Avaya Enterprise Policy Manager 5.0 User-Based Policies

Transcription

1 Avaya Enterprise Policy Manager 5.0 User-Based Policies Enterprise Policy Manager Unified Communications Management Document Status: Standard Document Number: NN Document Version: Date: June 2011 CPC: A

2 2011 Avaya Inc. All Rights Reserved. Notices While reasonable efforts have been made to ensure that the information in this document is complete and accurate at the time of printing, Avaya assumes no liability for any errors. Avaya reserves the right to make changes and corrections to the information in this document without the obligation to notify any person or organization of such changes. Documentation disclaimer Avaya shall not be responsible for any modifications, additions, or deletions to the original published version of this documentation unless such modifications, additions, or deletions were performed by Avaya. End User agree to indemnify and hold harmless Avaya, Avaya s agents, servants and employees against all claims, lawsuits, demands and judgments arising out of, or in connection with, subsequent modifications, additions or deletions to this documentation, to the extent made by End User. Link disclaimer Avaya is not responsible for the contents or reliability of any linked Web sites referenced within this site or documentation(s) provided by Avaya. Avaya is not responsible for the accuracy of any information, statement or content provided on these sites and does not necessarily endorse the products, services, or information described or offered within them. Avaya does not guarantee that these links will work all the time and has no control over the availability of the linked pages. Warranty Avaya provides a limited warranty on this product. Refer to your sales agreement to establish the terms of the limited warranty. In addition, Avaya s standard warranty language, as well as information regarding support for this product, while under warranty, is available to Avaya customers and other parties through the Avaya Support Web site: Please note that if you acquired the product from an authorized reseller, the warranty is provided to you by said reseller and not by Avaya. Licenses THE SOFTWARE LICENSE TERMS AVAILABLE ON THE AVAYA WEBSITE, ARE APPLICABLE TO ANYONE WHO DOWNLOADS, USES AND/OR INSTALLS AVAYA SOFTWARE, PURCHASED FROM AVAYA INC., ANY AVAYA AFFILIATE, OR AN AUTHORIZED AVAYA RESELLER (AS APPLICABLE) UNDER A COMMERCIAL AGREEMENT WITH AVAYA OR AN AUTHORIZED AVAYA RESELLER. UNLESS OTHERWISE AGREED TO BY AVAYA IN WRITING, AVAYA DOES NOT EXTEND THIS LICENSE IF THE SOFTWARE WAS OBTAINED FROM ANYONE OTHER THAN AVAYA, AN AVAYA AFFILIATE OR AN AVAYA AUTHORIZED RESELLER, AND AVAYA RESERVES THE RIGHT TO TAKE LEGAL ACTION AGAINST YOU AND ANYONE ELSE USING OR SELLING THE SOFTWARE WITHOUT A LICENSE. BY INSTALLING, DOWNLOADING OR USING THE SOFTWARE, OR AUTHORIZING OTHERS TO DO SO, YOU, ON BEHALF OF YOURSELF AND THE ENTITY FOR WHOM YOU ARE INSTALLING, DOWNLOADING OR USING THE SOFTWARE (HEREINAFTER REFERRED TO INTERCHANGEABLY AS "YOU" AND "END USER"), AGREE TO THESE TERMS AND CONDITIONS AND CREATE A BINDING CONTRACT BETWEEN YOU AND AVAYA INC. OR THE APPLICABLE AVAYA AFFILIATE ("AVAYA"). Copyright Except where expressly stated otherwise, no use should be made of the Documentation(s) and Product(s) provided by Avaya. All content in this documentation(s) and the product(s) provided by Avaya including the selection, arrangement and design of the content is owned either by Avaya or its licensors and is protected by copyright and other intellectual property laws including the sui generis rights relating to the protection of databases. You may not modify, copy, reproduce, republish, upload, post, transmit or distribute in any way any content, in whole or in part, including any code and software. Unauthorized reproduction, transmission, dissemination, storage, and or use without the express written consent of Avaya can be a criminal, as well as a civil offense under the applicable law. Third Party Components Certain software programs or portions thereof included in the Product may contain software distributed under third party agreements ("Third Party Components"), which may contain terms that expand or limit rights to use certain portions of the Product ("Third Party Terms"). Information regarding distributed Linux OS source code (for those Products that have distributed the Linux OS source code), and identifying the copyright holders of the Third Party Components and the Third Party Terms that apply to them is available on the Avaya Support Web site: Trademarks The trademarks, logos and service marks ("Marks") displayed in this site, the documentation(s) and product(s) provided by Avaya are the registered or unregistered Marks of Avaya, its affiliates, or other third parties. Users are not permitted to use such Marks without prior written consent from Avaya or such third party which may own the Mark. Nothing contained in this site, the documentation(s) and product(s) should be construed as granting, by implication, estoppel, or otherwise, any license or right in and to the Marks without the express written permission of Avaya or the applicable third party. Avaya is a registered trademark of Avaya Inc. All non-avaya trademarks are the property of their respective owners. Downloading documents For the most current versions of documentation, see the Avaya Support. Web site: Contact Avaya Support Avaya provides a telephone number for you to use to report problems or to ask questions about your product. The support telephone number is in the United States. For additional support telephone numbers, see the Avaya Web site:

