{"id":42118,"date":"2019-03-18T00:00:00","date_gmt":"2019-03-17T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/nastrojka-802-1x-na-kommutatorah-cisco-s-pomoshhyu-otkazoustojchivogo-nps-windows-radius-with-ad"},"modified":"2020-02-18T13:44:55","modified_gmt":"2020-02-18T10:44:55","slug":"nastrojka-802-1x-na-kommutatorah-cisco-s-pomoshhyu-otkazoustojchivogo-nps-windows-radius-with-ad","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/nastrojka-802-1x-na-kommutatorah-cisco-s-pomoshhyu-otkazoustojchivogo-nps-windows-radius-with-ad","title":{"rendered":"Konfigurimi i 802.1X n\u00eb switch-e Cisco me NPS t\u00eb besuesh\u00ebm (Windows RADIUS me AD)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Konfigurimi
\nLe t\u00eb shqyrtojm\u00eb n\u00eb praktik\u00eb p\u00ebrdorimin e Windows Active Directory + NPS (2 server\u00eb p\u00ebr sigurimin e q\u00ebndrueshm\u00ebris\u00eb) + standardin 802.1x p\u00ebr kontrollin e aksesit dhe autentifikimin e p\u00ebrdoruesve \u2013 kompjuter\u00ebve t\u00eb domenit \u2013 pajisjeve. Mund t\u00eb njihemi me teorin\u00eb p\u00ebr standardin n\u00eb Wikipedia, n\u00eb lidhjen: IEEE 802.1X<\/a><\/noindex><\/p>\n

Duke qen\u00eb se \u201claboratori\u201d im \u00ebsht\u00eb i kufizuar p\u00ebr nga burimet, po bashkoj rolet NPS dhe kontrolluesin e domenit, por un\u00eb ju rekomandoj q\u00eb k\u00ebto sh\u00ebrbime kritike t\u00eb ndahen.<\/p>\n

Nuk di p\u00ebr m\u00ebnyra standarde p\u00ebr sinkronizimin e konfigurimeve (politikat) t\u00eb Windows NPS, prandaj do t\u00eb p\u00ebrdorim skripte PowerShell, t\u00eb cilat do t\u00eb ekzekutohen nga planifikuesi i detyrave (autori \u00ebsht\u00eb ish-kolegu im). P\u00ebr autentifikimin e kompjuter\u00ebve t\u00eb domenit dhe p\u00ebr pajisjet q\u00eb nuk e p\u00ebrkrahin 802.1x<\/b> (telefonat, printer\u00ebt etj), do t\u00eb konfigurohet politika grupore dhe do t\u00eb krijohen grupe sigurie.<\/p>\n

N\u00eb fund t\u00eb artikullit do t\u00eb flas p\u00ebr disa nuanca t\u00eb pun\u00ebs me 802.1x \u2013 si mund t\u00eb p\u00ebrdoren switch-et e pa menaxhuara, dynamic ACL etj. Do t\u00eb ndajem informacion mbi \u201cdefektet\u201d e kapura...
