Windows2008下配置cisco radius server

Windows2008下配置cisco radius server
配置环境：
Windows2008
域环境
域管理员帐户登陆
基本步骤：
∙ Install the Network Policy and Access Service Role
∙ Register in Active Directory
∙ Configure the RADIUS Client Settings
∙ Configure the Access policy
∙ Configure the Cisco Device
Install the Network Policy and Access Service Role
∙ From the Initial Configuration Task Windows ->Click Add a Role
∙ Select the “Network Policy and Access Server Role”
∙ Select the Role Service “Network Policy Server” – This is all that is require to provide RADIUS authentication for our Cisco devices
Register in Active Directory
∙ Once the Role has been configured then we can continue with the NPS configuration.
You can find the NPS console under administrative tools
∙ Right Click NPS (local) and Select Register in Active Directory
Configure the RADIUS Client Settings
∙ In the RADIUS Client and Server Folder Right Click RADIUS Client and Select New RADIUS Client
∙ Enter Friendly Name and IP address of the Cisco Device
∙ Select Cisco as the RADIUS Vendor
∙ Click Generate to make a unique RADIUS key (make sure you copy this somewhere you can access it later to paste into the Cisco Device)
Configure the Access policy
∙ Right Click the Network policy and Select New
∙ Enter a Policy Name (Leave as unspecified)
∙ Enter a Windows Group Condition – Enter the name of the group from AD who should have access
∙ Enter a Client Friendly Name as a Condition – Enter the name of the RADIUS Client (we can use wild cards here so “CISCO–R?” would match multiple RADU IS Clients
∙ Enter a NAS-Port-Type as a condition –Select Virtual (VPN)
∙ Specify Access Granted in Specify Access Permissions
∙ Configure Authentication Method as PAP
∙ You can select No when asked if you want to look up the help file.
∙ There are no sett ing necessary in the “Configure Constraint”
“Configure Settings” – Here is where we setup the access level ∙ Remove Frame-Protocol PPP
∙ Remove Service-Type Framed
∙ Select Vendor Specific
∙ Now Add Cisco Vendor Attribute AV=Pair
∙ Add Attribute Shell:priv-lvl=15
You should now end up with something like this
Configure the Cisco Device
The device in the following example is a Cisco router, and only the key lines are shown
Username XXX secret XXXXXX
aaa new-model
aaa group server radius RADIUS_AUTH
server a.a.a.a auth-port 1812 acct-port 1813
server b.b.b.b auth-port 1812 acct-port 1813
aaa authentication login networkaccess group RADIUS_AUTH local
aaa authorization exec default group RADIUS_AUTH none
ip radius source-interface g0/48
radius-server host a.a.a.a auth-port 1812 acct-port 1813 key XXXXX
radius-server host b.b.b.b auth-port 1812 acct-port 1813 key XXXXX
line vty 0 15
exec-time 15 0
login authentication networkaccess
privilege level 15
01:定义一个本地用户，如果radius服务器失效，可以用来登陆
02: Switch to Access Authentication, Authorisation and Accounting new command set 03: configure a radius group “RADIUS_AUTH” to logical group RADIUS Servers
04: specify primary RADIUS server as part of “RADIUS_AUTH”
05: specify backup RADIUS server as part of “RADIUS_AUTH”
06: define “networkaccess” as a logical name to apply logon and local access to
07: allow RADIUS_AUTH users access to exec mode,计费可以不用
08:specifies the interface RADIUS uses as the source.
09: specify secret key for primary RADIUS server
10: specify secret key for backup RADIUS server
11: modify the telnet access
12: set the time out for the login session
13:assign networkaccess from 05: for Login access
14:设置登陆权限，为了可以不用输入enable密码。