Module 7 - Installing, Configuring, and Troubleshooting The Network Policy Server - Radius - Public Key Certificate

3/22/2021 Module 7: Installing, Configuring, And Troubleshooting the Network Policy Server | Radius | Public Key Certificate

Copy Link

Email
8 of 30  Search document 

Rate
Share

This document is...
 Useful (0%)
 Useful  Not useful
 Facebook
Not useful (0%) Twitter

LinkedIn
https://www.scribd.com/presentation/24312099/Module-7-Installing-Configuring-And-Troubleshooting-the-Network-Policy-Server 1/66


Copy Link

Email
Module 7: Installing
Configuring, and
Troubleshooting the
Network Policy Serve
Role Service

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Module Overview
• Installing and Configuring a Network Policy Server
• Configuring RADIUS Clients and Servers
• NPS Authentication Methods
• Monitoring and Troubleshooting a Network Policy Se

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn

Lesson1:
 Installing and Configuring a Netwo
 8 of 30  Search document
Copy Link Email
Policy Server
• What Is a Network Policy Server?
• Network Policy Server Usage Scenarios
• Demonstration: How to Install the Network Policy Se
• Tools Used for Managing a Network Policy Server
• Demonstration: Configuring General NPS Settings

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
What Is a Network Policy Server?
Windows Server 2008 Network Policy Server (NPS)
• RADIUS server
• RADIUS proxy
• Network Access Protection

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Network Policy Server Usage Scenarios
NPS is used for the following scenarios:
• Network Access Protection

• Enforcement for IPsec traffic
• Enforcement for 802.1x wired and wireless
• Enforcement for DHCP
• Enforcement for VPN
• Secure Wired and Wireless Access


Rate
Share • RADIUS 
This document is...
 Useful (0%)
 Facebook
Not useful (0%) Twitter LinkedIn

• Terminal Server Gateway
3/22/2021
Terminal Server Gateway Module 7: Installing, Configuring, And Troubleshooting the Network Policy Server | Radius | Public Key Certificate

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn

Demonstration:
  How to Install the Network
8 of 30  Search document
Copy Link Email
Policy Server
In this demonstration, you will see how to inst

Network Policy Server

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Tools Used for Managing a Network Policy Se
Tools used to manage NPS include:
• NPS MMC Console
• Netsh command line to configure all aspects of NPS, su

• NPS Server Commands
• RADIUS Client Commands
• Connection Request Policy Commands
• Remote RADIUS Server Group Commands
• Network Policy Commands
Rate
Share

• Network Access Protection Commands This document is...
 Useful (0%)
 Facebook
Not useful (0%) •Twitter Commands
Accounting
LinkedIn

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Demonstration: Configuring General NPS Set
In this demonstration, you will see how to con

general NPS settings

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Lesson 2: Configuring RADIUS Clients and Se
• What Is a RADIUS Client?
• What Is a RADIUS Proxy?
• Demonstration: Configuring a RADIUS Client
• Configuring Connection Request Processing
• What Is a Connection Request Policy?
• Demonstration: Creating a New Connection Request

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
What Is a RADIUS Client?
• NPS is a RADIUS server
• RADIUS clients are network access servers, such as:

• Wireless access points
• 802.1x authenticating switches
• VPN servers
• Dial-up servers
• RADIUS clients send

 connection requests and accountin
Rate
Share messages to RADIUS servers for authentication, author 
This document is...
 Useful (0%) and accounting  Useful  Not useful
 Facebook

LinkedIn

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
What Is a RADIUS Proxy?
A RADIUS proxy receives connection attempts from RADIU

clients and forwards them to
to the appropriate RADIUS serv
another RADIUS proxy for further
further routing
routing
A RADIUS proxy is required for:
• Service providers offering outsourced dial-up, VPN,

or wireless network access services
• Providing authentication and authorization for user

accounts that are not Active Directory members
• Performing authentication
 and authorization using
Rate
Share
a database that is not a Windows account database
This document is...