\n<\/a><\/noindex>
\nT\u00eb fillojm\u00eb me instalimin dhe konfigurimin e failover NPS n\u00eb Windows Server 2012R2 (n\u00eb 2016 \u00ebsht\u00eb e ngjashme): p\u00ebrmes Server Manager -> Add Roles and Features Wizard zgjedhim vet\u00ebm Network Policy Server.<\/p>\n

\"Konfigurimi
\n
\nose p\u00ebrmes PowerShell:<\/p>\n

Install-WindowsFeature NPAS -IncludeManagementTools<\/code><\/pre>\n
<\/p>\n
Nj\u00eb shpjegim i vog\u00ebl \u2013 pasi q\u00eb p\u00ebr Protected EAP (PEAP)<\/b> ju nevojitet patjet\u00ebr nj\u00eb certifikat p\u00ebr t\u00eb konfirmuar autencitetin e serverit (me t\u00eb drejtat p\u00ebrkat\u00ebse t\u00eb p\u00ebrdorimit) q\u00eb do t\u00eb jet\u00eb n\u00eb t\u00eb besuara n\u00eb kompjuter\u00ebt klient\u00eb, ndoshta ju duhet t\u00eb instaloni edhe rolin Certification Authority<\/b>. Por le ta supozojm\u00eb se CA<\/b> keni tashm\u00eb instaluar...<\/p><\/blockquote>\n
 T\u00eb b\u00ebjm\u00eb t\u00eb nj\u00ebjt\u00ebn gj\u00eb edhe n\u00eb serverin e dyt\u00eb. T\u00eb krijojm\u00eb nj\u00eb dosje p\u00ebr skriptin C:Scripts n\u00eb t\u00eb dy server\u00ebt dhe nj\u00eb dosje rrjetore n\u00eb serverin e dyt\u00eb SRV2NPS-config$<\/b><\/p>\n
N\u00eb serverin e par\u00eb do t\u00eb krijojm\u00eb nj\u00eb skript PowerShell C:ScriptsExport-NPS-config.ps1<\/i> me p\u00ebrmbajtjen e m\u00ebposhtme:<\/p>\n
Export-NpsConfiguration -Path \"SRV2NPS-config$NPS.xml\"<\/code><\/pre>\n
\nPas k\u00ebsaj do t\u00eb konfigurojm\u00eb nj\u00eb detyr\u00eb n\u00eb Task Sheduler: \"Export-NpsConfiguration<\/i>\u201d<\/p>\n
powershell -executionpolicy unrestricted -f \"C:ScriptsExport-NPS-config.ps1\"<\/code><\/pre>\n
\nEkzekuto p\u00ebr t\u00eb gjith\u00eb p\u00ebrdoruesit \u2014 Ekzekuto me t\u00eb drejta maksimale
\n\u00c7do dit\u00eb \u2014 P\u00ebrs\u00ebrit detyr\u00ebn \u00e7do 10 minuta p\u00ebr 8 or\u00eb.<\/i><\/p>\n
N\u00eb NPS-in rezerv\u00eb do t\u00eb konfiguroni importin e konfigurimeve (politikat):
\ndo t\u00eb krijoni skript PowerShell:<\/p>\n
echo Import-NpsConfiguration -Path \"c:NPS-configNPS.xml\" >> C:ScriptsImport-NPS-config.ps1<\/code><\/pre>\n
\ndhe nj\u00eb detyr\u00eb p\u00ebr ekzekutimin e tij \u00e7do 10 minuta:<\/p>\n
powershell -executionpolicy unrestricted -f \"C:ScriptsImport-NPS-config.ps1\"<\/code><\/pre>\n
\nEkzekuto p\u00ebr t\u00eb gjith\u00eb p\u00ebrdoruesit \u2014 Ekzekuto me t\u00eb drejta maksimale
\n\u00c7do dit\u00eb \u2014 P\u00ebrs\u00ebrit detyr\u00ebn \u00e7do 10 minuta p\u00ebr 8 or\u00eb.<\/i><\/p>\n
Tani, p\u00ebr t\u00eb verifikuar, do t\u00eb shtojm\u00eb n\u00eb NPS n\u00eb nj\u00ebrin nga server\u00ebt (!) disa switch-e si klient\u00eb RADIUS (IP dhe Shared Secret), dy politika lidhjeje: WIRED-Connect<\/b> (Kushti: \"Lloji i port\u00ebs NAS - Ethernet\") dhe WiFi-Enterprise<\/b> (Kushti: \"Lloji i port\u00ebs NAS - IEEE 802.11\"), si dhe politik\u00ebn rrjetit Qasje n\u00eb Pajisjet Rrjet Cisco<\/i><\/b> (Administruesit e Rrjetit):<\/p>\n