3 Contents 3 Contents Contents New in this release Introduction Navigation Assumptions Supported device software EAP/UBP process overview Operational details Basic steps for EAP/UBP setup Configuring networking devices for EAP and RADIUS Navigation Configuring the ERS 8800/8600 for EAP and RADIUS Configuring the ERS 5500, ES 460/470, or BPS for EAP and RADIUS Configuring the RADIUS server (Funk) Navigation Adding device attributes and EPM attributes to the Steel-Belted RADIUS Server Adding users and user roles to the Steel-Belted RADIUS server Configuring the RADIUS server (Microsoft) Navigation Microsoft Windows 2000 Server setup notes Configuring the Windows 2000 Server Creating EAP users in Active Directory Setting up Internet Authentication Service Registering IAS with Active Directory Adding device attributes to IAS Adding remote access policies to IAS Setting up the Routing and Remote Access Service Configuring EPM for UBP Navigation Device objects in EPM Setting EPM preferences for UBP Creating user roles in EPM Checking a device for policy filters Setting up the Funk Odyssey Client for EAP Setting up the Windows XP client for EAP Navigation Tips and hints for setting up Windows XP User-Based Policies

4 4 Contents Enabling EAP on Windows XP Testing EAP authentication Logging on to the domain with Windows XP Checking EAP authentication success Tips and hints for EAP authentication NN

5 5 New in this release The EPM Console path to set UBP preferences has changed to Edit > Preferences > Devices > UBP. User-Based Policies

6 6 New in this release NN

7 7 Introduction This guide outlines the basic steps to set up a user-based policy (UBP) system, using Enterprise Policy Manager (EPM), a RADIUS server, and an Avaya device which supports Extensible Access Protocol (EAP). It provides sample small-scale deployment configurations using the following products: Avaya Enterprise Policy Manager Avaya Ethernet Routing Switch 5500 (ERS 5500), Avaya Ethernet Routing Switch 8800/8600 (ERS 8600), Ethernet Switch 460/470 (ES 460/470), or Business Policy Switch (BPS) Funk Steel-Belted RADIUS Server or Microsoft Internet Authentication Service (IAS) Funk Odyssey client or Microsoft Windows XP client This guide is primarily intended to demonstrate the user-based policy feature in EPM on a limited scale. Although it might serve as a good starting point for larger deployments, it is not intended as a mass-deployment guide. Navigation Assumptions on page 7 Supported device software on page 8 EAP/UBP process overview on page 8 Basic steps for EAP/UBP setup on page 9 Assumptions The material provided in this guide is intended to outline a specific application of Enterprise Policy Manager. It is assumed that the user is already familiar with the EPM product. For an introduction to EPM, see Fundamentals (NN ). Before undertaking any of the procedures in this guide, you should ensure that the networking device you are using has been created in the EPM Console and is properly configured for policy management. If the device has already been used in conjunction with EPM, it is probably already configured. Otherwise, refer to the Configuration Devices (NN ). User-Based Policies

8 8 Introduction Supported device software The following table lists the Avaya device/software platforms that support user-based policies: Device Software Ethernet Routing Switch 5500 Version 5.0. Ethernet Routing Switch 8800/8600 Version 3.7.x (and later), version 4.1 (legacy blades - not R module), version 4.0 not supported. Ethernet Switch 460/470, BoSS version and later. Business Policy Switch EAP/UBP process overview The User-Based Policies (UBP) feature in Enterprise Policy Manager works in conjunction with Extensible Access Protocol (EAP) technology (supported on certain networking devices) to enhance the security of the network. Users login to the network and are authenticated as the network connection is established. The UBP feature works as an extension to the Roles feature in EPM. In a UBP environment, role objects are linked directly to specific users (as RADIUS attributes), as opposed to being linked simply to device interfaces. The role object then links the user to specific policies that control the user s access to the network. When a user is successfully authenticated by the RADIUS server, the networking device sends an EAP session start event (which reports user roles associated with the interface on which the user initiates an EAP session) to the EPM Policy Server. The Policy Server then sends user-based policy configuration for the new user roles to the interface, based on the role attribute that was assigned to that user on the RADIUS server. Operational details The following figure illustrates the user-based policy process. 1 Edge switch (EAP access point) 2 3 RADIUS server and user data store Network access point 4 EPM Policy Server NN

9 Introduction 9 The process for the installation of user-based policies on a device port is as follows: Procedure Steps Step Action 1 The user logs in from a network access point (for example, a desktop PC) and receives an identify request (login prompt) from the EAP access point (an L2 or L3 switch). At this point, the EAP access point port is in EAP blocking mode. The user provides Username and Password credentials to the EAP access point. 2 The EAP access point initiates RADIUS authentication with the RADIUS server. The EAP access point presents the user s Username/Password credentials to the RADIUS server for authentication. 3 The RADIUS server examines its data store and verifies that the Username/ Password credentials are valid. It returns any additional attributes that may be associated with the user (such as user roles). 4 The EAP access point communicates with the EPM Policy Server to open the device port and to provision the port with user-based policies (based on user policy/role combinations). These attributes remain valid during the lifetime of that session. -End- Basic steps for EAP/UBP setup The following tasks must be completed to implement UBP functionality with EPM: Procedure Steps Step Action 1 Configure networking device (ERS 5500, ERS 8800/8600, ES 460/470, or BPS) for EAP and RADIUS. See Configuring networking devices for EAP and RADIUS on page Configure the RADIUS server: For use with ERS 5500, ERS 8800/8600, ES 460/470, or BPS networking devices. With EAP/UBP users. With user-roles. For the Funk Steel-Belted RADIUS Server, see Configuring the RADIUS server (Funk) on page 17. For Microsoft Internet Authentication Service, see Configuring the RADIUS server (Microsoft) on page Configure EPM with user roles. See Configuring EPM for UBP on page Configure the EAP client. User-Based Policies

10 10 Introduction For information on the Funk Odyssey Client, see Setting up the Funk Odyssey Client for EAP on page 53. For information on the Microsoft Windows XP client, see Setting up the Windows XP client for EAP on page 57. -End- NN