 Useful (0%)
 Facebook Twitter

Not useful (0%)• Load-balancing
LinkedIn
connection requests among
multiple RADIUS servers
multiple RADIUS servers


Copy Link Email
 8 of 30  Search document 
• Providing RADIUS for outsourced service providers
and limiting traffic types through the firewall

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Demonstration: Configuring a RADIUS Client
In this demonstration, you will see how to:

• Add a new RADIUS client to NPS
• Configure Routing and Remote Access as a RADIU

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Configuring Connection Request Processing
Configuration Description
Local vs. RADIUS • Local authentication takes place against th

authentication security account database or Active Directo
Connection policies exist on that server.
• RADIUS authentication forwards the conne
request to a RADIUS server for authenticat
a security database. RADIUS maintains a c
of all the connection policies.
RADIUS server Used where one or more RADIUS servers are
groups handling connection requests. The connectio
are

load-balanced on criteria specified during
Rate
Share creation of the RADIUS server group if there

than one RADIUS server in the group.
This document is...
 Useful (0%)
Default
 Facebook
Not useful (0%) ports
Twitter for  The ports required for
LinkedIn accounting and authe
accounting and requests being forwarded to a RADIUS serve

 
authentication
Copy Link Email
using UDP 1812/1645 and UDP 1813/1646. 
RADIUS

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
What Is a Connection Request Policy?
Connection Request policies are sets of conditions a

settings that designate which RADIUS servers perfo
authentication and authorization of connection requ
that NPS receives from RADIUS
RADIUS clients
clients
Connection Request policies include:
• Conditions, such as: • Settings, such as:

• Framed Protocol • Authentication
• Service Type • Accounting
• Tunnel Type  • Attribute Manipulat
Rate
Share

• Day and Time restrictions • Advanced settings
This document is...
 Useful (0%)
 Facebook

LinkedIn
 Custom
Copy Link

Email
Connection
8 of 30
Request policies are requiredto
 Search document
forward the request to another proxy or RADIUS se

server group for authorization and authentication, o
specify a different server for accounting informatio

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn

Demonstration:
  Creating a New Connection
Copy Link Email
Request Policy
In this demonstration, you will see how to:
• Use the Connection Request Policy wizard to create
connection request policy
• Disable or delete a connection request policy

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Lesson 3: NPS Authentication Methods
• Password-Based Authentication Methods
• Using Certificates for Authentication
• Required Certificates for NPS Authentication Methods
• Deploying Certificates for PEAP and EAP

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Password-Based Authentication Methods
Authentication methods for an NPS server include:
• MS-CHAPv2
• MS-CHAP
• CHAP
• PAP

Rate
Share

This document is...
 Useful (0%) • Unauthenticated access  Useful  Not useful
 Facebook

LinkedIn

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Using Certificates for Authentication
Certificate-based authentication in NPS:
• Certificate types:
• CA certificate: Verifies the trust path of other certificates
• Client computer certificate: Issued to the computer to pro
identity to NPS during authentication
• Server certificate: Issued to an NPS server to prove its id
to client computers during authentication
• User certificate: Issued to individuals to prove their ident
NPS servers for authentication

Rate
Share

This document is...
 Useful (0%)• Certificates can be obtained from public CA providers or
can host your own Active Directory certificate services
 Facebook
Not useful (0%) Twitter LinkedIn
Copy Link

 • To specify 8 of 30
certificate-based
Email
 Search document
authentication in a network
configure the authentication methods on the Constraint

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Required Certificates for NPS Authentication
All certificates must meet the requirements for X.509 a

work for connections that use SSL/TLS
Type Requirements
Server • Must contain a Subject attribute that is not NULL

certificates
• Must chain to a trusted-root CA
• Configured with Server Authentication purpose in EKU exten
• Configured with required algorithm of RSA with a minimum

length

Rate
Share
• Subject Alternative Name extension, if used, must contain
This document is...
 t
 Useful (0%)
• Issued by an Enterprise CA or mapped   Useful Not useful
Client
certificates
Not useful (0%)
Facebook Twitter

LinkedIn
to an account in Acti
certificates
• Must chain to a trusted-root CA

Copy Link

Email
8 of 30 
• For computer certificates, the Subject Alternative Name mu
 Search document
the FQDN
• For user certificates, the Subject Alternative Name must con

