{"id":42118,"date":"2019-03-18T00:00:00","date_gmt":"2019-03-17T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/nastrojka-802-1x-na-kommutatorah-cisco-s-pomoshhyu-otkazoustojchivogo-nps-windows-radius-with-ad"},"modified":"2020-02-18T13:44:55","modified_gmt":"2020-02-18T10:44:55","slug":"nastrojka-802-1x-na-kommutatorah-cisco-s-pomoshhyu-otkazoustojchivogo-nps-windows-radius-with-ad","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/nastrojka-802-1x-na-kommutatorah-cisco-s-pomoshhyu-otkazoustojchivogo-nps-windows-radius-with-ad","title":{"rendered":"Konfigurimi i 802.1X n\u00eb switches Cisco me NPS me q\u00ebndrueshm\u00ebri (Windows RADIUS me AD)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Konfigurimi
\nLe t\u00eb shqyrtojm\u00eb praktikisht p\u00ebrdorimin e Windows Active Directory + NPS (2 server\u00eb p\u00ebr t\u00eb siguruar q\u00ebndrueshm\u00ebrin\u00eb) + standardin 802.1x p\u00ebr kontrollin e aksesit dhe autentifikimin e p\u00ebrdoruesve \u2013 kompjuter\u00ebve t\u00eb domenit \u2013 pajisjeve. Mund t\u00eb njiheni me teorin\u00eb mbi standardin n\u00eb Wikipedia, n\u00eb lidhjen: IEEE 802.1X<\/a><\/noindex><\/p>\n

Duke qen\u00eb se \u201claboratori\u201d im \u00ebsht\u00eb i kufizuar n\u00eb burime, un\u00eb kombinoj rolet NPS dhe kontrolluesin e domenit, por ju rekomandoj q\u00eb sh\u00ebrbime kaq kritike t'i ndani.<\/p>\n

Nuk di m\u00ebnyra standarde p\u00ebr sinkronizimin e konfigurimeve (politikave) t\u00eb Windows NPS, prandaj do t\u00eb p\u00ebrdorim skriptet PowerShell, t\u00eb cilat do t\u00eb ekzekutohen nga planifikuesi i detyrave (autori \u00ebsht\u00eb nj\u00eb ish-kolegu im). P\u00ebr autentifikimin e kompjuter\u00ebve n\u00eb domen dhe p\u00ebr pajisjet q\u00eb nuk e mb\u00ebshtesin 802.1x<\/b> (telefonat, printerat etj), do t\u00eb konfiguroni politik\u00ebn grupore dhe do t\u00eb krijoni grupe sigurie.<\/p>\n

N\u00eb fund t\u00eb artikullit do t\u00eb flas p\u00ebr disa nuanca t\u00eb pun\u00ebs me 802.1x \u2013 si mund t\u00eb p\u00ebrdoren switch-e t\u00eb pa menaxhuar, dynamic ACL dhe t\u00eb tjera. Do t\u00eb ndaj informacion rreth \u201cbug\u201d-eve\u201d t\u00eb kapura...