11 11 Configuring networking devices for EAP and RADIUS The network edge devices through which UBP users will connect must be configured to communicate with the RADIUS server to exchange EAP authentication information, as well as user role information. You must specify the IP address of the RADIUS server, as well as the shared secret (essentially a password that authenticates the device with the RADIUS server as an EAP access point). EAP must be enabled globally on each device, and EAP authentication settings must be set on each device port through which EAP/UBP users will connect. This chapter covers the following device configurations: Ethernet Routing Switch 8800/8600 on page 11. Ethernet Routing Switch 5500, Ethernet Switch (460 or 470), and Business Policy Switch on page 12. Navigation Configuring the ERS 8800/8600 for EAP and RADIUS on page 11 Configuring the ERS 5500, ES 460/470, or BPS for EAP and RADIUS on page 12 Configuring the ERS 8800/8600 for EAP and RADIUS The ERS 8800/8600 device must be running up-to-date software in order to be configured for EAP and RADIUS. For information on supported software versions, refer to Supported device software on page 8. Procedure Steps Step Action 1 From you system s command line, open a Telnet session and login to the device s command line. 2 Enter the following at the device s command line interface: config radius server create <IP> secret <secretkey> usedby eapol <IP> is the IP address of your Radius server. This tells the device where to find the RADIUS server, from which it will obtain EAP authentication and user role information. <secretkey> is the shared secret for RADIUS authentication. The shared secret is held in common by the RADIUS server and all EAP-enabled devices in your network. It authenticates each device with the RADIUS server as an EAP access point. When you configure your RADIUS server, you will need to use the same shared secret value as you used here. For example: config radius server create secret abc123 usedby eapol User-Based Policies

12 12 Configuring networking devices for EAP and RADIUS 3 Enter the following at the command line to enable the device to communicate through EAP, and to globally enable session management: config sys set eapol enable config sys set eapol sess-manage true When EPM learns interfaces on the device, EPM sets config ethernet <port#> eapol sess-manage-mode true on individual interfaces. 4 Use the following command line syntax to enable device ports for EAP authentication: config eth <port#> eapol admin-status auto config eth <port#> eapol reauthentication true <port#> can be a single value (1/12), a contiguous set of values (1/12-1/18), or multiple non-contiguous values (1/12,1/15,1/18) For example: config eth 1/12 eapol admin-status auto config eth 1/12 eapol reauthentication true 5 In order to keep these settings, you should save the device configuration after making changes. -End- Configuring the ERS 5500, ES 460/470, or BPS for EAP and RADIUS Your ERS 5500, ES 460/470 or BPS devices must be running up-to-date software in order to be configured for EAP and RADIUS. For information on supported software versions, refer to Supported device software on page 8. Procedure Steps Step Action 1 From you system s command line, open a Telnet session and login to the device s command console. 2 From the Main Menu, select IP Configuration/Setup. NN

13 Configuring networking devices for EAP and RADIUS 13 3 Specify the IP address of your switch in the In-Band Switch IP Address field and (optionally) specify your gateway IP address in the Default Gateway field. Return to the Main Menu. 4 From Main menu, select Console/Comm Port Configuration and specify the IP address of your RADIUS server. This tells the device where to find the RADIUS server, from which it will obtain EAP authentication and user role information. Specify the shared secret password (The RADIUS UDP port number should remain unchanged). The shared secret is held in common by the RADIUS server and all EAP-enabled devices in your network. It authenticates each device with the RADIUS server as an EAP access point. When you configure your RADIUS server, you will need to use the same shared secret value as you used here. (ES 460/470 console shown. ERS 5500 may differ slightly.) User-Based Policies

14 14 Configuring networking devices for EAP and RADIUS 5 From Main Menu, select Switch Configuration > EAPOL Security Configuration and set the following parameters: Set the EAPOL Administrative State parameter to Enabled. Set the EAPOL User Based Policies parameter to Enabled. 6 Specify a port on which the EAP process is going operate (for example, Port 1). 7 Set the Administrative Status parameter to Auto for the specified port. This means that the port authorization status relies on the EAP authentication results. Leave other values as default. For ES 460/470 and BPS users, the configuration process is complete and you can logout from the device command console. ERS 5500 users must complete the following steps: 8 From Main Menu, select Command Line Interface. At the device command line, type: en [Enter] configure [Enter] 9 You are prompted to configure the device from the network or a terminal. Select [terminal]. You are now in configuration mode. At the command line, type: qos agent ubp epm [CTRL+Z] exit 10 Logout from the device command console. If the device qos agent is set to default (by running the qos agent reset-default command) after this procedure is completed, UBP support on the device is disabled. NN

15 Configuring networking devices for EAP and RADIUS 15 You will need to re-enable UBP by re-running the qos agent ubp epm command. You will then need to resend SNMP informs to the device by disabling/re-enabling it for policy management through the EPM Console. -End- User-Based Policies

