How to configure fast and simple Radius on the router and on a server.
First I explame the installation / configuration on a Server.
Installation Internet Authentication Service
- First you install radius on the server.
- Click on Add/Remove Windows Components
- Click on Network Services ( Details )
- Check the box in front of “Internet Authentication Service” and click OK
- Click on Next
- Click on Finish
Active Directory Changes
- make a Security Group
- Call it Radius ( Group scope “GLOBAL” & Group type “SECURITY”)
- Click on Next
- A mailbox is not necessary and click on next
- Click on Finish
- Click right mouse button and Properties of the group Radius
- Add Members who chain access with VPN ( include the Administrator also )
Internet Authentication Service
- Go to Radius Clients
- Add New RADIUS Client
- Give a Friendly Name and their IP Address
- On Client – Vendor ( can you choose standard or Cisco )
- Shared Secret key:( for example: H0m3RS1mps0n )
- Go to Remote Access Policies
- Remove all policies which are available
- Create a New Remote Access Policy
- Click on Next
- “Use the Wizard to set up a typical policy for a common scenario”
- Policy Name: VPN
- Click on Next
- Choose VPN and click on Next
- Choose for Group and click on Add
- Check the Group ( Radius ) you want to grant access and click on OK
- Click on Next
- Check all boxes EAP / MS-CHAPv2 and MS-CHAP and click on next
- check all boxes basic / strong / strongest
- Click on Finish
- Click on the policy Properties
- Click on Edit Profile
- Check at Authentication CHAP and PAP,SPAP
- Click on Apply and OK
- If you get a warning of a Help file click NO
- Click on OK
On the Router you have to do something to
Go to the enable mode
Configuration Terminal
aaa new-model
!
!
Local login to the router to avoid login problem when you have to change something Split the local / Radius from the default group.
aaa authentication login default local
Command for the Radius group
aaa authentication login CVPN group radius
aaa authentication ppp default local
aaa authorization network default local
!
aaa session-id common
The 2 bold lines are associated with the Radius group in AAA
crypto isakmp profile CIP_CVPN_CLIENT
match identity group <Companyname>-VPN
client authentication list CVPN
isakmp authorization list CVPN
client configuration address respond
radius-server host < server ip > auth-port 1645 acct-port 1646 key < example key H0m3RS1mps0n >
Test the VPN connection if you can log on the the network.
Test the Telnet thru contact the router with the local name you entered in the router.
If you have any problems say it and i hope i’m able to help you out with the problem.
update: I’ve made a new post included pictures for the server side of the radius configuration http://glazenbakje.wordpress.com/2012/08/09/windows-server-2008-r2-radius-installation-for-cisco-devices/