RWL Tech Note RADIUS Authentication for ProCurve Switches

Transcription

1 RADIUS Authentication for ProCurve Switches Prepared by Richard Litchfield HP Networking Solution Architect Hewlett-Packard Australia Limited 410 Concord Road Rhodes NSW 2138 AUSTRALIA Date Prepared: 10-Aug-12

2 Document Information Document Version No: 1.02 Prepared By: Richard Litchfield Document Version Date: 10-Aug-12 Reviewed By: Review Date: Version History Ver. Ver. Date Revised By Description Filename Jun-12 Richard Litchfield Initial draft RWL TechNote RADIUS Authentication for ProCurve Switches v0.80.doc Jun-12 Richard Litchfield First Release RWL TechNote RADIUS Authentication for ProCurve Switches v1.00.doc Jul-12 Richard Litchfield Minor updates RWL TechNote RADIUS Authentication for ProCurve Switches v1.01.doc Aug-12 Richard Litchfield Logging, accounting updates RWL TechNote RADIUS Authentication for ProCurve Switches v1.02.doc Proprietary Notice Hewlett-Packard believes the information contained in this document is accurate as of its publication date. Hewlett-Packard makes no warranty of any kind with regards to this document, including, but not limited to, the implied warranties of merchantability and fitness for any particular purpose Hewlett-Packard shall not be held liable for errors contained herein and/or direct indirect, special, incidental or consequential damages in connection with furnishing, performance, and/or use of this material. All information contained within this document, which relates to Hewlett-Packard and its partners (including but not limited to its functions, policies, procedures, decisions, officers, employees, agents, clients and all financial matters) shall be kept absolutely confidential. No part of this document may be distributed to third parties unless authorised by Hewlett-Packard Australia. Copyright Hewlett-Packard Australia, 2012 HP Global Method Page 2 of 20

3 Table of Contents Proprietary Notice Introduction Purpose and Scope Sample Configurations Definitions and Abbreviations Related Documents and References Public References General Information HP Networking Specific References Solution Overview Configuration Equipment Used Windows Active Directory Microsoft NPS Installation Add Device Network Policy Switch Configuration Telnet SSH Configuration Results Testing Troubleshooting Microsoft Event Viewer Microsoft Event Viewer Configuration Microsoft Event Viewer Examples RADIUS Accounting Setup Sample Account Output Available Diagnostic Tools NTRadPing Appendix A: HP Global Method Page 3 of 20

4 1. Introduction 1.1. Purpose and Scope HP Networking is the networking division of Hewlett Packard. The extensive product line-up includes products that range from high-end core network functionality down to small SMB unmanaged switches. Products from a number of different families are brought together under the FlexNetwork banner, with the functional groupings of FlexFabric, FlexCampus and FlexBranch. This document will focus on those products from the ProCurve family, rather than those from the Comware family. The information provided in this document is designed to assist a suitably skilled practitioner to implement 802.1X RADIUS authentication on switches in the ProCurve product family Sample Configurations HP Networking has developed one or more sample configurations to show possible use cases. They are samples only, and do not take into account specific requirements or restrictions that may be present in a customer production environment Definitions and Abbreviations HP Hewlett Packard HPN HP Networking HPGM HP Global Method (Project Management) DHCP Dynamic Host Configuration Protocol NIC Network Interface Card NPS Network Policy Server (part of Microsoft Windows) OS Operating System POE Power over Ethernet RADIUS Remote Authentication Dial In User Service SSH Secure Shell VLAN Virtual Local Area Network HP Global Method Page 4 of 20

5 1.4. Related Documents and References Version/Date Author Document Name 1.5. Public References General Information HP Converged Infrastructure Manuals, updates, guides, white papers are available for all HP products Support forums for all HP Networking products HP Networking The HP Networking starting point! Specific References TechNet blog covering multiple 802.1x switch configs with MS Win2008 NPS Has some useful config info for the MS NPS server, including Cisco switch config for RADIUS authentication Installing Windows 2008 R2 NPS for RADIUS Authentication Microsoft reference material for NPS HP Global Method Page 5 of 20

6 2. Solution Overview The example solution used in this document has a single RADIUS server (NPS running on Microsoft 2008 Enterprise Server) and several ProCurve switches. 3. Configuration 3.1. Equipment Used The following components were used to build the example solution described in Section 2. Device IP Address Location/Function Windows 2008 Enterprise Server Running NPS HP ProCurve 5400zl switch Core switch (K15 firmware) 3.2. Windows Active Directory You will need to have one or more groups that will have access to the devices via RADIUS. If a suitable group does not already exist, create one in AD. Create a Group (Users New Group) Select Global Security Group. Name and describe the group appropriately. Add users as required. HP Global Method Page 6 of 20

7 3.3. Microsoft NPS In Windows 2008, Network Policy Server (NPS) replaces Internet Authentication Service (IAS) found in previous versions of Windows server operating systems Installation Install NPS by adding a server role from the Server Manager. The NPS console is available from the Server Manager. HP Global Method Page 7 of 20

