In this article I`ll show you step by step how to install, configure and test Radius Server for Wireless communication on Windows Server 2008.
My test configuration is setup on the Windows Server 2008 STD x64.
More info and details about RADIUS you can find here -> http://technet.microsoft.com/en-us/library/cc771455.aspx
Radius can be installed only in environment where domain is configured.
For testing purposes I created new test domain called – radius.local, and DC is named RADIUSDC
Server is on the following address – 10.154.147.10 ; 255.255.255.0
Installing CA and NPS
After I configured DC (It is desirable that DC role is installed on separate server from Radius role) I started Radius installation. If you want Radius to work, first step is to install CA (certificate authority) and configure it. We`ll first install both CA and NPS roles, and then configure them.
Server Manager | Roles | Add Roles
Next
Choose | Active Directory Certificate Services | Network Policy and Access Services | Next
Next
Choose | Network Policy Server. Optionally you can choose other services… Next
Choose | Create a self-signed certificate for SSL encryption | Next
Next
Choose | Certification Authority |Next
Choose| Enterprise |Next
Choose |Root CA |Next
Choose |Create a new private key |Next
Leave everything as it is | Next
Next
Next
Next
Next
Leave everything as it is in IIS setup, or choose additional options that you need |Next
Install
Installation…
Installation successful.
Configuring certificates
After installing Active Directory Certificate Service and Network Policy Server service we need to configure them.
I`m starting with Active Directory Certificate Services.
Start MMC | File | Add/Remove Snap-in | choose Certificates |Add
Click on Add, new window will show up |Choose Computer |Next
Choose | Local computer |Finish
Confirm new MMC Snap-in by clicking on OK
Created Snap-in opens up. Expand Certificates | Choose Personal | Right click on Certificates |All Tasks | Request New Certificate
Next
Choose your computer |Enroll
Successful | Finish
With this we finished configuring certificates for our Radius server.
Configuring RADIUS service
Choose Start | Administrative Tools | Network Policy Server
Right click on NPS and then click on Register server in Active Directory
OK
OK
Stay on NPS (local) and from the right window choose |RADIUS server for 802.1x Wireless or Wired Connections |Click on Configure 802.1x
Choose |Secure Wireless Connections | Choose Name |Next
Radius clients |Add
Choose a name for client | Enter IP address (it has to be fixed) of client that we are registering | Shared secret – Manual |Enter password for client identification |OK
Next
Choose | Microsoft Protected EAP (PEAP) |Click on Configure
Certificate Properties | Select Secured password | click on Edit
Edit number of authentication retries to desired value | OK |OK
Next
Choose groups that will be able to authenticate with RADIUS |Next
Next
Finish
After finishing configuration click on Start |Administrative Tools | Services |find NPS service and restart it.
By clicking on Radius Clients and Servers | Radius Clients I can see created client. I`m now able to authenticate with RADIUS.
That is the basic setup for RADIUS server.
You can setup RADIUS more detailed under |NPS |Policies |Connection Request Policies or Network Policies
I`m now directing my attention to Network Policies
Network Policies | Choose created WiFiAP and right click| Properties
Tab Constraints |I have chosen even less secure authentication methods for testing purposes. In production environment you should choose only most secure protocols.
Tab Settings | Encryption. For testing purposes I left all options ON, in production environment you should choose strongest encryption (MPPE 128bit)
You should go through all the settings and setup RADIUS to your preferences.
ACCESS POINT setup
I used Linksys WAP54G. Setup is more or less the same for all APs. Although I had some APs that just won`t work with Windows Server based RADIUS server, so be careful when you choose your equipment.
Access Point should have ethernet connection to the network environment where RADIUS server is located.
Access Point should be setup as follows:
Static IP, same subnet as RADIUS server
Setup as Access Point
Basic Wireless Settings |Setup SSID name
Wireless Security |Choose WPA Enterprise ( My AP is older so It doesn`t have WPA2 ) |Encryption AES | RADIUS Server: IP address of RADIUS server | RADIUS Port: it`s usually 1812 |Shared secret: you defined it while creating new client in NPS, desirable value for shared secret is for example: 984752G2N3
Key renewal: leave as it is.
Advanced Wireless Settings | Leave default settings.
With this step we configured AP for communication with RADIUS. Save your settings and reboot Access Point.
Testing
I want to connect my iPhone (iOS5) to WiFI network RadiusTest and by that connection test connection between client – AP and RADIUS server.
On my iPhone in WiFI networks I can see created WiFi RadiusTest – I`m taping on it to connect.
I need to authenticate. I entered my domain user account and password in following form : Domain\user + password | Choose Join
After few seconds I`m offered the certificate that I created earlier on RADIUS server | Accept
iPhone is successfully connected and authenticated on RADIUS server.
With this step installing, configuring and testing RADIUS server on Windows Server 2008 x64 is successfully finished.