{"id":42118,"date":"2019-03-18T00:00:00","date_gmt":"2019-03-17T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/nastrojka-802-1x-na-kommutatorah-cisco-s-pomoshhyu-otkazoustojchivogo-nps-windows-radius-with-ad"},"modified":"2020-02-18T13:44:55","modified_gmt":"2020-02-18T10:44:55","slug":"nastrojka-802-1x-na-kommutatorah-cisco-s-pomoshhyu-otkazoustojchivogo-nps-windows-radius-with-ad","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/nastrojka-802-1x-na-kommutatorah-cisco-s-pomoshhyu-otkazoustojchivogo-nps-windows-radius-with-ad","title":{"rendered":"Nastavenie 802.1X na prep\u00edna\u010doch Cisco pomocou redundantn\u00e9ho NPS (Windows RADIUS s AD)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Nastavenie
\nPozrime sa na praktick\u00e9 vyu\u017eitie Windows Active Directory + NPS (2 servery pre zabezpe\u010denie odolnosti) + \u0161tandard 802.1x na kontrolu pr\u00edstupu a autentifik\u00e1ciu pou\u017e\u00edvate\u013eov \u2013 dom\u00e9nov\u00fdch po\u010d\u00edta\u010dov \u2013 zariaden\u00ed. O te\u00f3rii o \u0161tandarde sa m\u00f4\u017eete dozvedie\u0165 na Wikip\u00e9dii, na odkaze: IEEE 802.1X<\/a><\/noindex><\/p>\n

Ke\u010f\u017ee moja \u201elaborat\u00f3rium\u201c je obmedzen\u00e9 zdrojmi, zl\u00fa\u010dim \u00falohy NPS a dom\u00e9nov\u00e9ho kontrol\u00e9ra, ale v\u00e1m odpor\u00fa\u010dam tak\u00e9to kritick\u00e9 slu\u017eby sk\u00f4r oddeli\u0165.<\/p>\n

Neviem o \u0161tandardn\u00fdch sp\u00f4soboch synchroniz\u00e1cie konfigur\u00e1ci\u00ed (polit\u00edk) Windows NPS, preto budeme pou\u017e\u00edva\u0165 PowerShell skripty sp\u00fa\u0161\u0165an\u00e9 pl\u00e1nova\u010dom \u00faloh (autor bol m\u00f4j b\u00fdval\u00fd kolega). Na autentifik\u00e1ciu dom\u00e9nov\u00fdch po\u010d\u00edta\u010dov a pre zariadenia, ktor\u00e9 nevedia o 802.1x<\/b> (telef\u00f3ny, tla\u010diarne a pod.), bude nastaven\u00e1 skupinov\u00e1 politika a vytvoren\u00e9 bezpe\u010dnostn\u00e9 skupiny.<\/p>\n

Na konci \u010dl\u00e1nku sa podel\u00edm o niektor\u00e9 detaily pr\u00e1ce s 802.1x \u2013 ako je mo\u017en\u00e9 pou\u017e\u00edva\u0165 neadministrat\u00edvne prep\u00edna\u010de, dynamick\u00e9 ACL a pod. Zdie\u013eam inform\u00e1cie o zachyten\u00fdch \u201echybi\u010dk\u00e1ch\u201c...
