Using Windows® NPS as RADIUS ineduroamBest Practice Document

Produced by the UNINETT-led working groupon campus networking
Authors: P. Dekkers (SURFnet), T. Myren (UNINETT)
February 2015

© GÉANT Association 2015. All rights reserved.
Document No:
Version/ date:
Source language:
Original title:
Original version/ date:Contact:

GN3-NA3-T4-UFS140
V1.0 / February 2015
English“Using Windows NPS as RADIUS in eduroam”
Version 1 / 7 October 2014
campus@uninett.no

UNINETT bears responsibility for the content of this document. The work has been carried out by a UNINETT-led working
group on campus networking as part of a joint-venture project within the HE sector in Norway. Original input for thisdocument was given by Paul Dekkers from SURFnet in the Netherlands. DANTE and TERENA joined forces in October 2014
to become the GÉANT Association.
Parts of the report may be freely copied, unaltered, provided that the original source is acknowledged and copyrightpreserved.
The research leading to these results has received funding from the European Community's Seventh Framework Programme(FP7/2007-2013) under grant agreement n° 605243, relating to the project 'Multi-Gigabit European Research and Education
Network and Associated Services (GN3plus)'.

Best Practice Document:
Using Windows NPS as RADIUS in eduroamii

Table of Contents
Executive Summary

4

1

Introduction

52

Limitations

6

3

Installing NPS

7

4Server certificate for NPS

14

5

Configuring NPS

15

5.1

Defining Clients and Servers

16

5.2

Creating policies

21

5.2.1

Connection Request Policies

22

5.2.2

Network Policies.

31

6

Logging / Accounting

42

7

Troubleshooting tips

45

Appendix A

Certificates

46

A.1

Install and configure Windows server as a CA Server

46

A.2

Distribute CA certificate to clients

65

A.3

Request and install server certificate for NPS

67

References

76

Glossary

77

Best Practice Document:
Using Windows NPS as RADIUS in eduroamiii

Executive Summary
Network Policy Server (NPS) is the Microsoft Windows implementation of a Remote Access Dial-in
User Service (RADIUS) server and proxy. An increasing number of institutions in the Norwegian HE
sector have chosen to use Windows NPS as their RADIUS server connected to the eduroam
infrastructure. This document is provided to explain in some detail how Windows NPS should be
configured to best fit in with eduroam.
The examples in this document are collected from a mix of both Windows Server 2008 R2 Enterpriseand Windows Server 2012 R2. The dialogue screens differ slightly between the two versions, but theconfiguration items are very similar.
The instructions in this document assume a basic setup of an Active directory.
For the configuration of related equipment (Access Points, controllers and other RADIUS servers),
please see the References section for links to other resources. This includes both other best practice
documents and TERENA confluence pages.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

4

Introduction

1

This is a listing of tasks involved in setting up Windows NPS for eduroam as a quick-start for moreexperienced users. The topics below are covered in more detail through the rest of this document:Installing NPS as a server roleA server certificate suitable for eduroam (and NPS) is required. This could be a self-signed
certificate or signed by a public Certificate Agency (CA).

Configuring RADIUS clients (and shared secrets). Wireless Controllers (or Access points) andthe proxy-servers of your National Roaming Operator (NRO) must be defined. Details fornational proxy servers must be provided and negotiated (shared secrets) with NRO.



Configuring RADIUS servers in NPS to allow sending requests to NRO proxy-servers for visiting
eduroam users. The proxy-servers will be configured in a server group, with one server
preferred and with a secondary configured for failover.

Connection Request Policies to determine how a request is dealt with. Handle locally or proxy
to NRO. For local-accounts create a User Name condition that matches your users with theirrealms, while preventing usage of unknown / unused sub-realms or no realm in username.
o Such a Connection Request Policy can use “.institution\.no$” as a match for the User Nameattribute, matching your realm and all sub realms. Also configure this policy to override
Network Policy authentication settings and configure “Microsoft PEAP” as EAP Type (Add,then Edit to select the server certificate) and deselect all “less secure” mechanisms.
o A Connection Request Policy to forward requests to the proxy-server group could match aUser Name “@.+\..+$”. Or matching only valid TLD realms “@.+\.[a-z]{2,6}$”

Configure one or more Network Policies. These handle all requests that the Connection
Request Polices have set to be authenticated locally. These will handle the actual EAPauthentication of your users, unless overwritten in the Connection Request Policy. A policy
can be duplicated to add VLAN assignment attributes for local use, while travelling users
should not receive these attributes.

