dynamic vlan assignment microsoft nps radius server

The only way to do that is 'firewall' them onto a separate VLAN and put security rules in place on the network to prevent traffic from that 'guest' VLAN from accessing the main network.To authenticate to the main network, you can setup so that only 'domain computers' can authenticate to that, which prevents users with valid user credentials from getting on. You still need 2 separate VLANs, because while NPS can specify which VLAN/WLAN that a device gets put onto, there is no mechanism to prevent a user with domain credentials on the network from access your servers.

There are multiple pieces to this puzzle. I am now using the cert with CA-1 on the end because the server itself is a root CA.Īll seems to be working now, even on Windows 7.Sorry this isn't the most informative, but I thought I would put my solution just in case anyone else has similar issues with similar knowledge with RADIUS as me.Thanks for the comments though everyone:). Radius-server host 10.58.3.Managed to resolve this, I don't really understand the certificates on RADIUS to be honest, I am going to do some digging and learning on this, because I really don't feel like I know enough.I had to go into NPS:Policies Network Policies Double Click policy name Constraints tab Auth Methods Select EAP/PEAP and click Edit I changed the 'Certificate Issues to' dropdown and tried different ones. Radius-server host 10.58.2.128 key switch priority 2 I've probably just got my VLAN routing wrong, or I'm not correctly passing VLAN traffic on the trunk ports.įor anyone else finding this via google my (mostly) working config is as follow: interface range ethernet all The ports are being correctly assigned to VLANs as a result of RADIUS authentication, however for some reason after the device gets assigned an IP address from our DHCP server, no other traffic is forwarded. I've managed to resolve this now (or mostly). Username bryan password password-hash-was-here level 15 encrypted Radius-server host 10.58.3.132 key switch priority 1 usage dot1.x Radius-server host 10.58.2.128 key switch usage dot1.x My switch configuration is as follows, can anyone spot anything I've missed? interface range ethernet all Network Comms between the switch and RADIUS servers has been proven using ping from the switch CLI. I can't seem to convince the switches to actually perform an authentication against either of the RADIUS servers however. One of the servers (Priority 0) is hosted on the network management VLAN (TekRADIUS running on Windows), and the second (Priority 1) is located on another VLAN (FreeRADIUS on Linux). I've got a two RADIUS servers, both of which I've proved to be working using radtest on Linux. I'm attempting to get Dynamic VLAN Assignment working on a number of Dell PowerConnect 3524 switches.

Dynamic vlan assignment microsoft nps radius server