\n<\/a><\/noindex>
\nZa\u010dneme in\u0161tal\u00e1ciou a nastaven\u00edm failover NPS na Windows Server 2012R2 (na 2016 je to podobn\u00e9): prostredn\u00edctvom Spr\u00e1vcu servera -> Sprievodca pridan\u00edm rol\u00ed a funkci\u00ed vyberieme len Network Policy Server.<\/p>\n

\"Nastavenie
\n
\nalebo pomocou PowerShell:<\/p>\n

Install-WindowsFeature NPAS -IncludeManagementTools<\/code><\/pre>\n
<\/p>\n
Mal\u00e9 upresnenie \u2013 preto\u017ee pre Protected EAP (PEAP)<\/b> budete potrebova\u0165 certifik\u00e1t, ktor\u00fd potvrdzuje pravos\u0165 servera (so zodpovedaj\u00facimi pr\u00e1vami na pou\u017e\u00edvanie), ktor\u00fd bude v d\u00f4veryhodn\u00fdch na klientskych po\u010d\u00edta\u010doch, pravdepodobne budete musie\u0165 nain\u0161talova\u0165 aj rolu Certification Authority<\/b>. Ale pova\u017eujme to, \u017ee CA<\/b> u\u017e m\u00e1te nain\u0161talovan\u00e9...<\/p><\/blockquote>\n
 Urob\u00edme to ist\u00e9 aj na druhom serveri. Vytvor\u00edme prie\u010dinok pre skript C:Scripts na oboch serveroch a sie\u0165ov\u00fd prie\u010dinok na druhom serveri SRV2NPS-config$<\/b><\/p>\n
Na prvom serveri vytvor\u00edme PowerShell skript C:ScriptsExport-NPS-config.ps1<\/i> so nasleduj\u00facim obsahom:<\/p>\n
Export-NpsConfiguration -Path \"SRV2NPS-config$NPS.xml\"<\/code><\/pre>\n
\nPotom nastav\u00edme \u00falohu v Pl\u00e1nova\u010di \u00faloh: \u201cExport-NpsConfiguration<\/i>\u201d<\/p>\n
powershell -executionpolicy unrestricted -f \"C:ScriptsExport-NPS-config.ps1\"<\/code><\/pre>\n
\nVykon\u00e1va\u0165 pre v\u0161etk\u00fdch pou\u017e\u00edvate\u013eov \u2014 vykona\u0165 s najvy\u0161\u0161\u00edmi pr\u00e1vami
\nKa\u017edodenne \u2014 opakova\u0165 \u00falohu ka\u017ed\u00fdch 10 min\u00fat po\u010das 8 hod\u00edn.<\/i><\/p>\n
Na z\u00e1lo\u017enom NPS nastav\u00edme import konfigur\u00e1cie (polit\u00edk):
\nvytvor\u00edme skript PowerShell:<\/p>\n
echo Import-NpsConfiguration -Path \"c:NPS-configNPS.xml\" >> C:ScriptsImport-NPS-config.ps1<\/code><\/pre>\n
\na \u00falohu na jeho vykonanie ka\u017ed\u00fdch 10 min\u00fat:<\/p>\n
powershell -executionpolicy unrestricted -f \"C:ScriptsImport-NPS-config.ps1\"<\/code><\/pre>\n
\nVykon\u00e1va\u0165 pre v\u0161etk\u00fdch pou\u017e\u00edvate\u013eov \u2014 vykona\u0165 s najvy\u0161\u0161\u00edmi pr\u00e1vami
\nKa\u017edodenne \u2014 opakova\u0165 \u00falohu ka\u017ed\u00fdch 10 min\u00fat po\u010das 8 hod\u00edn.<\/i><\/p>\n
Teraz, na kontrolu, prid\u00e1me do NPS na jednom z serverov (!) nieko\u013eko prep\u00edna\u010dov do RADIUS klientov (IP a Shared Secret), dve politiky \u017eiadost\u00ed o pripojenie: WIRED-Connect<\/b> (Podmienka: \u201eTyp portu NAS \u2013 Ethernet\u201c) a WiFi-Enterprise<\/b> (Podmienka: \u201eTyp portu NAS \u2013 IEEE 802.11\u201c), ako aj sie\u0165ov\u00fa politiku Access Cisco Network Devices<\/i><\/b> (Spr\u00e1vcovia siete):<\/p>\n