In the following sections, mainly Windows Server 2012 R2 is used in the examples; configuration in
Windows Server 2008 R2 is very similar.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

5

Limitations

2

The Network Policy Server has a few limitations:

You cannot strip attributes (for instance VLAN attributes assigned by other identity providers(IdPs), but you can explicitly set values applicable to your environment if you work with VLANs
or want to prevent invalid attributes.

You cannot add attributes in outbound requests: adding an “Operator-Name” attribute toindicate where a user gets online is thus not possible and could be set by the National Roaming
Operator instead.



NPS doesn't answer to Status-Server requests. It is best-practise for eduroam proxy servers tocheck your servers’ availability with those requests, and ideally you would do that the otherway round too.

Because of the previous limitations, inform your National Roaming Operator that you’re
working with NPS.

While the outer username (via the Connection Request Policy) can be rewritten, the innerusername (often users configure both to be the same) handled by the Network Policy cannot.
This means that your users will have to use the registered UPN (User Principal Name) whichby convention maps to the e-mail address / user-ID@domain-name.



Using anonymous outer identities is not possible. Unless “Override network policy
authentication settings” is enabled in the Connection Request Policies. This implies that
override network policies should be used, but not all consequences of this are known andsome functionality (Constraints and Settings) in Network Policies might be lost.



Logging in Event manager is rather poor (compared to FreeRADIUS) – there is not much detailshown, making the debugging of any connection problems difficult. Be prepared to install
Wireshark for this purpose.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

6

3

Installing NPS

In your Windows server open Server Manager, right click Roles and select Add Roles (2008). Or click
Add roles and features. The Add Roles Wizard will open – read the information text and accept thedefault by just clicking Next three times:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

7

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

8Select Network Policy and Access Services – then Next:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

9

Accept the defaults in the next three windows:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

10

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

11

Then Install:

And wait for the installation to finish – Close:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

12

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

134Server certificate for NPS

You need to have a Server Certificate in order to use PEAP-authentication with eduroam.
PEAP (Protected Extensible Authentication Protocol) sets up a secure tunnel (just like HTTPS does forwebsites) in order to protect the credentials, and is an important part of the mutual authentication.
Firstly the authentication server needs to prove to the user that he or she will be providing credentials
to the right authority, then the users need to prove who they are. So the RADIUS server (NPS in thiscase) will send its certificate to the client before authentication of the user takes place. The client musthave previously installed the public certificate of the Certification Authority (CA) that has issued andsigned the NPS server’s certificate. This may be distributed using e-mail, a web page such as eduroam
CAT (eduroam Configuration Assistant Tool), or a management system such as AD. The client checks
the validity of the RADIUS server’s certificate using the CA certificate. The client should also check thename of the certificate. Using a certificate from local CA, rather than certificates from a larger
commercial CA, reduces the possibility of phishing.
Please see the TERENA confluence pages on EAP Server Certificate considerations [TERENA] for good
information on this topic.
Without a certificate (self-signed or not) it’s not possible to do local authentication, but NPS can still
be used as a proxy to receive requests from Access Points, log, filter, and forward to the eduroam
infrastructure.
If you have no certificate installed (or are in doubt about your certificate), please read Appendix A‘Certificates’.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

14

5

Configuring NPS

Open the NPS console (snap-in):
2012: In Server Manager > Tools > Network Policy Server
2008: Start > Administrative Tools > Network Policy server
A Wizard is available for configuring 802.1X Wireless or wired connections, see the next picture. You
may use this for eduroam, but it does not provide all required settings (like realm/username patternmatching) so you will need to make some changes in the created policies.

