Solved

Set up Windows Radius Server.

Posted on 2013-11-26
9
445 Views
Last Modified: 2013-11-29
Set up Windows Radius Server.

http://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-ias-to-support-two-factor-authentication

I am looking at the link above.
In our environment we have 2 domain controllers. I wan to set up IAS as Radius server and set  up VPN appliance as Radius client.

I want user authentication to be validated by our domain controllers DC1 and DC2.
I wonder whether by ,just authorizing RADIUS server in AD will do the job, or I need somehow to individually add DC1 and DC2 to Radius server.

Any help will be very much appreciated.

Thanks
0
Comment
Question by:jskfan
9 Comments
 
LVL 21

Assisted Solution

by:Jakob Digranes
Jakob Digranes earned 125 total points
ID: 39680017
the link provides setting up a radius Proxy to forward authentication requests to other Radius Servers - as a security measure. Most likely you wouldn't need that.

Authorizing the Radius server in AD will read users properties for both servers, so if DC1 is down - they still can authenticate using DC2
0
 
LVL 45

Accepted Solution

by:
Craig Beck earned 250 total points
ID: 39680309
Yes, you don't need to install the RADIUS service on a DC, but you can if you want to.  As long as the server where you install IAS/NPS is a member-server on the domain you want to authenticate users in you will be fine.
0
 
LVL 39

Assisted Solution

by:Aaron Tomosky
Aaron Tomosky earned 125 total points
ID: 39681074
And don't install two radius servers. Apparently there are special things you have to do if you want more than one to keep them in sync.
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 45

Assisted Solution

by:Craig Beck
Craig Beck earned 250 total points
ID: 39681660
...all you need to do is configure one server how you want it then export the AAA config using NETSH, then import into the second RADIUS server.  It's not a problem.  It's actually advisable to have more than one RADIUS for redundancy.
0
 
LVL 39

Expert Comment

by:Aaron Tomosky
ID: 39681779
I think the issue I personally experienced was the lack of 3rd party trusted certs for those servers, so it was easier to just use one radius server in my environment.

http://technet.microsoft.com/en-us/library/jj200219.aspx
0
 
LVL 45

Expert Comment

by:Craig Beck
ID: 39682081
You could have still used two RADIUS servers if you issued a cert to each IAS from your internal PKI.  I suspect you were using self-signed certs in your scenario?
0
 
LVL 39

Expert Comment

by:Aaron Tomosky
ID: 39682120
Don't want to take over this question with my details, but basically radius2 (on dc2) was not authenticating anyone. I read about cert stuff and just killed it. radius1 is my dc1 anyway and it's a small office so if dc1 goes out I've got bigger problems.
0
 
LVL 45

Expert Comment

by:Craig Beck
ID: 39682264
Agreed we're stealing the thread... :-)
0
 

Author Closing Comment

by:jskfan
ID: 39685764
Thank you Guys
0

Featured Post

Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains the steps required to use the default Photos screensaver to display branding/corporate images
Most MSPs worth their salt are already offering cybersecurity to their customers. But cybersecurity as a service is wide encompassing and can mean many things.  So where are MSPs falling in this spectrum?
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

829 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question