Kushtet:\nGrupet Windows - domainsg-network-admins\nKufizimet:\nMetodat e verifikimit - Verifikimi me tekst t\u00eb hapur (PAP, SPAP)\nParametrat:\nAtributet RADIUS: Standard - Service-Type - Login\nT\u00eb varura nga ofruesi - Cisco-AV-Pair - Cisco - shell:priv-lvl=15<\/code><\/pre>\n
Nga ana e switch-eve, konfigurimet e m\u00ebposhtme:<\/b><\/p>\n
aaa new-model\naaa local authentication attempts max-fail 5\n!\n!\naaa group server radius NPS\n server-private 192.168.38.151 auth-port 1812 acct-port 1813 key %shared_secret%\n server-private 192.168.10.151 auth-port 1812 acct-port 1813 key %shared_secret%\n!\naaa authentication login default group NPS local\naaa authentication dot1x default group NPS\naaa authorization console\naaa authorization exec default group NPS local if-authenticated\naaa authorization network default group NPS\n!\naaa session-id common\n!\nidentity profile default\n!\ndot1x system-auth-control\n!\n!\nline vty 0 4\n exec-timeout 5 0\n transport input ssh\n escape-character 99\nline vty 5 15\n exec-timeout 5 0\n logging synchronous\n transport input ssh\n escape-character 99<\/code><\/pre>\n
Pas konfigurimit, pas 10 minutash, t\u00eb gjith\u00eb klient\u00ebt e politikave duhet t\u00eb shfaqen gjithashtu dhe n\u00eb NPS-n\u00eb rezerv\u00eb dhe ne do t\u00eb mund t\u00eb identifikoheshim n\u00eb switch-e duke p\u00ebrdorur llogarin\u00eb Active Directory, an\u00ebtar i grupit domainsg-network-admins (t\u00eb cilin e kemi krijuar m\u00eb par\u00eb).<\/p>\n
Tani do t\u00eb kalojm\u00eb n\u00eb konfigurimin e Active Directory - do t\u00eb krijojm\u00eb politika grupore dhe fjal\u00ebkalimi, do t\u00eb krijojm\u00eb grupet e nevojshme.<\/p>\n
Politika grupore Computers-8021x-Settings<\/b><\/i>:<\/p>\n
<\/p>\n
Konfigurimi i Kompjuterit (Aktivizuar)\n   Politikat\n     Cil\u00ebsimet e Windows\n        Cil\u00ebsimet e Siguris\u00eb\n          Sh\u00ebrbimet e Sistemit\n     Wired AutoConfig (Modaliteti i Nisjes: Automatike)\nPolitikat e Rrjetit t\u00eb Wired (802.3)<\/code><\/pre>\n
<\/b>
\nNPS-802-1x<\/b><\/p>\n
Emri\tNPS-802-1x\nP\u00ebrshkrimi\t802.1x\nCil\u00ebsimet Globale\nCIL\u00cbSIMI\tVLER\u00cb\nP\u00ebrdorni sh\u00ebrbimet e rrjetit LAN t\u00eb \u00e7el\u00ebsit p\u00ebr klient\u00ebt\tAktivizuar\nKredencialet e ndara p\u00ebr verifikimin e rrjetit\tAktivizuar\nProfili i Rrjetit\nCil\u00ebsimet e Siguris\u00eb\nAktivizoni p\u00ebrdorimin e verifikimit IEEE 802.1X p\u00ebr qasje n\u00eb rrjet\tAktivizuar\nT\u00eb detyrohet p\u00ebrdorimi i verifikimit IEEE 802.1X p\u00ebr qasje n\u00eb rrjet\t\u00c7aktivizuar\nCil\u00ebsimet IEEE 802.1X\nVerifikimi i Kompjuterit\tVet\u00ebm kompjuter\nNumri maksimal i d\u00ebshtimeve t\u00eb verifikimit\t10\nNumri maksimal i mesazheve EAPOL-Start\t \nPeriudha e mbajtjes (sekonda)\t \nPeriudha e nisjes (sekonda)\t \nPeriudha e verifikimit (sekonda)\t \nPronat e Metod\u00ebs s\u00eb Verifikimit t\u00eb Rrjetit\nMetoda e verifikimit\tPEAP e Mbrojtur (PEAP)\nValidoni certifikat\u00ebn e serverit\tAktivizuar\nKonektimi me k\u00ebta server\u00eb\t \nMos e k\u00ebrkoni p\u00ebrdoruesin t\u00eb autorizoj\u00eb server\u00eb t\u00eb rinj ose autoritetet e certifikatave t\u00eb besuara\t\u00c7aktivizuar\nAktivizoni riparimin e shpejt\u00eb\tAktivizuar\nDisconnect n\u00ebse serveri nuk prezanton TLV kriptobinding\t\u00c7aktivizuar\nT\u00eb detyrohet mbrojtja e qasjes n\u00eb rrjet\t\u00c7aktivizuar\nKonfigurimi i Metod\u00ebs s\u00eb Verifikimit\nMetoda e verifikimit\tFjal\u00ebkalim i siguruar (EAP-MSCHAP v2)\nP\u00ebrdorni automatikisht emrin dhe fjal\u00ebkalimin tim t\u00eb Windows (dhe domain-in n\u00ebse ka)\tAktivizuar<\/code><\/pre>\n
\"Konfigurimi
\n
\nDo t\u00eb krijojm\u00eb nj\u00eb grup sigurie sg-computers-8021x-vl100<\/i><\/b>, ku do do shtojm\u00eb kompjuter\u00ebt q\u00eb duam t\u00eb shp\u00ebrndajm\u00eb n\u00eb VLAN 100 dhe t\u00eb konfigurojm\u00eb filtrimin p\u00ebr politik\u00ebn grupore t\u00eb krijuar m\u00eb par\u00eb n\u00eb k\u00ebt\u00eb grup:<\/p>\n
\"Konfigurimi
\n
\nT\u00eb sigurohemi q\u00eb politika t\u00eb ket\u00eb funksionuar me sukses duke hapur \u201cQendrat e Menaxhimit t\u00eb Rrjetit dhe Qasjes s\u00eb P\u00ebrbashk\u00ebt (Parametrat e Rrjetit dhe Internetit) \u2013 Ndrysho parametrat e adapatorit (Konfigurimi i parametrave t\u00eb adapatorit) \u2013 Pronat e adapatorit\u201d, ku do t\u00eb mund t\u00eb shohim sked\u00ebn \u201cVerifikimi i Autenticitetit\u201d:<\/p>\n
\"Konfigurimi
\n
\nKur t\u00eb jemi siguruar q\u00eb politika po aplikohet me sukses \u2013 mund t\u00eb kalojm\u00eb n\u00eb konfigurimin e politik\u00ebs rrjetore n\u00eb NPS dhe porteve t\u00eb p\u00ebr\u00e7uesve t\u00eb nivelit t\u00eb qasjes.<\/p>\n
Do t\u00eb krijojm\u00eb nj\u00eb politik\u00eb rrjetore neag-computers-8021x-vl100<\/i><\/b>:<\/p>\n
Kushtet:\n  Grupet Windows - sg-computers-8021x-vl100\n  Lloji i Port\u00ebs NAS - Ethernet\nKufizimet:\n  Metodat e Autenticitetit - Microsoft: Protected EAP (PEAP) - Autenticitet i pakriptuar (PAP, SPAP)\n  Lloji i Port\u00ebs NAS - Ethernet\nParametrat:\n  Standard:\n   Framed-MTU 1344\n   TunnelMediumType 802 (p\u00ebrfshin t\u00eb gjitha mediat 802 plus formati kanonike t\u00eb Ethernet)\n   TunnelPrivateGroupId  100\n   TunnelType  VLAN-t\u00eb Virtuale<\/code><\/pre>\n
\n\"Konfigurimi
\n
\nParametrat tipik\u00eb p\u00ebr portin e p\u00ebr\u00e7uesit (v\u00ebrej se p\u00ebrdoret lloji i autentifikimit \u201cmulti-domain\u201d \u2013 Data & Voice, si dhe ka mund\u00ebsin\u00eb e autentifikimit sipas adres\u00ebs MAC. Gjat\u00eb \u201cperiudh\u00ebs s\u00eb kalimit\u201d ka kuptim t\u00eb p\u00ebrdoren n\u00eb parametrat:<\/p>\n