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Deploying Certificates for PEAP and EAP
• For Domain Computer and User accounts, use the auto-en

feature in Group Policy
• Nondomain member enrollment requires an administrator

to request a user or computer certificate using the
CA Web Enrollment tool
• The administrator must save the computer or user certific

floppy disk or other removable media, and manually insta
certificate on the nondomain

member computer
Rate
Share

This document is...
 Useful (0%)
 Facebook
Not useful (0%)
 can distribute user certificates on a sm
• The administrator
Twitter LinkedIn

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn

Lesson4:
 Monitoring and Troubleshooting a
Copy Link Email
Network Policy Server
• Methods Used to Monitor NPS
• Configuring Log File Properties
• Configuring SQL Server Logging
• Configuring NPS Events to Record in the Event Viewe

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Methods Used to Monitor NPS
NPS monitoring methods include:
• Event logging
• The process of logging NPS events in the System Eve
• Useful for auditing and troubleshooting connection at
• Logging user authentication and accounting reque

• Useful for connection
 analysis and billing purposes
Rate
Share

This document is...
 Useful (0%) • Can be in a text format
Not useful (0%)• Can

 Facebook Twitter be in adatabase format within a SQL instance
LinkedIn

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Configuring Log File Properties
Use the NPS console to configure logging:
1 Open NPS from the Administrative Tools menu
2 In the console tree, click Accounting
3 In the details pane, click Configure Local File Logging
4 On the Settings tab, select the information to be logged
Rate
Share
On the Log Filetab, select the log type and the frequency
5 or size attributes of the log files to be generated
This document is...

 Useful (0%)
 Facebook

LinkedIn
 Log files
 should be stored
8 of 30 on a separate partition from the
 Search document 
partition:
Copy Link Email
If RADIUS accounting fails due to a full hard disk, NPS stops

processing connection requests

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Configuring SQL Server Logging
You can use SQL to log RADIUS accounting data:

• Requires SQL to have a stored procedure
named report_event
• NPS formats accounting data as an XML docum
• Can be a local or remote SQL Server database


Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Configuring NPS Events to Record in the Even
How do I configure NPS events to be recorded in Event
• NPS is configured by default to record failed connections a

successful connections in the event log
• You can change this behavior on the General tab of the
Properties sheet for the network policy
• Common request failure events
• What information does the failure event record?
• What information does the success event record?

Rate
Share
What is Schannel logging, and how do I configure
This document is...
it?
 Useful (0%)
 Facebook
• Schannel

is a security
LinkedIn
support provider that supports a set
Internet security protocols
Internet security protocols
Copy Link
configure Schannel
• You can 8 of 30  Search document
logging in the following Regist
Email

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\
SecurityProviders\SCHANNEL\EventLogging

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Lab: Configuring and Managing Network Polic
• Exercise 1: Installing and Configuring the Network P
Server Role Service
• Exercise 2: Configuring a RADIUS Client
• Exercise 3: Configuring Certificate Auto-Enrollment
Logon information

Rate Virtual
Share machine 6421A-NYC-DC1 and 
This document is...
 Useful (0%) 6421A-NYC-SVR1  Useful  Not useful
 Facebook

LinkedIn
User name Administrator
User name Administrator
  8 of 30  Search document 
Password
Copy Link Email Pa$$w0rd
Estimated time: 60 minutes

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Lab Review
• What does a RADIUS proxy provide?
• What is a RADIUS client, and what are some exampl

RADIUS clients?

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn

Copy Link

Email

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn


Copy Link

Email
Module Review and Takeaways
• Review questions
• Best Practices
• Security Issues
• Tools

Rate
Share

This document is...
 Useful (0%)
 Facebook

LinkedIn

Copy Link

Email

This document is...

Notes Page Over-flow Slide. Do Not Print Slid

See Notes pane.

This document is...

This document is...