\n<\/a><\/noindex>
\nLe t\u00eb fillojm\u00eb me instalimin dhe konfigurimin e NPS p\u00ebr ndihm\u00eb n\u00eb Windows Server 2012R2 (n\u00eb 2016-\u00ebn \u00ebsht\u00eb e ngjashme): p\u00ebrmes Server Manager -> Shk wizardin p\u00ebr Shtimin e Rolleve dhe Karakteristikave, zgjedhim vet\u00ebm Serverin e Politika e Rrjetit.<\/p>\n

\"Konfigurimi
\n
\nose me ndihm\u00ebn e PowerShell:<\/p>\n

Install-WindowsFeature NPAS -IncludeManagementTools<\/code><\/pre>\n
<\/p>\n
Nj\u00eb sqarim i vog\u00ebl \u2013 q\u00eb t\u00eb Protected EAP (PEAP)<\/b> do t'ju nevojitet patjet\u00ebr nj\u00eb certifikat\u00eb q\u00eb v\u00ebrteton autentikimin e serverit (me t\u00eb drejtat p\u00ebrkat\u00ebse p\u00ebr p\u00ebrdorim), q\u00eb do t\u00eb jet\u00eb n\u00eb t\u00eb besuarit n\u00eb kompjuter\u00ebt klient\u00eb, prandaj ka gjasa t\u00eb nevojitet gjithashtu t\u00eb instaloni rolin Certification Authority<\/b>. Por le t\u00eb mendojm\u00eb se CA<\/b> ju tashm\u00eb e keni instaluar\u2026<\/p><\/blockquote>\n
 Do ta b\u00ebjm\u00eb t\u00eb nj\u00ebjt\u00ebn gj\u00eb edhe n\u00eb serverin e dyt\u00eb. Do t\u00eb krijojm\u00eb nj\u00eb dosje p\u00ebr skriptin C:Scripts n\u00eb t\u00eb dy server\u00ebt dhe nj\u00eb dosje rrjetore n\u00eb serverin e dyt\u00eb SRV2NPS-config$<\/b><\/p>\n
N\u00eb serverin e par\u00eb do t\u00eb krijojm\u00eb skriptin PowerShell C:ScriptsExport-NPS-config.ps1<\/i> me p\u00ebrmbajtjen e m\u00ebposhtme:<\/p>\n
Export-NpsConfiguration -Path \"SRV2NPS-config$NPS.xml\"<\/code><\/pre>\n
\nPas k\u00ebsaj do t\u00eb konfigurojm\u00eb nj\u00eb detyr\u00eb n\u00eb Task Scheduler: \"Export-NpsConfiguration<\/i>\u201d<\/p>\n
powershell -executionpolicy unrestricted -f \"C:ScriptsExport-NPS-config.ps1\"<\/code><\/pre>\n
\nEkzekutohet p\u00ebr t\u00eb gjith\u00eb p\u00ebrdoruesit \u2013 Ekzekutohet me t\u00eb drejtat m\u00eb t\u00eb larta
\n\u00c7do dit\u00eb \u2013 P\u00ebrs\u00ebritni detyr\u00ebn \u00e7do 10 minuta p\u00ebr 8 or\u00eb.<\/i><\/p>\n
N\u00eb NPS-in rezerv\u00eb do t\u00eb konfigurojm\u00eb importimin e konfigurimit (politikave):
\ndo t\u00eb krijojm\u00eb nj\u00eb skript PowerShell:<\/p>\n
echo Import-NpsConfiguration -Path \"c:NPS-configNPS.xml\" >> C:ScriptsImport-NPS-config.ps1<\/code><\/pre>\n
\ndhe nj\u00eb detyr\u00eb p\u00ebr t\u00eb ekzekutuar at\u00eb \u00e7do 10 minuta:<\/p>\n
powershell -executionpolicy unrestricted -f \"C:ScriptsImport-NPS-config.ps1\"<\/code><\/pre>\n
\nEkzekutohet p\u00ebr t\u00eb gjith\u00eb p\u00ebrdoruesit \u2013 Ekzekutohet me t\u00eb drejtat m\u00eb t\u00eb larta
\n\u00c7do dit\u00eb \u2013 P\u00ebrs\u00ebritni detyr\u00ebn \u00e7do 10 minuta p\u00ebr 8 or\u00eb.<\/i><\/p>\n
Tani, p\u00ebr verifikim, do t\u00eb shtojm\u00eb n\u00eb NPS n\u00eb nj\u00ebrin nga server\u00ebt (!) nj\u00eb \u00e7ift switch-esh n\u00eb RADIUS-klient\u00ebt (IP dhe Shared Secret), dy politika p\u00ebr k\u00ebrkesat e lidhjes: WIRED-Connect<\/b> (Kushti: \"Lloji i portit NAS \u2013 Ethernet\") dhe WiFi-Enterprise<\/b> (Kushti: \"Lloji i portit NAS \u2013 IEEE 802.11\"), si dhe nj\u00eb politk\u00eb rrjeti Access Cisco Network Devices<\/i><\/b> (Network Admins):<\/p>\n
