Description
This Document Assumes the Following :
- FortiGate OS v5.x
- Windows 2008 R2 Server with the
following installed:
- Network Policy Server (NPS)
*
- Active Directory
- Active Directory Certificate
Management
* In Windows Server 2008 / 2008 R2, Network Policy Server
(NPS) replaces Internet Authentication Service (IAS).
Configuring the RADIUS server on NPS
- Browse to Network Policy and
Access Server -> NPS(Local) -> Radius Clients and Servers
-> RADIUS Clients
- Right Click on RADIUS Client and
select New
Settings Tab
Friendly Name : Name the 'Network Policy and Access Server'
Address : Enter IP of FortiGate
Shared Secret : Create a password for the radius server
Leave all other settings as default
Advanced Tab
Leave all settings as default
- Browse to Network Policy and
Access Server -> NPS(Local) -> Policies -> Connection
Request Policies
- Right Click and select New
|-Enter friendly name in the 'Policy name:' field, then select Next
|-Under 'Specify Conditions'
|-Select Add
|-Scroll down to Client IPv4 Address
|-Select 'Add'
|-Enter the IP address of the internal interface of the FortiGate and select OK
|-Select Next
|-Select Next
|-Select Next
|-Select Next
|-Select Finish
|-Move the newly created Connection Request Policy above the default 'Use Windows Authentication for all users' policy.
- Browse to Network Policy and
Access Server -> NPS(Local) -> Policies -> Network
Policies
- Right Click and select New
|-Enter friendly name in the 'Policy name:' field, then select Next
|-Under 'Specify Conditions'
|-Select Add
|-Select 'Windows Groups'
|-Select Add
|-Select 'Add Groups'
|-Add you Windows Security Group you wish to allow access
|-Select OK
|-Select Next
|-Select Next
|-Under 'Configure Authentication Methods'
|-Check 'Microsoft Encrypted Authentication version 2 (MS-CHAP-v2)'
|-Select Add
|-Select 'Microsoft: Protected EAP (PEAP)'
|-Select OK
|-Highlight 'Microsoft: Protected EAP(PEAP)'
|-Select Edit
|-Under 'Edit Protected EAP Properties'
|-Make sure the Certificate issued is not the CA certificate.
|-Select Next
|-Select Next
|-Select Next
|-Select Finish
|-Move the newly created Network Policy to the top of the list
Configure the FortiGate to use the RADIUS Server
- Log into the FortiGate's GUI, and
browse to 'User & Device -> Authentication -> RADIUS
Server'
- Select Create New
- Under 'New Radius Server'
Name : Enter a friendly name
Primary Server IP/Name : IP address or FQDN of RADIUS server
Primary Server Secret : The shared secret created on the Windows Server in the Radius Client Settings
Leave the rest as default.
- Select OK
- Browse to 'WiFi Controller ->
WiFi Network -> SSID'
- Select your SSID you wish to use
RADIUS to authenticate or Create New
- Under 'Edit Interface'
Security Mode : WPA/WPA2 Enterprise
Authentication : RADIUS Server
Select the RADIUS server created in the drop down menu
Check 'Listen for RADIUS Accounting Messages'