16 16 Configuring networking devices for EAP and RADIUS NN

17 17 Configuring the RADIUS server (Funk) The Funk Steel-Belted RADIUS Server must be configured with EAP/UBP users, device attributes, and EPM attributes. You can perform all of these tasks through the Funk Steel-Belted RADIUS Administrator window. You will need version 4.5 (or later) of the Funk RADIUS Server, Enterprise Edition, with licensing for the EAP Expansion Module. The procedural information included in this chapter refer to Funk Steel-Belted RADIUS Server version 4.5. If you are working with a later version of the Funk software, the steps may differ slightly. Navigation Adding device attributes and EPM attributes to the Steel-Belted RADIUS Server on page 17 Adding users and user roles to the Steel-Belted RADIUS server on page 20 Adding device attributes and EPM attributes to the Steel-Belted RADIUS Server In order for EPM and your networking devices to work in conjunction with the Funk Steel-Belted RADIUS Server, you must add their attributes to the RADIUS server. Any changes to the server files requires a restart of the Funk Steel-Belted RADIUS Server. Procedure Steps Step Action 1 On the system on which the Funk Steel-Belted RADIUS Server is installed, navigate to the Radius\Service directory and add dictionary files for your networking devices (es_bps.dct, ers8600.dct, ers5500.dct). (These files are supplied on the EPM install CD in the \Auxilliary\Funk Radius\ directory. If you are working with an electronic EPM install package, you will need to decompress/unzip or extract the file set and look for the \Auxilliary\Funk Radius\ directory in the install file set.) The files you are adding in this step contain references to epm.dct and radius.dct files. By adding the device dictionary files to the Radius\Service directory, you are associating the dictionary files for EPM and the Steel-Belted RADIUS Server with the device dictionary files. 2 Copy the epm.dct file (supplied on the EPM install CD) to the same directory (Radius\Service). 3 Edit the dictiona.dcm file (also found in the Radius\Service directory), adding the names of the dictionary files that you created in the previous steps. For example: User-Based Policies

18 18 Configuring the RADIUS In this step, you are adding the attributes for the networking device(s) and the EPM attributes to the Steel-Belted RADIUS Server. 4 Edit the vendor.ini file (also found in the Radius\Service directory) and add the following lines: (These lines specify the dictionary file that you added for the devices in step 1.) vendor-product = Nortel ERS 8600 dictionary = ers8600 ignore-ports = no port-number-usage = per-port-type help-id = 0 vendor-product = Nortel ES (460, 470, or BPS) dictionary = es_bps ignore-ports = no port-number-usage = per-port-type help-id = 0 vendor-product = Nortel ERS 5500 dictionary = ers5500 ignore-ports = no port-number-usage = per-port-type help-id = 0 5 Edit the eap.ini file, ensuring that the following lines do NOT have comment characters (;) in front of them: [Native-User] EAP-Only = 0 First-Handle-Via-Auto-EAP = 0 EAP-Type = MD5-Challenge Some users may need to edit other sections of this file according to their specific RADIUS authentication needs. 6 Stop and restart the Steel-Belted RADIUS Server. (Windows users can use the Windows Services dialog box to stop and restart the RADIUS server.) 7 Launch the Steel-Belted RADIUS Administrator Console and connect locally. NN

19 Configuring the RADIUS server (Funk) 19 8 Click the RAS Clients option button. 9 Click the Add button. 10 In the Add New RAS Client dialog box, type a name for the client (for example, ERS 8600, ERS 5500 or ES 460/470/BPS) and then click OK. You are returned to the Administrator console. 11 Type the IP address of the client device in the IP Address field. 12 From the Make/Model drop-down list, choose Nortel ERS 8600, ERS 5500, or Nortel ES (460, 470, or BPS). These entries in the list were created when you modified the vendor.ini file earlier. 13 Click the Edit Authentication Shared Secret button. User-Based Policies

20 20 Configuring the RADIUS server (Funk) 14 Type the shared secret for RADIUS authentication (eg. abc123) and click the Set button. You MUST use the same shared secret that you specified when you configured the networking device for RADIUS (refer to Configuring networking devices for EAP and RADIUS on page 11). You are returned to the Administrator console. 15 Click the Save button. Adding users and user roles to the Steel-Belted RADIUS server The RADIUS server maintains a list of network users (clients) who can be authenticated through EAP. Each user must have a unique username and password. In order for the users to receive user-based policies from EPM upon authentication, each user must be associated with a user role. You can create EAP/UBP users and user roles through the Funk Steel-Belted RADIUS Administrator window. Before you begin defining users, you should determine what user role names will be employed in your EAP/UBP-enabled network. A single user role can be associated with several users. A set of user roles should be defined so that they can define the purpose of each user and what kind of network resources they will require. For example: student professor manager accountant researcher A corresponding set of roles (with exactly the same role names) must be created in EPM in order to link the user roles with user-based policies. For more information, refer to Creating user roles in EPM on page 49. Procedure Steps Step Action 1 In Windows, click Start > Programs > Steel-Belted RADIUS > Steel-Belted RADIUS Enterprise Edition Administrator. NN

21 Configuring the RADIUS server (Funk) 21 2 In the Steel-Belted RADIUS window, enable the Local option button and then click the Connect button. 3 Click the Users option button on the left hand side of the window. User-Based Policies

22 22 Configuring the RADIUS server (Funk) 4 Click the Add button. 5 In the Add New User dialog box, click the Native tab. 6 Type a username (for example, eapuser) and then click OK This will serve as the login name of one of the EAP/UBP users. 7 Click the Set Password button. 8 In the Enter User Password dialog box, type a password for the user in the Enter Password field, and then click the Set button. This will serve as the password that accompanies the login name you defined above. 9 On the Return List Attributes tab, click the Ins button. NN

23 Configuring the RADIUS server (Funk) In the Add New Attribute dialog box, choose NtnStringNameValPair from the Available Attributes list. This attribute was added to the list when you referenced the epm.dct file in the dictiona.dcm file. 11 In the String field, type a user role name, using the following syntax: UROL<rolename> For example, if the role name was student, you would type UROLstudent. In this step, you are defining a user role that will be associated with the EAP/ UBP user when they are authenticated by the RADIUS server. You will need to create a role in EPM with EXACTLY the same name, but WITHOUT the UROL prefix (for example, UROLstudent will have a role name of student in EPM). This role will be used to link the user to specific user-based policies in EPM. 12 Click the Add button, and then click the Close button. 13 In the Steel-Belted RADIUS Server main window, click Save. The new username/password/user role combination is added to the RADIUS server s list of authenticated users. You may want to define additional EAP users at this time. You must define a unique password for each user, but it is likely that several users will be associated with the same user role. User-Based Policies