8 Add Device Add your switch(es) to the RADIUS client list. Under RADIUS clients and Servers, right-click RADIUS Clients, and select New RADIUS Client. Enter the relevant details of the new device. o Shared secrets must match what is in the switch key. (See Section 3.4). o A common prefix to the name (eg switch, or ProCurve) is suggested. o This can be used if you want to use pattern matching on the name (eg switch-?) to manage specific policies. HP Global Method Page 8 of 20

9 In the screenshot below, the new device Switch-bvcore01 is shown at the bottom of the list Network Policy A network policy needs to be defined to define who can connect, and with what criteria. Under Policies, right-click Network Policies and select New. Enter the name; leave Type as unspecified. HP Global Method Page 9 of 20

10 Add the relevant conditions. In this case, a single condition is added membership of a specific Windows group. Specify access granted Configure authentication methods change to Unencrypted PAP/CHAP. HP Global Method Page 10 of 20

11 Configure additional constraints: add NAS Port Type: Virtual (VPN). Ethernet by itself didn't work, and makes no difference if it is selected. No other changes to the constraints are necessary. These settings are all default. HP Global Method Page 11 of 20

12 NPS is now configured! HP Global Method Page 12 of 20

13 3.4. Switch Configuration Each switch needs to be configured to allow users to authenticate to RADIUS when they login Telnet radius-server host key "secret" aaa authentication telnet login radius local aaa authentication telnet enable radius local SSH radius-server host key "secret" aaa authentication ssh login radius local aaa authentication ssh enable radius local Configuration Results bvcore01# show authentication Status and Counters - Authentication Information Login Attempts : 3 Respect Privilege : Disabled Login Login Login Access Task Primary Server Group Secondary Console Local None Telnet Radius radius Local Port-Access Local None Webui Local None SSH Local None Web-Auth ChapRadius radius None MAC-Auth ChapRadius radius None SNMP Local None Enable Enable Enable Access Task Primary Server Group Secondary Console Local None Telnet Radius radius Local Webui Local None SSH Local None HP Global Method Page 13 of 20

14 bvcore01# show radius host Status and Counters - RADIUS Server Information Server IP Addr : Authentication UDP Port : 1812 Accounting UDP Port : 1813 Round Trip Time : 0 Round Trip Time : 0 Pending Requests : 0 Pending Requests : 0 Retransmissions : 3 Retransmissions : 0 Timeouts : 4 Timeouts : 0 Malformed Responses : 0 Malformed Responses : 0 Bad Authenticators : 0 Bad Authenticators : 0 Unknown Types : 0 Unknown Types : 0 Packets Dropped : 0 Packets Dropped : 0 Access Requests : 26 Accounting Requests : 0 Access Challenges : 0 Accounting Responses : 0 Access Accepts : 6 Access Rejects : Testing Telnet to the switch. You now see a different prompt. Enter login details. You are now connected. If you also set RADIUS for enable access, enter those details now. HP Global Method Page 14 of 20

15 4. Troubleshooting This section has some information about RADIUS troubleshooting and diagnostic tools Microsoft Event Viewer Microsoft Event Viewer Configuration Sometimes you can get useful data from here, but it often isn't very helpful with default configuration options. The settings below should enable successful event logging. Additional material about logging events in NPS: c07eff8096eb?prof=required Disable and re-enable logging (from an Admin-level command line). auditpol /set /subcategory:"network Policy Server" /success:disable /failure:disable auditpol /set /subcategory:"network Policy Server" /success:enable /failure:enable Restarting the NPS service is also recommended. The locale should also be United States. 1. Start->Control Panel->Regional and Language Options 2. Click "Administrative" Tab, check the current applied System Locale, if it is different from "English (United States)", then click "Change system locale..." button. 3. Select "English (United States)", click OK and reboot the computer. This finally showed some useful data! (Look for event ID 6273 failed authentication.) Microsoft Event Viewer Examples HP Global Method Page 15 of 20

16 Event viewer entry showing a successful connection (viewed in the Network Policy and Access filter). HP Global Method Page 16 of 20

17 Event ID 6273 failed authentication. HP Global Method Page 17 of 20

18 4.2. RADIUS Accounting Accounting can be configured in Windows 2008 to log all relevant traffic. It can log far more data than the NPS events seen in MS Event Viewer Setup The NPS console is available from the Server Manager; select Accounting. Click Configure Accounting Choose the logging type (text file in this case) HP Global Method Page 18 of 20

19 Choose the items to log, logfile location, and whether you want logging failure to cause authentication failure. Click next and the accounting setup will complete Sample Account Output An example of the text-based log output. HP Global Method Page 19 of 20

20 4.3. Available Diagnostic Tools The URL above has links to several tools to assist with RADIUS management NTRadPing Your mileage may vary, but the most useful one appeared to be NTRadPing. 5. Appendix A: HP Global Method Page 20 of 20