View source for Enable AD Radius

{{DISPLAYTITLE: How to setup RADIUS Server Authentication in Active Directory Domain Controller?}}

In this guide, I will demonstrate the steps to enable "Radius authentication" in an active directory domain controller. And how do I enable the "Web Auth" of WFilter NG Firewall to do authentication against active directory.


= Setup WFilter =

To authenticate from your domain controller, you need to enable "Remote Auth" in "Web Auth" or "PPPoE" or VPN modules. For example:

[[File:ngf_radius01.png|800px]]

Set "Radius Server" to domain controller IP, the "Pre-shared Key" shall be same as configured in domain controller.

A web portal will appear when visiting any http web pages, you can input domain user and password to sign in.

[[File:ngf_radius02.png|600px]]

= Setup Domain Controller =
== Add Server Roles ==
Add server role "Network Policy and Access Services", enable "Network Policy Server" and "Remote Access Service" services. 

[[File:ngf_radius03.png|800px]]

[[File:ngf_radius04.png|800px]]

== Network Policy and Access Services ==
== Radius Clients ==
New a radius client in "Radius Clients" of "Network Policy and Access Services". Set WFilter IP as the radius client IP, "Shared secret" shall be same as the "Pre-shared Key" in WFilter.

[[File:ngf_radius05.png|600px]]

[[File:ngf_radius06.png|600px]]

=== Network Policy ===
New a network policy, choose "Access Granted", enable "CHAP" authentication( the default authentication protocol of WFilter.)

[[File:ngf_radius07.png|600px]]

[[File:ngf_radius08.png|600px]]

[[File:ngf_radius09.png|600px]]

[[File:ngf_radius10.png|600px]]

Add "Domain Users" into "Conditions".

[[File:ngf_radius11.png|600px]]

[[File:ngf_radius12.png|600px]]

[[File:ngf_radius13.png|600px]]

== Routing and Remote Access ==

You also need to enable "CHAP" authentication in "Routing and Remote Access".

[[File:ngf_radius14.png|600px]]

[[File:ngf_radius15.png|600px]]

[[File:ngf_radius16.png|450px]]

= Domain Users  =

By above steps, you've enabled the CHAP authentication of WFilter in domain controller. However, "store password using reversible encryption" of domain user property is also required.

[[File:ngf_radius17.png|800px]]

You also can change group policy to enable this option for all domain users.

[[File:ngf_radius18.png|800px]]

These are all the steps to intergrate domain controller radius authentication with WFilter. In this example, domain controller is windows 2008 R2.