24 24 Configuring the RADIUS server (Funk) NN

25 25 Configuring the RADIUS server (Microsoft) The Microsoft Internet Authentication Server (IAS) is the Microsoft RADIUS server product. It must be configured with EAP/UBP users, device attributes, and EPM attributes. In addition to IAS, you must configure other components of the Windows 2000 Server platform. (The Windows 2003 Server platform is also supported, although the configuration procedure may differ slightly.) Navigation Microsoft Windows 2000 Server setup notes on page 25 Configuring the Windows 2000 Server on page 26 Creating EAP users in Active Directory on page 27 Setting up Internet Authentication Service on page 32 Setting up the Routing and Remote Access Service on page 43 Microsoft Windows 2000 Server setup notes When installing and setting up Microsoft Windows 2000 Server, be sure to correctly choose the following information: Native or Mixed Mode server operation. Choose Native Mode if you are only supporting Windows 2000 and XP workstation users. Mixed Mode enables support for pre-windows 2000 workstation users. Workgroup, Domains, and Active Directory: Do not choose options to install the Windows 2000 Server as a Workgroup server but as a Domain Controller. This means that the server will also need to run DNS, so a server and domain name must be specified. (Note: the Server Name will be generated automatically if you do not specify a name.) To avoid confusion, use the password of password for administrators and users for testing purposes. Enable DHCP and set a scope for clients when they login. Optionally, enter the Windows 2000 Server IP address as the DNS server and IP gateway address. Optionally, set WINS server info (not used in this test). Active Directory users being authenticated by Internet Authentication Service need to be members of the RAS and IAS servers Security Group. Order of configuration setup: IAS, RAS, followed by Active Directory. IAS must be registered with Active Directory to enable authentication of EAP, VPN, and RAS users to their Active Directory accounts. If you install Active Directory on the same system as you are running iplanet or Sun ONE Directory Server, you must ensure that iplanet/sun ONE is not running on port 389. Otherwise, a port conflict will occur. User-Based Policies

26 26 Configuring the RADIUS server (Microsoft) Configuring the Windows 2000 Server Once the Windows 2000 Server software has been successfully loaded and you have set up the administrator, entered a password and booted up the Windows 2000 Server, you need to configure and set up services you want to run on the server. The Configure Your Server screen can be used to run various install wizards for Active Directory, DHCP, DNS, IAS, and RAS. Alternatively, you can perform each of these tasks manually at any time by running Control Panel > Administrative tools and then choosing the appropriate service icon. Procedure Steps Step Action 1 From the Start menu, click Administrative Tools > Configure Your Server. At the first window, enable the This is the only server in my network option for the purposes of demonstrating EAP. 2 Enter the name of the domain in which this server will exist. 3 Once the server domain setup has been completed, you will be prompted to complete setting up other services by choosing an item in the left menu of the screen. NN

27 Configuring the RADIUS server (Microsoft) 27 Alternatively, you can close the window and individually set up various services under Control Panel > Administrative Tools. -End- Creating EAP users in Active Directory Active Directory maintains a list of network users (clients) who can be authenticated through EAP. Each user must have a unique username and password. In order for the users to receive user-based policies from EPM upon authentication, each user must be associated with a remote access policy. You can create EAP/UBP users through the Active Directory Users and Computers window. You can also organize your users into functional groups. You create remote access policies through IAS (for more information, refer to Adding remote access policies to IAS on page 35). Before you begin defining users, you should determine what remote access policy names will be employed in your EAP/UBP-enabled network. A single remote access policy can be associated with a group of users. A set of remote access policies should be defined so that they can define the purpose of each group of users and what kind of network resources they will require. For example: student professor manager accountant researcher A corresponding set of roles (with exactly the same names) must be created in EPM in order to link the remote access policies with user-based policies in EPM. For more information, refer to Creating user roles in EPM on page 49. In this procedure, you will create a group called Students, and then add an EAP user to that group. Later in this chapter, you will create a remote access policy that specifies all users in the Students group for authentication. Procedure Steps Step Action User-Based Policies

28 28 Configuring the RADIUS server (Microsoft) 1 Under Administrative Tools, select Active Directory Users and Computers to add a new user account to Active Directory. Remote access policies are created to match the username and then provide access privileges. 2 Right-click on the Users folder and choose New > Group from the menu. In the New Object - Group dialog box, type a group name (for example, Students), and ensure that the Global and Security option buttons are enabled. Click OK. 3 Right-click on the Users folder and choose New > User from the menu. In the New Object - User dialog box, type a username (for example, eapuser) in the User Logon Name field. This will serve as the login name of the EAP/UBP user. For informational purposes, type the full name of the user in the First Name and Last Name fields. Then click Next and specify a password for the user in the NN

29 Configuring the RADIUS server (Microsoft) 29 Password field. This will serve as the password that accompanies the login name you defined above. Click Finish to add the user to the directory and return to the Active Directory Users and Computers window. 4 After the user has been added to Active Directory, some parameters will need to be changed for the user. Double-click on the new user in the Users list to view the user s properties. In the Properties dialog box, click the Member Of tab and verify that the user is a member of Domain Users. Now click the Add button and select the Students group (created earlier) from the Select Groups dialog User-Based Policies

30 30 Configuring the RADIUS server (Microsoft) box. The Students group is added to the Member Of list in the Properties dialog box. 5 Click the Account tab and enable the check boxes for Password Never Expires and Store Password Using Reversible Encryption. The latter must be enabled for correct operation using MD5 authentication with EAP. NN