Kushtet:\nGrupet Windows - domainsg-network-admins\nKufizimet:\nMetodat e verifikimit \u2013 Verifikimi n\u00eb tekst t\u00eb hapur (PAP, SPAP)\nParametrat:\nAtributet RADIUS: Standard - Service-Type - Login\nVarietetet e prodhuesit - Cisco-AV-Pair - Cisco - shell:priv-lvl=15<\/code><\/pre>\n
Nga ana e switch-eve, konfigurimet e m\u00ebposhtme:<\/b><\/p>\n
aaa new-model\naaa local authentication attempts max-fail 5\n!\n!\naaa group server radius NPS\n server-private 192.168.38.151 auth-port 1812 acct-port 1813 key %shared_secret%\n server-private 192.168.10.151 auth-port 1812 acct-port 1813 key %shared_secret%\n!\naaa authentication login default group NPS local\naaa authentication dot1x default group NPS\naaa authorization console\naaa authorization exec default group NPS local if-authenticated\naaa authorization network default group NPS\n!\naaa session-id common\n!\nidentity profile default\n!\ndot1x system-auth-control\n!\n!\nline vty 0 4\n exec-timeout 5 0\n transport input ssh\n escape-character 99\nline vty 5 15\n exec-timeout 5 0\n logging synchronous\n transport input ssh\n escape-character 99<\/code><\/pre>\n
Pas konfigurimit, pas 10 minutash, t\u00eb gjitha klient\u00ebt politikaparametrat duhet t\u00eb shfaqen edhe n\u00eb NPS-in rezerv\u00eb dhe ne do t\u00eb jemi n\u00eb gjendje t\u00eb autorizohemi n\u00eb switch-e me nj\u00eb llogari Active Directory, an\u00ebtar t\u00eb grupit domainsg-network-admins (t\u00eb cilin e krijuam m\u00eb par\u00eb).<\/p>\n
Le t\u00eb kalojm\u00eb n\u00eb konfigurimin e Active Directory \u2013 do t\u00eb krijojm\u00eb politikat grupore dhe t\u00eb fjal\u00ebkalimit, do t\u00eb krijojm\u00eb grupet e nevojshme.<\/p>\n
Politika grupore Computers-8021x-Settings<\/b><\/i>:<\/p>\n
<\/p>\n
Konfigurimi i Kompjuterit (Aktiv)\n   Politikate\n     Cil\u00ebsimet e Windows\n        Cil\u00ebsimet e Siguris\u00eb\n          Sh\u00ebrbimet e Sistemite\n     Wired AutoConfig (Modaliteti i Nism\u00ebs: Automatik)\nPolitikat e Rrjetit t\u00eb Nj\u00ebjta (802.3)<\/code><\/pre>\n
<\/b>
\nNPS-802-1x<\/b><\/p>\n
Emri\tNPS-802-1x\nP\u00ebrshkrimi\t802.1x\nCil\u00ebsimet Globale\nCIL\u00cbSIM\tVLER\u00cb\nP\u00ebrdor sh\u00ebrbimet e rrjetit LAN t\u00eb Windows p\u00ebr klient\u00ebt\tAktivizuar\nKredencialet e p\u00ebrbashk\u00ebta p\u00ebr autentifikimin n\u00eb rrjet\tAktivizuar\nProfili i Rrjetit\nCil\u00ebsimet e Siguris\u00eb\nAktivizo p\u00ebrdorimin e autentikimit IEEE 802.1X p\u00ebr qasje n\u00eb rrjet\tAktivizuar\nKufizo p\u00ebrdorimin e autentikimit IEEE 802.1X p\u00ebr qasje n\u00eb rrjet\t\u00c7aktivizuar\nCil\u00ebsimet IEEE 802.1X\nAutentifikimi i Kompjuterit\tVet\u00ebm kompjuter\nMaksimumi i D\u00ebshtimeve t\u00eb