In these instructions RADIUS clients and servers, Connection Request and Network policies will becreated separately i.e. not using the above Wizard.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

15

5.1

Defining Clients and Servers

Before any policy can be applied to authentication requests we need to create RADIUS clients andservers. This is to allow wireless controllers (or Access Points) and the national proxy servers (they are
all clients) to send requests to NPS and the national proxy servers to receive requests (now servers)
from NPS.
If you have several controllers or Access Points that need to be defined as clients, it is recommended
that you define a shared secret template first (it means you will re-use the same secret for all) andlater apply this to each client, in this way avoiding mistyping problems.
Defining shared secret template:

The above screen shows a template for Controllers; in addition you may create one for national proxy
servers.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

16

After creating the templates, create the Clients by right-clicking RADIUS clients and select New.
Enter a friendly name (it can later be referred to and used in pattern matching), IP address or DNS
name and a shared secret (use the template if has been created). Details for national proxies must be
agreed with your NRO.

Repeat the above until all needed clients are defined, together with at least two national proxies andone wireless controller.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

17

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

18

Next, create a server group for the proxy-servers, this will be used to send authentication requests
from non-local users via proxies to their home institutions.
Right-click Remote RADIUS Server Groups and select New; enter a name for the server group e.g.
“eduroam-proxies” then click Add:

Enter the name of the server (details from your NRO) and proceed to the Authentication/Accounting
tab for the shared secret settings:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

19

Enter the shared secret as agreed with the NRO (manually or by choosing the defined template).

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

20

For the secondary server, consider also the last tab “Load Balancing”. It is recommended not to loadbalance single EAP-sessions across multiple servers, which is what NPS will do when the LoadBalancing Priority is all set to the same level. In many situations it will work, but good practice is setting
it to a lower priority meaning it will only be used for failover.

Finish by clicking OK twice.

5.2

Creating policies

Two types of policies are used with NPS: “Connection Request Policies” and “Network Policies”. Whena request is received, it is first matched against Connection Request Policies, if the resulting matchsays “local authentication” the request is also matched against “Network Policies”. The order of
Policies is important, once conditions are met processing of Policies are stopped. You can move policy

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

21

rules up and down, and disable rules. The two policy types can do much of the same condition
matching and settings. The following details a set of policies that will work with eduroam, but is not
the only possible way to achieve the same result.

5.2.1 Connection Request Policies
The “Connection Request Policies” decide what to do with an authentication request, either by
forwarding it to a proxy-server or by authenticating locally. The decision is based on conditions set ina policy such as RADIUS attributes (e.g. User Name), RADIUS client IP-address (or friendly name) andseveral other options, when conditions are matched to the settings of that particular policy. For
eduroam we only need two Connection Request Policies, in this order:
1. Authenticate own realms “your-realm.tld” locally (use Network Policies)
2. Forward eduroam visitors to eduroam proxy-servers.

The following screens show how to create the two Connection Request Policies:
Right click Connection Request Policies – Select New.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

22

Enter a Policy name (e.g. own realms) – click Next
Click Add – to enter a condition, Select User Name and click Add: (in the example below, our realm is
win-ng.uninett.no)

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

23

Enter the username pattern to match for then press OK.
Note: See [PATTERN] for pattern matching syntax. Here we match for any username ending with “winng.uninett.no”, this includes possible sub-realms as student.win-ng.uninett.no.
Then click Next.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

24

Authenticate on this server – click Next.
Select “Override network policy authentication settings” and click Add to add PEAP as EAP, select OK.
Mark “Microsoft: Protected EAP (PEAP)” and click Edit …:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

25

Select the previously installed server certificate (above is just an example) and deselect “Enforce
Network Access Protection”. Then click OK, followed by Next twice.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

26

Check configuration:

Click Finish.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

27

Next, you need the Connection Request Policy to forward requests to the national proxy servers – Add
new policy as above with the following settings:

Note:
Pattern matching used is for any realm of the form “@something.something”, another option is to use“@.+\.[a-z]{2,6}$” which is a case-insensitive match for realms ending in “@something.tld” where tld
is between 2 to 6 letters.
In the above example, eduroam visitors are placed into VLAN 35 by setting the attributes TunnelMedium-Type, Tunnel-Type and Tunnel-Pvt-Group-ID. This can be omitted if you would like youreduroam visitors placed in the default VLAN for your eduroam SSID as configured on the wirelessBest Practice Document:
Using Windows NPS as RADIUS in eduroam

28

controller (or Access Points). It is however good practise to also include the VLAN setting here; it will
overwrite attributes returned from the IdP. (Some do even if they should not!). For placing local users
into specific VLANs we will use Network Policies (see later).