31 Configuring the RADIUS server (Microsoft) 31 6 Click the Dial-in tab and enable the Control Access Through Remote Access Policy option button. Leave all other tabs in the Properties dialog box with the default settings. Click OK. 7 In the Active Directory User list, right-click on the icon for the Students group and choose Properties from the menu. In the Students Properties dialog box, verify User-Based Policies

32 32 Configuring the RADIUS server (Microsoft) that the Members tab displays the newly-created user, and that the Member Of tab displays RAS and IAS Servers (you may have to add the latter). Windows 2000 Server platforms can be set up with different Group Scopes to allow separate groups for RAS and IAS users (which includes EAP users) to segregate them from standard user accounts (whose users may not be able to use EAP). This configuration does not use the Group Scope feature. -End- Setting up Internet Authentication Service When setting up Internet Authentication Service (IAS), you must complete the following tasks: Registering IAS with Active Directory on page 33) Adding device attributes to IAS on page 33) Adding remote access policies to IAS on page 35) NN

33 Configuring the RADIUS server (Microsoft) 33 To access IAS, click Start > Settings > Control Panel, and then double-click the Administrative Tools icon. In the Administrative Tools window, double-click the Internet Authentication Service configuration icon. Registering IAS with Active Directory In the Internet Authentication Service window, right click on the Internet Authentication Service (Local) icon and choose Register Service in Active Directory from the menu. Click OK to register IAS. Adding device attributes to IAS In order for your networking devices to work in conjunction with IAS as RADIUS clients, you must add their attributes to IAS. A RADIUS client is the network edge device through which users will be authenticated through EAP. Procedure Steps Step Action 1 In the Internet Authentication Service window, right-click the Clients folder and choose New Client from the menu. User-Based Policies

34 34 Configuring the RADIUS server (Microsoft) 2 Enter the friendly name for the edge device. Use a name to identify the particular device this entry refers to. 3 Enter the IP address of the device. From the Client-Vendor drop-down list, choose the RADIUS Standard option. Enter the shared secret password for the device This is the same shared secret password used when configuring the device for EAP. -End- NN

35 Configuring the RADIUS server (Microsoft) 35 Adding remote access policies to IAS Remote access policies in IAS are equivalent to user roles. When you define a remote access policy, you specify a group of EAP/UBP users with which it will be associated. You also specify a role name that corresponds exactly to a user role that you created in EPM. Procedure Steps Step Action 1 On the system on which Microsoft IAS is installed, launch the Microsoft Management Console. 2 Expand the Internet Authentication Service root object. 3 Right-click Remote Access Policies, and choose New Remote Access Policy from the menu. The Add Remote Access Policy wizard launches. 4 In the Policy Name window, type a name for the remote access policy (for example, you could name the remote access policy students, since it will be User-Based Policies

36 36 Configuring the RADIUS server (Microsoft) used to authenticate the Students user group) and click Next. In the Conditions window, click the Add button. NN

37 Configuring the RADIUS server (Microsoft) 37 5 In the Select Attribute dialog box, click the Windows Groups item and click the Add button. In the Groups dialog box, click the Add button. 6 In the Select Groups dialog box, click the Students group in the list, click the Add button, and then click OK. In the Groups dialog box, click OK. In this step, the Students group is specified as the matching condition to allow authentication User-Based Policies

38 38 Configuring the RADIUS server (Microsoft) through this remote access policy. All domain users in the Students group will be authenticated. 7 You are returned to the Conditions window of the Add Remote Access Policy wizard. Click Next. NN

39 Configuring the RADIUS server (Microsoft) 39 8 In the Permissions window, enable the Grant Remote Access Permission option and then click Next. In the User Profile window, click Finish. The new remote access policy is added to the list on the right-hand pane of the Microsoft Management Console. 9 Right-click the new remote access policy and choose Properties from the menu. In the Properties dialog box, click Edit Profile. In the Edit Dial-In Profile dialog User-Based Policies

40 40 Configuring the RADIUS server (Microsoft) box, click the Authentication tab and then enable the Extensible Authentication Protocol check box. From the drop-down list, choose the MD5 Challenge option. 10 Click the Advanced tab, remove the two default parameters from the list, and then click the Add button. In the Add Attributes dialog box, choose the NN

41 Configuring the RADIUS server (Microsoft) 41 Vendor-Specific item from the RADIUS Attributes list, and then click the Add button. 11 In the Multivalued Attribute Information dialog box, click the Add button. In the Vendor-Specific Attribute Information dialog box, enable the Enter Vendor Code User-Based Policies

42 42 Configuring the RADIUS server (Microsoft) option button and type the number 562 in the field, enable the Yes It Conforms option button, and then click the Configure Attribute button. NN

43 Configuring the RADIUS server (Microsoft) In the Configure VSA dialog box, type the number 110 in the Vendor-assigned Attribute Number field; type string in the Attribute Format field; and type UROL<remote_access_policy_name> in the Attribute Value field. For example, if the remote access policy name was students, you would type UROLstudents in the Attribute Value field. In this step, you are defining a remote access policy that will be associated with the EAP/UBP user when they are authenticated by the RADIUS server. You will need to create a role in EPM with EXACTLY the same name, but WITHOUT the UROL prefix (for example, UROLengineering will have a role name of engineering in EPM). This role will be used to link the user to specific user-based policies in EPM. 13 Click OK in the Configure VSA dialog box. Click OK in the Vendor-Specific Attribute Information dialog box. Click OK in the Multivalued Attribute Information dialog box. Click the Close button in the Add Attributes dialog box. You are returned to the Edit Dial-In Profile dialog box. The new Parameter should appear in the Parameters list. 14 In the Edit Dial-In Profile dialog box, click OK. 15 In the Properties dialog box, click OK. -End- Setting up the Routing and Remote Access Service The Routing and Remote Access Service provides IP routing functions on the server, and connection support for remote access users. User-Based Policies

