Windows Server 2012 - Configure RADIUS for Cisco ASA 5500 Authentication
KB ID 0000685 Dtd 19/09/12
I will say that Kerberos Authentication is a LOT easier to configure, but I've yet to test that with 2012, (watch this space).
Step 1 Configure the ASA for AAA RADIUS Authentication
1. Connect to your ASDM, > Configuration.
2. Remote Access VPN.
4. In the Server group section > Add.
5. Give the group a name and accept the defaults > OK.
6. Now (with the group selected) > In the bottom (Server) section > Add.
Configure AAA RADIUS from command line;
aaa-server PNL-RADIUS (inside) host 172.16.254.223
Step 2 Configure Windows 2012 Server to allow RADIUS
9. On the Windows 2012 Server > Launch Server Manager > Local Server.
10. Manage > Add Roles and Features.
11. If you get an initial welcome page, tick the box to 'skip' > Next > Accept the 'Role based or feature based installation' > Next.
12. We are installing locally > Next.
13. Add 'Network Policy and Access Server' > Next.
14. Add Features.
19. When complete > Close.
20. Select NAP.
21. Right click the server > Network Policy Server.
22. Right click NPS > Register server in Active Directory.
24. Give the firewall a friendly name, (take note of what this is, you will need it again) > Specify its IP > Enter the shared secret you setup above (number 7) > OK.
25. Expand policies > right click 'Connection Request Policies' > New.
26. Give the policy a name > Next.
27. Add a condition > Set the condition to 'Client Friendly Name' > Add.
28. Specify the name you set up above (number 24) > OK > Next.
31. Change the attribute to 'User-Name' > Next.
33. Now right click 'Network Policies' > New.
34. Give the policy a name> Next.
35. Add a condition > User Groups.
36. Add in the AD security group you want to allow access to > OK > Next.
38. Access Granted > Next.
40. Select No.
Step 3 Test RADIUS Authentication
44. Back at the ASDM, in the same page you were in previously, select your server and then click 'Test'.
45. Change the selection to Authentication > Enter your domain credentials > OK.
46. You are looking for a successful outcome.
Note: if it fails check there is physical connectivity between the two devices, the shared secrets match. Also ensure UDP ports 1645 and 1646 are not being blocked.
To Test AAA RADIUS Authentication from Command Line
47. Finally, save the firewall changes > File > Save running configuration to flash.
Related Articles, References, Credits, or External Links