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

29

Make sure your Connection Request Policies are processed in this order:Note:
The original policy “Use Windows authentication for all users” should be deleted or disabled. Please
do not have it enabled! (This policy would catch users without a realm included in their username andcould actually work for authenticating your own users, but eduroam will not work for such users atother eduroam locations).
With just the above two policies enabled, a username without a realm will give an entry in your Event
Viewer similar to the following example (also revealing the username):

eduroam visitors should now be able to connect from your site. Check if possible as a guest at yourinstitution.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

30

5.2.2 Network Policies.
“Network Policies” are applied to requests that are to be authenticated locally. (As decided in theConnection Request Policy). In a very basic setup, only one Network Policy is needed, so first we create
this policy:

Give your policy a name such as “default for own eduroam users”:

Click Next
Then click Add, to specify the conditions for matching this request.
Here you define the User Group in your AD that are allowed to authenticate. So select UserGroups
and click Add.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

31

Click Add Groups … > Advanced > Find Now. This gives a list to choose from:Best Practice Document:
Using Windows NPS as RADIUS in eduroam

32

Here “All domain users” are selected as an example. You could establish a group just for eduroam
users.
Click OK three times to get back to Specify Condition for the new Network Policy. Click Next.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

33

Click Next.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

34

De-select all “Less secure authentication methods” and Add “Microsoft: Protected EAP (PEAP)”, just
as you did for the Connection Request Policy.
Note: PEAP (and certificate to use) was configured in Connection Request Policy to Override Network
Policies for all local realms, so this setting should never be used. However since an authentication
method must be set – we choose to select the most secure.
Click OK – then Next.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

35

Leave this as a default – click Next.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

36

This is where VLAN attributes can be set for local users. Leave as default for this policy (we should not
set VLAN for our users at remote sites!). Click Next.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

37

Check the settings and click Finish.
You should now be able to use eduroam at your site. Please check before adding more configurations.
Local eduroam users will now all be placed in the VLAN (or possibly interface group) set on yourcontroller or Access Points. Please also note that some Wireless controllers require you to enable“AAA Override” to allow VLAN (or interface group) to be set from RADIUS.
Now to place own users (or perhaps just some of them, e.g. employees) into a different VLAN. First
duplicate the above Network Policy:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

38

Then double click on the duplicate to edit:

Give the policy a new name and tick Policy enabled to enable the policy. Select the Conditions tab:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam39

In this example, conditions are set to be Domain Admins and the Client Friendly Name so that request
must be from one of the local Controllers. Next select the Settings tab:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

40Add RADIUS attributes as shown above to assign VLAN to users matching this policy. Your VLAN id ofcourse must match your infrastructure. Although at the time of writing this has not been tested;
Tunnel-Pvt-Group-ID should also be possible to use to set an Interface Group Name.
Click OK.
The order of Policies are important – right click on a policy and chose to move it up or down. Make
sure the order is as below:

You may add more Network Policies for other user groups, Machine Groups or combinations of these– if you have followed this guide you will know how to do this now.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

41

6

Logging / Accounting

To see NPS events open Event Viewer. (Or view events directly in Server Manager)
In Windows 2012: Server Manager > Tools > Event Viewer.
In Windows 2008: Start > Administrative Tools > Event Viewer.