Podmienky:\nSkupiny Windows - domainsg-network-admins\nObmedzenia:\nMet\u00f3dy overovania - Overenie otvoren\u00fdm textom (PAP, SPAP)\nParametre:\nAtrib\u00faty RADIUS: \u0160tandard - Service-Type - Login\nZ\u00e1visl\u00e9 od dod\u00e1vate\u013ea - Cisco-AV-Pair - Cisco - shell:priv-lvl=15<\/code><\/pre>\n
Z poh\u013eadu prep\u00edna\u010dov s\u00fa nasleduj\u00face nastavenia:<\/b><\/p>\n
aaa new-model\naaa local authentication attempts max-fail 5\n!\n!\naaa group server radius NPS\n server-private 192.168.38.151 auth-port 1812 acct-port 1813 key %shared_secret%\n server-private 192.168.10.151 auth-port 1812 acct-port 1813 key %shared_secret%\n!\naaa authentication login default group NPS local\naaa authentication dot1x default group NPS\naaa authorization console\naaa authorization exec default group NPS local if-authenticated\naaa authorization network default group NPS\n!\naaa session-id common\n!\nidentity profile default\n!\ndot1x system-auth-control\n!\n!\nline vty 0 4\n exec-timeout 5 0\n transport input ssh\n escape-character 99\nline vty 5 15\n exec-timeout 5 0\n logging synchronous\n transport input ssh\n escape-character 99<\/code><\/pre>\n
Po nastaven\u00ed, po 10 min\u00fatach, by v\u0161etci klienti, politiky a parametre mali by\u0165 vidite\u013en\u00e9 aj na z\u00e1lo\u017enom NPS a budeme sa m\u00f4c\u0165 autentizova\u0165 na prep\u00edna\u010doch pomocou \u00fa\u010dtu Active Directory, \u010dlena skupiny domainsg-network-admins (ktor\u00fa sme vytvorili vopred).<\/p>\n
Prejdeme k nastaveniu Active Directory \u2013 vytvor\u00edme skupinov\u00fa a heslov\u00fa politiku, vytvor\u00edme potrebn\u00e9 skupiny.<\/p>\n
Skupinov\u00e1 politika Computers-8021x-Settings<\/b><\/i>:<\/p>\n
<\/p>\n
Konfigur\u00e1cia po\u010d\u00edta\u010da (Povolen\u00e9)\n   Politiky\n     Windows nastavenia\n        Bezpe\u010dnostn\u00e9 nastavenia\n          Syst\u00e9mov\u00e9 slu\u017eby\n     Wired AutoConfig (Re\u017eim spustenia: Automatick\u00fd)\nPolitiky bezdr\u00f4tovej siete (802.3)<\/code><\/pre>\n
<\/b>
\nNPS-802-1x<\/b><\/p>\n
N\u00e1zov\tNPS-802-1x\nPopis\t802.1x\nGlob\u00e1lne nastavenia\nNastavenie\tHodnota\nPou\u017ei\u0165 slu\u017eby siet\u00ed LAN Windows pre klientov\tPovolen\u00e9\nZdie\u013ean\u00e9 pou\u017e\u00edvate\u013esk\u00e9 poverenia pre autentiz\u00e1ciu v sieti\tPovolen\u00e9\nProfil siete\nBezpe\u010dnostn\u00e9 nastavenia\nPovoli\u0165 pou\u017eitie autentifik\u00e1cie IEEE 802.1X pre pr\u00edstup do siete\tPovolen\u00e9\nPresadi\u0165 pou\u017eitie autentifik\u00e1cie IEEE 802.1X pre pr\u00edstup do siete\tZak\u00e1zan\u00e9\nNastavenia IEEE 802.1X\nAutentiz\u00e1cia po\u010d\u00edta\u010da\tIba po\u010d\u00edta\u010d\nMaxim\u00e1lne zlyhania autentifik\u00e1cie\t10\nMaxim\u00e1lny