20411B-ENU-TrainerHandbook

same set of credentials for network-access control (authenticating and authorizing access to a network) as they do to access resources within the AD DS domain.

Organizations that maintain network access, such as Internet service providers (ISPs), have the challenge

NAP Policy Server USE

When you configure NPS as a NAP policy server, NPS evaluates statements of health (SoHs) sent by NAPcapable client computers that attempt to connect to the network. NPS also acts as a RADIUS server when it is configured with NAP, performing authentication and authorization for connection requests. You can configure NAP policies and settings in NPS, including system health validators (SHVs), health policy, and remediation server groups that allow client computers to update their configuration to become compliant with your organization’s network policy.

•NPS MMC snap-in. Use the NPS MMC to USE configure a RADIUS server, a RADIUS proxy,

or a NAP technology.

•Netsh commands for NPS. The netsh commands for NPS provide a command set that is fully PROHIBITED equivalent to all configuration settings that are available through the NPS MMC snap-in. You can run

netsh commands manually at the netsh prompt or in administrator scripts.

One example of using netsh is that after you install and configure NPS, you can save the configuration by using the netsh nps show config > path\file.txt command. You then save the NPS configuration with this command each time that you make a change.

•Windows PowerShell®. You also can use Windows PowerShell Cmdlets to configure and manage a Network Policy Server.

For example, to export the NPS configuration, you can use the Export-NpsConfiguration -Path <filename> cmdlet.

Administering Windows Server® 2012 8-5

•Configure a RADIUS server for VPN connections.

•Save the configuration.

8-6 Installing, Configuring, and Troubleshooting the Network Policy Server Role

servers—because they use the RADIUS protocol to communicate with RADIUS servers such as NPS servers.

To deploy NPS as a RADIUS server, a RADIUS proxy, or a NAP policy server, you must configure RADIUS clients in NPS.

RADIUS Client Examples

Examples of network access servers include the following:

•Network access servers that provide remote access connectivity to an organization network or the Internet, such as a computer that is running the Windows Server 2012 operating system, and the Routing and Remote Access service that provides either traditional dial-up or VPN remote access services to an organization’s intranet.

•Wireless access points that provide physical-layer access to an organization’s network by using wireless-based transmission and reception technologies.

•Switches that provide physical-layer access to an organization’s network, using traditional local areaMCT network (LAN) technologies, such as the Ethernet.

•NPS-based RADIUS proxies that forward connection requests to RADIUS servers that are members of

a remote RADIUS server group that you configure on the RADIUS proxy, or other RADIUS proxies. USE

•You are a service provider who offers outsourced dial, VPN, or wireless network-access services to STUDENT multiple customers.

Your NAS sends connection requests to the NPS RADIUS proxy. Based on the user name’s realm portion in the connection request, the NPS RADIUS proxy forwards the connection request to a RADIUS server that the customer maintains, and can authenticate and authorize the connection attempt.

•You want to provide authentication and authorization for user accounts that are not members of the domain in which the NPS server is a member, or of a domain that has a two-way trust with the NPS

server’s member domain.

This includes accounts in untrusted domains, one-way trusted domains, and other forests. Instead ofUSE configuring your access servers to send their connection requests to an NPS RADIUS server, you can configure them to send their connection requests to an NPS RADIUS proxy. The NPS RADIUS proxy

uses the realm-name portion of the user name, and then forwards the request to an NPS server in the correct domain or forest. Connection attempts for user accounts in one domain or forest can be

•authenticated for NAS in another domain or forest. PROHIBITED You want to perform authentication and authorization by using a database that is not a Windows

account database.

In this case, NPS forwards connection requests that match a specified realm name to a RADIUS server, which has access to a different database of user accounts and authorization data. An example of another user database is SQL databases.

•You want to process a large number of connection requests. In this case, instead of configuring your RADIUS clients to attempt to balance their connection and accounting requests across multiple RADIUS servers, you can configure them to send their connection and accounting requests to an NPS RADIUS proxy.

The NPS RADIUS proxy dynamically balances the load of connection and accounting requests across multiple RADIUS servers, and it increases processing of large numbers of RADIUS clients and authentications each second.

attributes of the incoming RADIUS access-request message. If multiple conditions exist, NPS enforces the policy only if all of the conditions in the connection-request message and in the connection request policy match.

•Authentication is not configured. STUDENT

•Accounting is not configured to forward accounting information to a remote RADIUS server group.

•Attribute manipulation is not configured with rules that change attributes in forwarded connection requests. USE

•Forwarding Request is turned on, which means that the local NPS server authenticates and authorizes connection requests.

•Advanced attributes are not configured.

The default connection request policy uses NPS as a RADIUS server. To configure an NPS server to act as a RADIUS proxy, you also must configure a remote RADIUS server group. You can create a new remote RADIUS server group while you are creating a new connection request policy with the New Connection Request Policy Wizard. You either can delete the default connection request policy or verify that the default connection request policy is the last policy processed.

PROHIBITED

•To configure an NPS server to act as a ONLY RADIUS proxy and forward connection

requests to other NPS or RADIUS servers, you must configure a remote RADIUS server

group, and then add a new connection request policy that specifies conditions and settings that the connection requests must match. .

•You can use the New Connection Request Policy Wizard to create a new remote RADIUS server group

•when you create a new connection-request. STUDENT If you do not want the NPS server to act as a RADIUS server and process connection requests locally,

you can delete the default connection request policy.

•If you want the NPS server to act as both a RADIUS server (processes connection requests locally) and as a RADIUS proxy (forwards some connection requests to a remote RADIUS server group), then you should add a new policy, and verify that the default connection request policy is the last policy processed.

1646 for accounting requests. When you are deciding on what port numbers to use, make sure that you configure NPS and the access server to use the same port numbers. If you do not use the RADIUS default port numbers, you must configure exceptions on the firewall for the local computer to enable RADIUS traffic on the new ports.

Configuring NPS UDP Port Information

You can use the following procedure to configure the User Datagram Protocol (UDP) ports that NPS uses for RADIUS authentication and accounting traffic.

Note: To complete this procedure, you must be a member of the Domain Admins group, the Enterprise Admins group, or the Administrators group on the local computer.

.ONLY USE MCT

Other authentication methods implement the use of certificate-based credentials for the user, the client computer, the NPS server, or some combination. Certificate-based authentication methods provide strong security and are recommended over password-based authentication methods.

When you deploy NPS, you can specify the required type of authentication method for access to your network.

Lesson Objectives

After completing this lesson, you will be able to:

The authentication method you require is

determined by the configuration of the network access server, the client computer, and network policy on the NPS server. Consult your access server documentation to determine which authentication methods are supported.