You will find the NPS related log under Custom Views > ServerRoles > Network Policy and Access
Services.
Another source of information is accounting, by default accounting is enabled logging to a file:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam42If you would like to run queries toward your authentication and accounting information and maybe
produce some statistics from it, use the “Configure Accounting” Wizard to setup logging to the SQL
database. You may combine this with logging to file.
If you choose to keep logging to a file consider these settings, click Change Log File Properties:

You might want to check that If logging fails, discard connection requests is unchecked.
Select the Log File tab:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

43

Decide how often you want a new log file created – One month could produce a lot of data to searchthrough.
Tip:
To improve the presentation of Log File presentation, a third-party tool like IAS log viewer can be used
to track log files, produce statistics and assemble reports for users and accounting purposes. It is also
possible to define traps for alarms and filter logs.
See http://www.deepsoftware.com/iasviewer/ for a list of features, shareware license informationand downloads.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

44Troubleshooting tips

7
Install Wireshark on your NPS server to be able to see all RADIUS traffic.



Set up a Linux machine as a RADIUS client and install wpa_supplicant on it. This supplicant
contains eapol_test (a program that communicates directly with the RADIUS server) and
rad_eap_test (a script that use eapol_test). This provides a lot of information and is a
useful tool for testing and troubleshooting. Here is an example command using the script:○ ./rad_eap_test -c -H 192.168.1.10 -P 1812 -S sharedsecret -M 22:44:66:33:22:55 -uanon1234@win-ng.uninett.no -p password -e PEAP -m WPA-EAP | grep 'RADIUS message:'

Use the CAT tool to setup clients in your realm / institution – it could save a lot of time doingtroubleshooting and also contains a possibility to check your realm from a remote site. Anyquestions about this tool should be directed to your NRO.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

45

Appendix A Certificates
You need to have a server certificate in order to use PEAP-authentication with eduroam. PEAP sets up
a secure SSL tunnel (just like HTTPS does for websites) in order to protect credentials, and is an
important part of the mutual authentication. Both the user needs to prove who he or she is, and theauthentication server needs to prove to the user that he or she is providing credentials to the rightauthority.
Without a certificate (self-signed or not) it is not possible to do local authentication. NPS can still be
used as a proxy to receive requests from Access Points, log, filter, and forward to the eduroam
infrastructure.
The following is showing how to setup your own CA (on your Domain Controller), create a CA
certificate, distribute it to your clients and finally request (from your own CA) and install a server
certificate for NPS. If you already have a CA set up and a CA certificate, please jump to the relevant
section below.
(For an alternative method see [UFS112] “Recommended Security Solution for Wireless Networks” forsetting up your own CA and acquire a certificate form your own CA using Linux.)
Prerequisites – Windows Active Directory Domain Controller must be running on this server or thisserver is part of an AD domain.

A.1

Install and configure Windows server as a CA Server

Add Roles and Features Wizard:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

46

Select Active Directory Certificate Services:
And add required features (as suggested). Select Add Features.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

47

Press Next:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

48

Select Review ADCS information text from the scroll down list. Press Next:

Press Next:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

49

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

50

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

51

Then press Install:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

52

Installation – Close once Installation succeeded:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

53

In Server Manager – AD CS – it will notify that configuration is required for AD CS.
Click on More…

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

54

Press Configure Active Directory Certification Services
Read the text and press Next:

Select Role Certification Authority:
Then Next.

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

55

In Setup Type, select Enterprise CA:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

56

In CA Type, select Root CA:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

57

In Private Key, select Create a new private key:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

58

In Cryptography, accept the suggested cryptographic options:Best Practice Document:
Using Windows NPS as RADIUS in eduroam

59

In CA Name, accept the default Common name for CA (servername-CA.domain):Best Practice Document:
Using Windows NPS as RADIUS in eduroam

60

Choose a long validity period (this is when the CA expires, it is also when all eduroam clients will need
new CA cert):

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

61

In Certificate Database, accept the default database locations:Best Practice Document:
Using Windows NPS as RADIUS in eduroam

62

Review the configuration and press Configure:Best Practice Document:
Using Windows NPS as RADIUS in eduroam

63

Note:
Some clients (Win XP and above) require the certificate extension “TLS Web Server Authentication”(OID 1.3.6.1.5.5.7.3.1) to be present.
This is how to achieve this:Open MMC on your server – File > Add snap > Certificates.
You will find the CA certificate here:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

64

Right click and choose Properties – go to the Extended Validation tab, then add the required OpenID(OID):
Click OK.