po\u010det odoslan\u00fdch EAPOL-Start spr\u00e1v\t \nDr\u017ean\u00fd \u010das (sekundy)\t \nPo\u010diato\u010dn\u00fd \u010das (sekundy)\t \n\u010cas autentifik\u00e1cie (sekundy)\t \nVlastnosti met\u00f3dy autentifik\u00e1cie siete\nMet\u00f3da autentifik\u00e1cie\tChr\u00e1nen\u00e9 EAP (PEAP)\nOveri\u0165 certifik\u00e1t servera\tPovolen\u00e9\nPripoji\u0165 sa k t\u00fdmto serverom\t \nNep\u00fdta\u0165 pou\u017e\u00edvate\u013ea, aby autorizoval nov\u00e9 servery alebo d\u00f4veryhodn\u00e9 certifika\u010dn\u00e9 autority\tZak\u00e1zan\u00e9\nPovoli\u0165 r\u00fdchle prepojenie\tPovolen\u00e9\nOdpoji\u0165, ak server nepredlo\u017e\u00ed cryptobinding TLV\tZak\u00e1zan\u00e9\nPresadi\u0165 ochranu pr\u00edstupu do siete\tZak\u00e1zan\u00e9\nKonfigur\u00e1cia met\u00f3dy autentifik\u00e1cie\nMet\u00f3da autentifik\u00e1cie\tZabezpe\u010den\u00e9 heslo (EAP-MSCHAP v2)\nAutomaticky pou\u017ei\u0165 moje meno a heslo Windows (a dom\u00e9nu, ak existuje)\tPovolen\u00e9<\/code><\/pre>\n
\"Nastavenie
\n
\nVytvor\u00edme skupinu zabezpe\u010denia sg-computers-8021x-vl100<\/i><\/b>, kde budeme prid\u00e1va\u0165 po\u010d\u00edta\u010de, ktor\u00e9 chceme priradi\u0165 do VLAN 100 a nastav\u00edme filtrovanie pre vytvoren\u00fa predt\u00fdm skupinov\u00fa politiku na t\u00fato skupinu:<\/p>\n
\"Nastavenie
\n
\nOveri\u0165, \u010di politika \u00faspe\u0161ne funguje, je mo\u017en\u00e9 otvoren\u00edm \u201eCentra spr\u00e1vy siet\u00ed a zdie\u013eania (Nastavenia siete a internetu) \u2013 Zmeni\u0165 nastavenia adapt\u00e9ra (Nastavenie vlastnost\u00ed adapt\u00e9ra) \u2013 Vlastnosti adapt\u00e9ra\u201c, kde uvid\u00edme kartu \u201eOverenie\u201c:<\/p>\n
\"Nastavenie
\n
\nKe\u010f\u017ee sme sa presved\u010dili, \u017ee politika sa \u00faspe\u0161ne aplikuje, m\u00f4\u017eeme prejs\u0165 k nastaveniu sie\u0165ovej politiky na NPS a portov pr\u00edstupov\u00e9ho prep\u00edna\u010da.<\/p>\n
Vytvor\u00edme sie\u0165ov\u00fa politiku neag-computers-8021x-vl100<\/i><\/b>:<\/p>\n
Podmienky:\n  Windows skupiny - sg-computers-8021x-vl100\n  Typ portu NAS - Ethernet\nObmedzenia:\n  Met\u00f3dy autentiz\u00e1cie - Microsoft: Chr\u00e1nen\u00e9 EAP (PEAP) - Ne\u0161ifrovan\u00e1 autentiz\u00e1cia (PAP, SPAP)\n  Typ portu NAS - Ethernet\nNastavenia:\n  \u0160tandard:\n   Framed-MTU 1344\n   TunnelMediumType 802 (zah\u0155\u0148a v\u0161etky 802 m\u00e9di\u00e1 plus Ethernet kanonick\u00fd form\u00e1t)\n   TunnelPrivateGroupId  100\n   TunnelType  Virtu\u00e1lne LAN (VLAN)<\/code><\/pre>\n
\n\"Nastavenie
\n
\nTypick\u00e9 nastavenia pre port prep\u00edna\u010da (zd\u00f4raz\u0148ujem, \u017ee sa pou\u017e\u00edva typ autentiz\u00e1cie \u201emultidom\u00e9n\u201c \u2013 Data & Voice, a takisto je tu mo\u017enos\u0165 autentiz\u00e1cie pod\u013ea MAC adresy. Po\u010das \u201eprechodn\u00e9ho obdobia\u201c m\u00e1 zmysel pou\u017ei\u0165 v parametroch:<\/p>\n