Autentifikimit\t10\nMaksimumi i Mesazheve EAPOL-Start t\u00eb D\u00ebrguara\t \nPeriudha e Mbajtjes (sekonda)\t \nPeriudha e Nism\u00ebs (sekonda)\t \nPeriudha e Autentifikimit (sekonda)\t \nPron\u00ebsit\u00eb e Metod\u00ebs s\u00eb Autentifikimit t\u00eb Rrjetit\nMetoda e autentifikimit\tProtected EAP (PEAP)\nV\u00ebrteto certifikat\u00ebn e serverit\tAktivizuar\nLidhu me k\u00ebto servera\t \nMos e k\u00ebrko p\u00ebrdoruesin p\u00ebr t\u00eb autorizuar server\u00eb t\u00eb rinj ose autoritete t\u00eb certifikimit t\u00eb besuara\t\u00c7aktivizuar\nAktivizo rikonekton e shpejt\u00eb\tAktivizuar\nShk\u00ebput n\u00ebse serveri nuk paraqet cryptobinding TLV\t\u00c7aktivizuar\nKufizo mbrojtjen e aksesit n\u00eb rrjet\t\u00c7aktivizuar\nKonfigurimi i Metod\u00ebs s\u00eb Autentifikimit\nMetoda e autentifikimit\tFjal\u00ebkalim t\u00eb siguruar (EAP-MSCHAP v2)\nP\u00ebrdor automatikisht emrin dhe fjal\u00ebkalimin e lidhjes sime Windows (dhe domenin n\u00ebse ka)\tAktivizuar<\/code><\/pre>\n
\"Konfigurimi
\n
\nDo t\u00eb krijojm\u00eb nj\u00eb grup sigurie sg-computers-8021x-vl100<\/i><\/b>, ku do t\u00eb shtojm\u00eb kompjuter\u00ebt q\u00eb duam t\u00eb shp\u00ebrndajm\u00eb n\u00eb VLAN 100 dhe do t\u00eb konfigurojm\u00eb filtrimin p\u00ebr politik\u00ebn grupore t\u00eb krijuar m\u00eb par\u00eb n\u00eb k\u00ebt\u00eb grup:<\/p>\n
\"Konfigurimi
\n
\nSigurohuni q\u00eb politika e cila \u00ebsht\u00eb aplikuar n\u00eb m\u00ebnyr\u00eb t\u00eb suksesshme mund t\u00eb kontrollohet duke e hapur \"Qendra e Menaxhimit t\u00eb Rrjeteve dhe Ndihm\u00ebsit (Parametrat e Rrjetit dhe Internetit) \u2013 Ndryshimi i parametrave t\u00eb adapterit (Konfigurimi i parametrave t\u00eb adapterit) \u2013 Pronat e adapterit\", ku ne mund t\u00eb shohim sked\u00ebn \"Kontrolli i Autenticitetit\":<\/p>\n
\"Konfigurimi
\n
\nKur t\u00eb jeni siguruar q\u00eb politika aplikohet me sukses, mund t\u00eb kaloni n\u00eb konfigurimin e politik\u00ebs rrjetore n\u00eb NPS dhe portet e switch-it t\u00eb nivelit t\u00eb aksesit.<\/p>\n
Le t\u00eb krijojm\u00eb nj\u00eb politik\u00eb rrjetore neag-computers-8021x-vl100<\/i><\/b>:<\/p>\n
Kushtet:\n  Grupi i Windows - sg-computers-8021x-vl100\n  Lloji i Portit NAS - Ethernet\nKufizimet:\n  Metodat e Autentikimit - Microsoft: EAP e Mbrojtur (PEAP) - Autentikim i Paenkriptuar (PAP, SPAP)\n  Lloji i Portit NAS - Ethernet\nParametrat:\n  Standard:\n   Framed-MTU 1344\n   TunnelMediumType 802 (p\u00ebrfshin t\u00eb gjitha mediat 802 plus formatin kanonik t\u00eb Ethernetit)\n   TunnelPrivateGroupId 100\n   TunnelType VLAN virtuale<\/code><\/pre>\n
\n\"Konfigurimi
\n
\nParametrat e zakonsh\u00ebm p\u00ebr portin e switch-it (v\u00ebrej se po p\u00ebrdoret tipi i autentikimit \"multi-domain\" \u2013 Data & Voice, dhe gjithashtu ka mund\u00ebsin\u00eb e autentikimit p\u00ebrmes adres\u00ebs MAC. Gjat\u00eb \"periudh\u00ebs kalimtare\" ka kuptim t\u00eb p\u00ebrdornim n\u00eb parametrat:<\/p>\n