A.2

Distribute CA certificate to clients

The CA root certificate must be present as Trusted Root Certification Authorities on all your eduroam
clients. The recommended way is to distribute the CA certificate using CAT.
To have the CA transferred to CAT or otherwise to clients:
Right click the CA again and choose Export:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

65

Next Select file format:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

66

Save the file as for example <institution>_CA.cer – it is then ready for distribution. In a Win AD domain
this can be done from the DC.
For clients outside the domain you need to go via CAT, distribute via email, intranet, USB memory stickor other method so that clients can install the CA Certificate.

A.3

Request and install server certificate for NPS

On the server running NPS:
1.
2.
3.
4.
5.
6.
7.
8.

Click Start, enter mmc, and press Enter.
Click File > Add/Remove Snap-in.
Choose Certificates, and click Add.
Choose Computer account, and click Next.
Select Local Computer, and click Finish.
Click OK to return to the Microsoft Management Console (MMC).
Expand the Certificates (Local Computer) and Personal folders, and click Certificates.
Right-click in the whitespace beneath the CA certificate, and choose All Tasks > Request New
Certificate.

Click Next:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

67

Select (tick) Domain Controller

Best Practice Document:
Using Windows NPS as RADIUS in eduroam68Or select (tick) Computer – in the case of AD running on a separate server (this computer is an AD
member running NPS):Best Practice Document:
Using Windows NPS as RADIUS in eduroam

69

Before Clicking Enroll – click Details and adjust properties according to the screens below:

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

70

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

71

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

72

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

73

Then Enroll – and Finish.
In MMC you should now have both the CA and the server certificate:Best Practice Document:
Using Windows NPS as RADIUS in eduroam

74

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

75

References[PATTERN]

Pattern matching syntax for Windows Network Policy Server
http://technet.microsoft.com/en-us/library/dd197583(v=ws.10).aspx[TERENA]

EAP Server Certificate considerations
https://confluence.terena.org/display/H2eduroam/EAP+Server+Certificate+considerations[UFS112]

Recommended Security System for Wireless Networks
http://www.terena.org/activities/campus-bp/pdf/gn3-na3-t4-ufs112.pdf

Other references not directly linked to this document:
Complete guide for deploying eduroam on-site or on campus
https://confluence.terena.org/display/H2eduroam/How+to+deploy+eduroam+onsite+or+on+campus
Guide to configuring eduroam using a Cisco wireless controller
http://www.terena.org/activities/campus-bp/pdf/gn3-na3-t4-ufs127.pdf
Best Practice Document on “FreeRADIUS Database Connection”
http://www.terena.org/activities/campus-bp/pdf/gn3-na3-t4-freeradius-db.pdf
FreeRADIUS integration with AD
http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HOWTO
Cisco example of setting up a Windows server with all components needed for 802.1X
authentication
http://www.cisco.com/en/US/products/ps10315/products_configuration_example09186a0080bfb1
9a.shtml

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

76

Glossary
AD
CA
EAP
EAPoL
EAP-PEAP
EAP-TLS
EAP-TTLS
IdPIEEE 802.1X
LDAP
MSCHAPNAS IDNPSNROPEAPRADIUS

Active Directory
Certificate Authority (or Certification Authority)
Extensible Authentication Protocol
Extensible Authentication Protocol over LAN
EAP - Protected Extensible Authentication Protocol
EAP - Transport Layer Security
EAP - Tunnelled Transport Layer Security
Identity Provider
Authentication mechanism for wired and wireless networks.
Lightweight Directory Access Protocol
Microsoft Challenge-Handshake Authentication Protocol
Network Access Server IDentifier
Network Policy Server
National Roaming Operator
Protected Extensible Authentication Protocol
Remote Authentication Dial-In User Service; a protocol for authentication,authorisation and accounting

Best Practice Document:
Using Windows NPS as RADIUS in eduroam

77Complete BPDs are available at http://services.geant.net/cbp/Pages/Home.aspx
campus-bp-announcements@terena.org