\nakcia autorizova\u0165 VLAN 100 pri ne\u00faspe\u0161nom autentiz\u00e1cii\na.kcia autorizova\u0165 VLAN 100 pri nedostato\u010dnej odpovedi\n<\/code><\/pre>\n
\nVLAN ID nie je \u201ekarant\u00e9nne\u201c, ale to ist\u00e9, kam by mal pou\u017e\u00edvate\u013esk\u00fd po\u010d\u00edta\u010d pr\u00eds\u0165 po \u00faspe\u0161nej autoriz\u00e1cii \u2013 pokia\u013e sa presved\u010d\u00edme, \u017ee v\u0161etko funguje ako m\u00e1. Tieto parametre m\u00f4\u017eu by\u0165 pou\u017eit\u00e9 aj v in\u00fdch scen\u00e1roch, napr\u00edklad, ke\u010f do tohto portu zapoj\u00edte nejak\u00fd neovl\u00e1dan\u00fd prep\u00edna\u010d a chcete, aby v\u0161etky zariadenia, ktor\u00e9 s\u00fa k nemu pripojen\u00e9 a nepre\u0161li autentiz\u00e1ciou, patrili do ur\u010dit\u00e9ho VLAN (\u201ekarant\u00e9nneho\u201c).<\/p>\n
nastavenia portu prep\u00edna\u010da v re\u017eime 802.1x host-mode multi-domain<\/b><\/p>\n
default int range Gi1\/0\/39-41\nint range Gi1\/0\/39-41\nshu\ndes PC-IPhone_802.1x\nswitchport mode access\nswitchport nonegotiate\nswitchport voice vlan 55\nswitchport port-security maximum 2\nauthentication event fail action authorize vlan 100\nauthentication event no-response action authorize vlan 100\nauthentication host-mode multi-domain\nauthentication port-control auto\nauthentication violation restrict\nmab\ndot1x pae authenticator\ndot1x timeout quiet-period 15\ndot1x timeout tx-period 3\nstorm-control broadcast level pps 100\nstorm-control multicast level pps 110\nno vtp\nlldp receive\nlldp transmit\nspanning-tree portfast\nno shu\nexit<\/code><\/pre>\n
Skontrolova\u0165, \u010di po\u010d\u00edta\u010d\/telef\u00f3n \u00faspe\u0161ne pre\u0161iel autentiz\u00e1ciou, je mo\u017en\u00e9 pr\u00edkazom:<\/p>\n
sh authentication sessions int Gi1\/0\/39 det<\/code><\/pre>\n
\nTeraz vytvor\u00edme skupinu (napr\u00edklad, sg-fgpp-mab<\/i> ) v Active Directory pre telef\u00f3ny a prid\u00e1me do nej jedno zariadenie na testovanie (v mojom pr\u00edpade je to Grandstream GXP2160<\/i><\/b> s mac-adresou 000b.82ba.a7b1<\/b> a odpovedaj\u00facim \u00fa\u010dtom domain 00b82baa7b1<\/b>). <\/p>\n
Pre vytvoren\u00fa skupinu zn\u00ed\u017eime po\u017eiadavky politiky hesiel (pou\u017eit\u00edm Fine-Grained Password Policies<\/a><\/noindex> cez Active Directory Administrative Center -> domain -> System -> Password Settings Container) s tak\u00fdmito parametrami Password-Settings-for-MAB<\/i><\/b>:<\/p>\n
\"Nastavenie
\n
\nt\u00fdmto umo\u017en\u00edme pou\u017e\u00edva\u0165 mac-adresy zariaden\u00ed ako hesl\u00e1. Po tomto budeme m\u00f4c\u0165 vytvori\u0165 sie\u0165ov\u00fa politiku pre autentifik\u00e1ciu 802.1x met\u00f3dou mab, nazveme ju neag-devices-8021x-voice. Parametre s\u00fa nasledovn\u00e9:<\/p>\n