\neventi i autentikimit d\u00ebshtoi veprimi autorizo vlan 100\neventi i autentikimit pa p\u00ebrgjigje veprimi autorizo vlan 100\n<\/code><\/pre>\n
\nid vlan-i nuk \u00ebsht\u00eb \"karantin\u00eb\", por i nj\u00ebjti, n\u00eb t\u00eb cilin kompjuteri i p\u00ebrdoruesit duhet t\u00eb hyj\u00eb, pasi \u00ebsht\u00eb autorizuar me sukses \u2013 deri sa t\u00eb sigurohemi se gjith\u00e7ka funksionon si\u00e7 duhet. K\u00ebto t\u00eb nj\u00ebjtat parametra mund t\u00eb p\u00ebrdoren edhe n\u00eb skenare t\u00eb tjera, p\u00ebr shembull, kur n\u00eb k\u00ebt\u00eb port \u00ebsht\u00eb lidhur nj\u00eb switch i pa menaxhuar dhe d\u00ebshiron q\u00eb t\u00eb gjitha pajisjet e lidhura n\u00eb t\u00eb dhe q\u00eb nuk kan\u00eb kaluar autentikimin, t\u00eb bien n\u00eb nj\u00eb vlan t\u00eb caktuar (\"karantin\u00eb\").<\/p>\n
parametrat e portit t\u00eb switch-it n\u00eb modalitetin 802.1x host-mode multi-domain<\/b><\/p>\n
default int range Gi1\/0\/39-41\nint range Gi1\/0\/39-41\nshu\ndes PC-IPhone_802.1x\nswitchport mode access\nswitchport nonegotiate\nswitchport voice vlan 55\nswitchport port-security maximum 2\neventi i autentikimit d\u00ebshtoi veprimi autorizo vlan 100\neventi i autentikimit pa p\u00ebrgjigje veprimi autorizo vlan 100\nauthentication host-mode multi-domain\nauthentication port-control auto\nauthentication violation restrict\nmab\ndot1x pae authenticator\ndot1x timeout quiet-period 15\ndot1x timeout tx-period 3\nstorm-control broadcast level pps 100\nstorm-control multicast level pps 110\nno vtp\nlldp receive\nlldp transmit\nspanning-tree portfast\nno shu\nexit<\/code><\/pre>\n
Sigurohuni q\u00eb telefoni i kompjuterit t\u00eb ket\u00eb kaluar me sukses autentikimin duke p\u00ebrdorur komand\u00ebn:<\/p>\n
sh authentication sessions int Gi1\/0\/39 det<\/code><\/pre>\n
\nTani, do t\u00eb krijojm\u00eb nj\u00eb grup (p.sh., sg-fgpp-mab<\/i> ) n\u00eb Active Directory p\u00ebr telefonat dhe do t\u00eb shtojm\u00eb nj\u00eb pajisje p\u00ebr prova (n\u00eb rastin tim kjo \u00ebsht\u00eb Grandstream GXP2160<\/i><\/b> me adres\u00ebn MAC 000b.82ba.a7b1<\/b> dhe llogarin\u00eb p\u00ebrkat\u00ebse domain 00b82baa7b1<\/b>). <\/p>\n
P\u00ebr grupin e krijuar, do t\u00eb ulim k\u00ebrkesat e politik\u00ebs p\u00ebr fjal\u00ebkalimin (duke p\u00ebrdorur Fine-Grained Password Policies<\/a><\/noindex> n\u00eb Qendr\u00ebn Administrative t\u00eb Active Directory -> domain -> System -> Password Settings Container) me parametrat e till\u00eb Password-Settings-for-MAB<\/i><\/b>:<\/p>\n
\"Konfigurimi
\n
\nn\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb do t\u00eb lejojm\u00eb q\u00eb t\u00eb p\u00ebrdoren adresat MAC t\u00eb pajisjeve si fjal\u00ebkalime. Pas k\u00ebsaj, ne mund t\u00eb krijojm\u00eb nj\u00eb politik\u00eb rrjetore p\u00ebr autentikimin 802.1x me metod\u00ebn mab, duke e quajtur at\u00eb neag-devices-8021x-voice. Parametrat jan\u00eb si m\u00eb posht\u00eb:<\/p>\n