwale kukonza doko losinthira), tiyeni tiwone zambiri kuchokera padoko:
sh kutsimikizika se int Gi1/0/34
----------------------------------------
Interface: GigabitEthernet1/0/34
MAC Address: 000b.82ba.a7b1
IP Address: 172.29.31.89
User-Name: 000b82baa7b1
Status: Authz Success
Domain: VOICE
Oper host mode: multi-domain
Oper control dir: both
Authorized By: Authentication Server
Session timeout: N/A
Idle timeout: N/A
Common Session ID: 0000000000000EB2000B8C5E
Acct Session ID: 0x00000134
Handle: 0xCE000EB3
Runnable methods list:
Method State
dot1x Failed over
mab Authc SuccessTsopano, monga momwe analonjezera, tiyeni tiwone zochitika zingapo zomwe sizikuwonekeratu. Mwachitsanzo, tifunika kulumikiza makompyuta ogwiritsira ntchito ndi zipangizo pogwiritsa ntchito switch yosayendetsedwa (kusintha). Pankhaniyi, zoikidwiratu doko adzawoneka motere:
sinthani makonda adoko mu 802.1x host-mode multi-auth mode
interface GigabitEthernet1/0/1
description *SW β 802.1x β 8 mac*
shu
switchport mode access
switchport nonegotiate
switchport voice vlan 55
switchport port-security maximum 8 ! ΡΠ²Π΅Π»ΠΈΡΠΈΠ²Π°Π΅ΠΌ ΠΊΠΎΠ»-Π²ΠΎ Π΄ΠΎΠΏΡΡΡΠΈΠΌΡΡ
ΠΌΠ°Ρ-Π°Π΄ΡΠ΅ΡΠΎΠ²
authentication event fail action authorize vlan 100
authentication event no-response action authorize vlan 100
authentication host-mode multi-auth ! β ΡΠ΅ΠΆΠΈΠΌ Π°ΡΡΠ΅Π½ΡΠΈΡΠΈΠΊΠ°ΡΠΈΠΈ
authentication port-control auto
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout quiet-period 15
dot1x timeout tx-period 3
storm-control broadcast level pps 100
storm-control multicast level pps 110
no vtp
spanning-tree portfast
no shuPS tawona glitch yodabwitsa kwambiri - ngati chipangizocho chidalumikizidwa kudzera pa switch yotere, ndiyeno chidalumikizidwa ndi switch yoyendetsedwa, SINGAgwire ntchito mpaka tiyambitsenso (!) switch. Sindinapeze njira zina zilizonse. kuthetsa vutoli panobe.
Mfundo ina yokhudzana ndi DHCP (ngati ip dhcp snooping ikugwiritsidwa ntchito) - popanda zosankha zotere:
ip dhcp snooping vlan 1-100
no ip dhcp snooping information optionPazifukwa zina sindingathe kupeza adilesi ya IP molondola ... ngakhale izi zingakhale mbali ya seva yathu ya DHCP
Ndipo Mac OS & Linux (omwe ali ndi chithandizo cha 802.1x) yesani kutsimikizira wogwiritsa ntchito, ngakhale kutsimikiziridwa ndi adilesi ya Mac kukhazikitsidwa.
Mu gawo lotsatira la nkhaniyi, tiwona kugwiritsa ntchito kwa 802.1x kwa Wireless (malingana ndi gulu lomwe akaunti ya wosuta ili nayo, "tidzayiponya" mu netiweki yofananira (vlan), ngakhale ilumikizidwa SSID yomweyo).
Source: www.habr.com