\nauthentication event fail action authorize vlan 100\nauthentication event no-response action authorize vlan 100\n<\/code><\/pre>\n
\nvlan id nuk \u00ebsht\u00eb \u201ckarantin\u00eb\u201d, por i nj\u00ebjt\u00eb me at\u00eb ku kompjuteri i p\u00ebrdoruesit duhet t\u00eb hyj\u00eb, pasi t\u00eb autentikohet me sukses \u2013 derisa t\u00eb jemi t\u00eb sigurt se gjith\u00e7ka funksionon si\u00e7 duhet. K\u00ebto t\u00eb nj\u00ebjtat parameter mund t\u00eb p\u00ebrdoren edhe n\u00eb skenare t\u00eb tjera, p\u00ebr shembull, kur n\u00eb k\u00ebt\u00eb port lidhet nj\u00eb p\u00ebr\u00e7ues i pa menaxhuar dhe d\u00ebshiron q\u00eb t\u00eb gjitha pajisjet e lidhura n\u00eb t\u00eb, q\u00eb nuk kan\u00eb kaluar autentikimin, t\u00eb shkojn\u00eb n\u00eb nj\u00eb VLAN t\u00eb caktuar (\u201ckarantin\u00eb\u201d).<\/p>\n
Parametrat e portit t\u00eb p\u00ebr\u00e7uesit n\u00eb modin 802.1x host-mode multi-domain<\/b><\/p>\n
default int range Gi1\/0\/39-41\nint range Gi1\/0\/39-41\nshu\ndes PC-IPhone_802.1x\nswitchport mode access\nswitchport nonegotiate\nswitchport voice vlan 55\nswitchport port-security maximum 2\nauthentication event fail action authorize vlan 100\nauthentication event no-response action authorize vlan 100\nauthentication host-mode multi-domain\nauthentication port-control auto\nauthentication violation restrict\nmab\ndot1x pae authenticator\ndot1x timeout quiet-period 15\ndot1x timeout tx-period 3\nstorm-control broadcast level pps 100\nstorm-control multicast level pps 110\nno vtp\nlldp receive\nlldp transmit\nspanning-tree portfast\nno shu\nexit<\/code><\/pre>\n
T\u00eb sigurohemi q\u00eb kompjuter\u00ebt\/telefonat t\u00eb ken\u00eb kaluar me sukses autentikimin mund t\u00eb kontrollohet me komand\u00ebn:<\/p>\n
sh authentication sessions int Gi1\/0\/39 det<\/code><\/pre>\n
\nTani do t\u00eb krijojm\u00eb nj\u00eb grup (p.sh., sg-fgpp-mab<\/i> ) n\u00eb Active Directory p\u00ebr telefonat dhe do t\u00eb shtojm\u00eb nj\u00eb pajisje p\u00ebr teste (n\u00eb rastin tim, kjo \u00ebsht\u00eb Grandstream GXP2160<\/i><\/b> me adres\u00ebn MAC 000b.82ba.a7b1<\/b> dhe me llogarin\u00eb p\u00ebrkat\u00ebse domain 00b82baa7b1<\/b>). <\/p>\n
P\u00ebr grupin e krijuar do t\u00eb ulim k\u00ebrkesat e politik\u00ebs s\u00eb fjal\u00ebkalimeve (duke p\u00ebrdorur Fine-Grained Password Policies<\/a><\/noindex> n\u00ebp\u00ebrmjet Qendr\u00ebs Administrative t\u00eb Active Directory -> domain -> System -> Password Settings Container) me parametrat e till\u00eb Password-Settings-for-MAB<\/i><\/b>:<\/p>\n
\"Konfigurimi
\n
\nn\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb do t\u00eb lejojm\u00eb p\u00ebrdorimin e adres\u00ebs MAC t\u00eb pajisjeve si fjal\u00ebkalime. Pas k\u00ebsaj, mund t\u00eb krijojm\u00eb nj\u00eb politik\u00eb rrjeti p\u00ebr autentifikimin 802.1x me metod\u00ebn mab, do ta quajm\u00eb neag-devices-8021x-voice. Parametrat jan\u00eb si m\u00eb posht\u00eb:<\/p>\n