44 44 Configuring the RADIUS server (Microsoft) Procedure Steps Step Action 1 To access RAS, click Start > Settings > Control Panel, and then double-click the Administrative Tools icon. In the Administrative Tools window, double-click the Routing and Remote Access Service configuration icon. The RAS server must be enabled and running. You can start and stop the RRA Service by right-clicking its icon (in the above example, NET-AGAST2000 ), selecting All Tasks, and then Start, Stop, or Restart. In the above case, the RRA Service is running locally on the Windows 2000 Server. To configure RAS, follow these steps: 2 In the Routing and Remote Access window, right-click the service icon (in the above example, NET-AGAST2000 ) and choose Configure and Enable Routing and Remote Access from the menu. 3 Set the operation mode for the server by right-clicking the service icon and choosing Properties from the menu. On the General tab of the Properties dialog NN

45 Configuring the RADIUS server (Microsoft) 45 box, enable the Remote Access Server check box. Click the Security tab to view and configure RADIUS Authentication and RADIUS Accounting. 4 Click the Authentication Methods button to choose the authentication methods supported globally by the RADIUS server. 5 Click OK in the Authentication Methods dialog box, and then click OK in the Properties dialog box. -End- User-Based Policies

46 46 Configuring the RADIUS server (Microsoft) NN

47 47 Configuring EPM for UBP In order for EPM to send user-based policies to a network device, you must create a set of user roles in EPM that correspond to the user roles in the RADIUS server. You must also set specific system preferences in EPM. Navigation Device objects in EPM on page 47 Setting EPM preferences for UBP on page 48 Creating user roles in EPM on page 49 Checking a device for policy filters on page 50 Device objects in EPM This manual assumes that the network edge devices you intend to configure with user-based policies have been added to the Enterprise Policy Manager. For more information, see Configuration Devices (NN ). If you are working with an ERS 8800/8600 device, you will need to consider the type of open mode you want to use for UBP sessions on the device interfaces. The open mode is specified globally for the device object in EPM. User-Based Policies

48 48 Configuring EPM for UBP To set the open mode for an ERS 8800/8600 device, right-click its object in EPM and then choose Properties from the menu. Enabling Immediate-open mode allows a UBP user to have unrestricted access to the network until user-based policy filters are installed on the interface through which the user has connected. Leaving this option disabled leaves the interface in Delayed-open mode, which prevents the UBP user from having any network access until user-based policy filters have been installed on the interface. Delayed-open mode results in enhanced network security, but may also result in UBP users facing network access delays. Setting EPM preferences for UBP Procedure Steps Step Action 1 In the EPM Console, click Edit > Preferences > Devices > UBP. 2 Type a password in the Password field. Keep a record of this password in a secure location for future reference. The Authentication ID/password combination is used to set up an SNMP Inform table on the networking device in order to communicate UBP Inform messages between EBP/EAP-enabled devices and the policy server. 3 Choose an option from the Authentication Type drop-down list: NN

49 Configuring EPM for UBP 49 Authentication, No Privacy (the default setting) requires the Policy Server to authenticate itself when it connects to the device, using the authentication ID and password values specified above. No Authentication, No Privacy requires no authentication between the device and the Policy Server during UBP sessions. The No Privacy component of the above options specifies that no encryption is required for communications between the device and the Policy Server during UBP sessions. 4 From the Protocol drop-down list, choose MD5 as the authentication protocol. 5 Click OK. -End- Creating user roles in EPM For each user role you define in the RADIUS Server, you must define a corresponding role (with exactly the same name) in EPM. You must associate each of these roles with one or more policies in EPM. These policies will define the UBP user s network access. To create a role object in EPM, do the following: Procedure Steps Step Action 1 In the EPM Console, Policy Setup view, right-click the Roles root object and choose New Role from the menu. User-Based Policies

50 50 Configuring EPM for UBP 2 In the New Role dialog box, type a name for a new user role. The role you create here will become a user role, after the networking device has authenticated the user through the RADIUS server, and contacted the Policy Server for user-based policy information. The role name you define here should match EXACTLY with one of the user role names you defined through the RADIUS server, but WITHOUT the UROL prefix (for example, UROLstudent will have a role name of student in EPM). 3 If you have already created some user-based policies in EPM, you can associate them with the new role at this time. In the Available Policies list, navigate to the directory location where you have stored the policies, click on the policy you want to associate with the role, and then click on the Right Arrow button. You can associate one or more policies with a role. 4 Click OK. You should repeat this procedure to create additional role objects in EPM - each one corresponding to one of the user roles you created in the RADIUS server. -End- Checking a device for policy filters You can use the Deployed Filters feature to check your networking devices to ensure that they received the policy filters you assigned to them. In order to check the policy filters installed on your COPS-PR devices, you must meet the following requirements: You must have SNMP device status reporting enabled on your network devices. You must enter the SNMP string for each device on the device s corresponding object in the EPM Console. NN

51 Configuring EPM for UBP 51 To check a device for policy filters in the Deployment Status view, follow these steps: Procedure Steps Step Action 1 In the Devices list, navigate to a device that is configured to receive user-based policies. 2 Right-click on the device and choose Show Deployed Filters from the menu. 3 In the Deployed Filters dialog box, click on the Lookup button next to the Interface field. 4 In the Select Interface dialog box, click an interface that is configured for EAP and RADIUS. A list of policy filters should appear in the Filter Set list. If the device is currently active in your network, the filters may have matched some of the traffic passing through the interface. The specific attributes of the filter (matching criteria, action) appear in the Details of Selected Filter area. Information about traffic matched by the filter appears in the Currently Reported Counter Values area (if the device supports filter statistics reporting). If the entries in the Filter Set list appear in red, the filters have not matched any traffic yet. -End- User-Based Policies

