Required certificates The following table identifies the certificates that are required to successfully deploy each of the certificate-based authentication methods. Certificate Required for EAP-TLS and PEAP-TLS? Required for v2? Details CA certificate in the Trusted Root Certification Authorities certificate store for Local Computer and Current User. Yes. The CA certificate is enrolled automatically for domain member computers. For non-domain member computers, the certificate must be manually imported into the certificate store. Yes. The CA certificate is enrolled automatically for domain member computers. For member computers, the certificate must be manually imported into the certificate store. For v2, The CA certificate is required for mutual authentication between client and server. Client computer certificate in the certificate store of the client. Yes. Client computer certificates are required unless user certificates are distributed on smart cards. Client certificates are enrolled automatically for domain member computers. For non-domain member computers, the certificate must be manually imported or obtained by using the Web enrollment tool. No. User authentication is performed with password-based credentials, not certificates. If you deploy user certificates on smart cards, client computers do not need client certificates. Server certificate in the certificate store of the NPS server. Yes. You can configure AD CS to autoenroll server certificates to members of the RAS and IAS servers group in Active Directory Domain Services (AD DS). Yes. In addition to using AD CS for server certificates, you can purchase server certificates from other CAs that client computers already trust. The NPS server sends the server certificate to the client computer; the client computer uses the certificate to authenticate the NPS server. User certificate on a smart card. No. This certificate is required only if you choose to deploy smart cards rather than autoenrolling client computer certificates. No. User authentication is performed with password-based credentials, not certificates. For EAP-TLS and PEAP-TLS, if you do not autoenroll client computer certificates, user certificates on smart cards are required.
User, domain user User Client Authentication Autoenrollment Use a smart card or the CA Web enrollment tool If your enterprise CA is on a computer running one of the following operating systems, the RAS and IAS Servers and Workstation Authentication templates are available for use: Windows Server 2003, Enterprise Edition Windows Server 2003, Datacenter Edition Windows Server 2003, Enterprise Edition for Itanium-based Systems Windows Server 2003, Datacenter Edition for Itanium-based Systems Windows Server 2003, Enterprise x64 Edition Windows Server 2003, Datacenter x64 Edition Windows Server 2008 Windows Server 2008 R2 Windows Server 2012 Windows Server 2012 R2 Windows Server 2016 Use the following table to determine when to use these templates. Object and domain membership Certificate template Certificate purpose Preferred certificate enrollment method Alternate certificate enrollment method VPN or NPS server, domain member RAS and IAS Server Server Authentication Autoenrollment a certificate by using the Certificates Client running Windows 8.1 or Windows 10, domain member Workstation Authentication Client Authentication Autoenrollment Request a certificate by using the Certificates VPN or NPS server, non-domain member RAS and IAS Server Server Authentication CA Web enrollment tool Install from a floppy disk or portable USB drive Client running Windows 8.1 or Windows 10, member Workstation Authentication Client Authentication CA Web enrollment tool Install from a floppy disk or portable USB drive
ANI/CLI authentication ANI/CLI) authentication is the authentication of a connection attempt based on the phone number of the caller. ANI/CLI service returns the number of the caller to the receiver of the call and is provided by most standard telephone companies. ANI/CLI authentication is different from caller ID authorization. In caller ID authorization, the caller sends a valid user name and password. The caller ID that is configured for the dial-in property on the user account must match the connection attempt; otherwise, the connection attempt is rejected. With ANI/CLI authentication, a user name and password are not sent. To identify ANI/CLI-based connections and apply the appropriate connection settings, you must do the following: Enable unauthenticated access on the network access server. Enable unauthenticated access on the appropriate network policy in NPS for authentication. Create a user account in Active Directory Domain Services (AD DS) or the local Security Accounts Manager (SAM) database on the NPS server for each number for which you want to provide ANI/CLI authentication. The name of the user account must match the number that the user is dialing from. For example, if a user is dialing in from 555-0100, create a "5550100" user account. Set the following registry value to 31 on the NPS server: Identity Attribute This registry setting tells the authenticating server to use the calling number (RADIUS attribute 31, Calling-Station-ID) as the identity of the calling user. The user identity is set to the calling number only when there is no user name being supplied in the connection attempt. To always use the calling number as the user identity, set the following registry value to 1 on the authenticating server: User-Name However, if you set Override User-Name to 1 and the User Identity Attribute to 31, the authenticating server can only perform ANI/CLI-based authentication. Normal authentication by using authentication protocols such as MS-CHAP, CHAP, and EAP is disabled. Note
log files, text values (such as strings, octet strings, and IP addresses) are always surrounded by double quotes. If the double quotes appear within the string, then they are replaced with a double set of double quotes. This table shows the values for the example entries of an IAS-internal attribute. Value shown in example Attribute Data type Description Text The name of the server where the packet was received (this is an IAS-internal attribute). "IAS" ServiceName Text The name of the service that generated the or the Routing and Remote Access service (this is an IAS-internal attribute). 03/07/2008 Record-Date Time The date at the NPS or Routing and Remote Access server (this is an IAS-internal attribute). 13:04:33 Record-Time Time The time at the NPS or Routing and Remote Access server (this is an IAS-internal attribute). 1 Packet-Type The type of packet, which can be: 1 = Access-Request 2 = Access-Accept 3 = Access-Reject 4 = Accounting-Request This is an IAS-internal attribute. "client" User-Name Text The user identity, as specified by the user. Text The user name in canonical format (this is an attribute). Text The phone number dialed by the user. Text The phone number from which the call originated. Text The callback phone number. Text The framed address to be configured for the user. NAS-Identifier Text The text that identifies the network access server originating the request. Text The IP address of the network access server originating the request.