This document is...
Share this document

    
You might also like
6421A_10: Monitoring and Troubleshooting IPsec

健康生活園Healthy Life Garden

This document is...
Module 9: Configuring IPsec

Leticia Jones
6421A_8: Configuring Network Access Protection

Radius Public Key Certificate Proxy Server Active Directory
6421A_11: Configuring and Managing Distributed File System


This document is...
6421A 13 Backup Shadow Copies Network Load Balance Failover Cluster
Module 4: Configuring and Troubleshooting DHCP

6421A_12 Configuring and Managing Storage Technologies

6421A_14 Windows Server Update Service


This document is...
Course 6421A
globalsign-ssl-api-documentation v4.5
Guillermo X. Aiken
Module 1: Installing and Configuring Servers


This document is...
Module 2: Configuring and Troubleshooting DNS
Show more
About Support Legal Social
About Scribd Help / FAQ Terms Instagram
Press Accessibility Privacy Twitter
Our blog Purchase help Copyright Facebook

Join our team! AdChoices Pinterest
Contact us Publishers
Invite friends
Gi s
Scribd for enterprise
Get our free apps

This document is...
Books • Audiobooks • Magazines • Podcasts • Sheet Music • Documents • Snapshots • Directory
Language: English 
Copyright © 2021 Scribd Inc.


This document is...

Module 7 - Installing, Configuring, and Troubleshooting The Network Policy Server - Radius - Public Key Certificate

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Module 7 - Installing, Configuring, and Troubleshooting The Network Policy Server - Radius - Public Key Certificate

Uploaded by

Copyright:

Available Formats

3/22/2021 Module 7: Installing, Configuring, And Troubleshooting the Network Policy Server | Radius | Public Key Certificate

• Configuring RADIUS Clients and Servers

• NPS Authentication Methods

• Monitoring and Troubleshooting a Network Policy Se

• Network Policy Server Usage Scenarios

• Demonstration: How to Install the Network Policy Se

• Tools Used for Managing a Network Policy Server

• Demonstration: Configuring General NPS Settings

Windows Server 2008 Network Policy Server (NPS)

• Network Access Protection

NPS is used for the following scenarios:

• Network Access Protection

• Secure Wired and Wireless Access

In this demonstration, you will see how to inst

Tools used to manage NPS include:

• NPS MMC Console

• Netsh command line to configure all aspects of NPS, su

In this demonstration, you will see how to con

• What Is a RADIUS Proxy?

• Demonstration: Configuring a RADIUS Client

• Configuring Connection Request Processing

• What Is a Connection Request Policy?

• Demonstration: Creating a New Connection Request

• NPS is a RADIUS server

• RADIUS clients are network access servers, such as:

• RADIUS clients send

A RADIUS proxy receives connection attempts from RADIU

A RADIUS proxy is required for:

• Service providers offering outsourced dial-up, VPN,

• Providing authentication and authorization for user

multiple RADIUS servers

In this demonstration, you will see how to:

• Configure Routing and Remote Access as a RADIU

Local vs. RADIUS • Local authentication takes place against th

accounting and requests being forwarded to a RADIUS serve

Connection Request policies are sets of conditions a

Connection Request policies include:

• Conditions, such as: • Settings, such as:

forward the request to another proxy or RADIUS se

• Using Certificates for Authentication

• Required Certificates for NPS Authentication Methods

• Deploying Certificates for PEAP and EAP

Authentication methods for an NPS server include:

Certificate-based authentication in NPS:

All certificates must meet the requirements for X.509 a

Server • Must contain a Subject attribute that is not NULL

• Configured with Server Authentication purpose in EKU exten

• Configured with required algorithm of RSA with a minimum

• For Domain Computer and User accounts, use the auto-en

• Nondomain member enrollment requires an administrator

• The administrator must save the computer or user certific

• Configuring Log File Properties

• Configuring SQL Server Logging

• Configuring NPS Events to Record in the Event Viewe

NPS monitoring methods include:

• Logging user authentication and accounting reque

Not useful (0%)• Can

Use the NPS console to configure logging:

1 Open NPS from the Administrative Tools menu

2 In the console tree, click Accounting

3 In the details pane, click Configure Local File Logging

4 On the Settings tab, select the information to be logged

If RADIUS accounting fails due to a full hard disk, NPS stops