52 52 Configuring EPM for UBP NN

53 53 Setting up the Funk Odyssey Client for EAP The Funk Odyssey Client handles communications between the EAP supplicant (the user s computer) and the EAP access point (the network edge device). It should be installed on any EAP/ UBP user s computer. To configure the Funk Odyssey Client, follow these steps: Procedure Steps Step Action 1 Open the Funk Odyssey Client Manager. User-Based Policies

54 54 Setting up the Funk Odyssey Client for EAP 2 In the Odyssey Client Manager window, click the Profiles icon and then click the Add button. 3 In the Add Profile dialog box, type a Profile Name, a Login name, and Password method. The Login Name/Password combination should correspond exactly to one of the username/password combinations you defined on the RADIUS server. 4 Click the Authentication tab and then click the Add button. 5 In the Add EAP Protocol dialog box, choose EAP/MD5-Challenge in the Protocols list and then click OK. 6 In the Add Profile dialog box, move EAP/MD5 Challenge to top of list or remove EAP/TTLS and click OK. NN

55 Setting up the Funk Odyssey Client for EAP 55 7 Enable the Odyssey client through the Settings menu. 8 Connect to the RADIUS/EAP network. You must physically connect the client/ supplicant computer to an EAP-enabled port on the edge device (by LAN cable). Click the Connection icon and then choose a profile from the Connect Using Profile drop-down list on the Connection page. The Status should change to open and authenticated. -End- User-Based Policies

56 56 Setting up the Funk Odyssey Client for EAP NN

57 57 Setting up the Windows XP client for EAP The Windows XP workstation includes client software that can handle communications with an EAP access point (the network edge device). Navigation Tips and hints for setting up Windows XP on page 57 Enabling EAP on Windows XP on page 57 Testing EAP authentication on page 59 Tips and hints for setting up Windows XP Set up at least one user to have local administrative privileges on the Windows XP workstation. For the sake of convenience, create that user s local account with the same names used in the domain account. Upon initial login (through Windows XP window where the username/password and domain name are entered), verify that the device switch port does not have EAP enabled, in order to allow the workstation to find the domain controller (Windows 2000 server), and the user s credentials can be cached in Windows XP. When EAP is set up on the switch and on the Windows XP workstation, allow several seconds for the pop domain login to appear from the system tray. Enabling EAP on Windows XP Procedure Steps Step Action 1 Open the Windows Control Panel on the PC/Laptop running Windows XP and double-click the Network Connections icon. In the Network Connections window, right-click the Local Area Connection icon and choose Properties from the menu. 2 On the General tab of the Local Area Connection Properties dialog box, enable the Show Icon In Notification Area When Connected check box. This enables User-Based Policies

58 58 Setting up the Windows XP client for EAP the popup window on the desktop, prompting you to login to the network after Windows XP completes its start up. 3 Click the Authentication tab and enable the Enable Network Access Control Using IEEE 802.1X check box. There is no need to check other boxes for EAP authentication unless support for connection to non-eap enabled switch ports is required. -End- NN

59 Setting up the Windows XP client for EAP 59 Testing EAP authentication This section illustrates the process of booting up the Windows XP workstation, testing the EAP login process, and verifying authentication success. Logging on to the domain with Windows XP Procedure Steps Step Action 1 From a powered-off state, boot up a Windows XP platform that is connected to an EAP-enabled device port. 2 At the first Windows XP login window, enter the computer username and password, or the domain username and password and domain name. (Either will work because Windows XP can be configured to support multiple users). 3 Once Windows XP has finished starting up and the desktop screen and icons are visible, wait a few seconds for a message to appear from the system tray, prompting you to logon to the network. 4 Click on the connection icon in the system tray to reveal the new login window (shown below). If the Local Area Connection status window also appears, you can close that window. -End- User-Based Policies

60 60 Setting up the Windows XP client for EAP Checking EAP authentication success Procedure Steps Step Action 1 On the Windows Control Panel > Network Connections, the Local Area Connection icon should display an Authentication succeeded message. 2 Verify that DHCP functioned properly by clicking the network connection icon on the system tray and then clicking the Support tab to view the allocated IP address and other information. NN

61 Setting up the Windows XP client for EAP 61 3 From the Windows 2000 menu Start menu, choose Administrative Tasks > Event Viewer. Click System Log, and then double-click the top event to view its properties. You can verify EAP success in the Event Properties dialog box. -End- Tips and hints for EAP authentication After completing a successful EAP login to the domain, when you log back out of Windows XP and re-login without powering off or unplugging the Ethernet cable from the PC you will usually not get the EAP login prompt. After logging out of Windows XP and before re-attempting another login, either remove and re-insert the Ethernet cable on the PC, or set the Reinitialize Port parameter to Yes on the ES 460/470 or BPS switch port that the PC is connected to. This action will cause the EAP login system tray prompt to appear again after logging into Windows XP. Make sure the user has successfully logged onto the domain for the first time via a switch port without EAP enabled. This is to allow caching of the user credentials in the Windows XP workstation. The very first login for a new user on the Windows XP workstation during startup requires the user to enter his domain login (username/password and domain name) at which point the Windows XP workstation will attempt to find the server / domain controller without running EAP at this point. If the Windows XP workstation is connected to a switch port with EAP enabled, the login will fail (ie: the workstation will never find the server). After the first successful login, EAP can then be enabled on the switch port from that point onwards for correct operation. User-Based Policies