RADIUS Authentication (Windows Server)

RADIUS Authentication (Windows Server)

1.0 Introduction

This article will walk you through enabling Active Directory authentication for SSL VPN users using RADIUS.

2.0 Requirements

  1. IoT-max™ Appliance
  2. Securolytics Firewall License
  3. Windows Server 2012 R2 or newer

3.0 Windows Server Configuration

3.1 Add Server Role

  1. Open the Server Manager application.
  2. Access the Manage menu and click on Add roles and features.

Windows Server Add Role



  1. Access the Server roles screen, select the Network Policy and Access Service option
  2. Click Next

Network Policy and Access Service

  1. On the following screen, click on the Add features button.
network policy features

  1. On the Role service screen, click on the Next Button.

network policy server

  1. On the next screen, click on the Install button.
radius server installation on windows

  1. This completes the RADIUS server installation on Windows Server.

3.2 Create an SSL VPN Users Group

  1. On the domain controller, open Active Directory Users and Computers
  2. Create a new group inside the Users container.

RADIUS Active Directory Group
  1. In this example, we will create a new group called "SSL-VPN-Users".

  1. Users that are allowed to connect to the SSL VPN should be added to this group.

3.3 Add Client Devices

  1. On the RADIUS server, open Network Policy Server
  2. You need to authorize the RADIUS server in the Active Directory database.
  3. Right-click on NPS (LOCAL) and select the Register server in Active Directory option.

authorize radius server on windows
  1. On the confirmation screen, click on the OK button.
  2. Next, you need to configure Radius clients.
  3. Radius clients are devices that will be allowed to request authentication from the Radius server.
  4. Note: Do not confuse Radius clients with Radius users.
  5. Right click on Radius Clients folder and select the New option.

  1. You need to set the following configuration:

    1. Friendly name: [Hostname of SSL VPN Server]
    2. Address (IP or DNS): [IP address of of SSL VPN Server]
    3. Shared Secret: Manual / [Unique 24 Character String]

  2. The Shared secret will be used to authorize the SSL VPN appliance to use the RADIUS server.
  3. You have now completed the RADIUS client configuration.

3.4 Configure Network Policy

  1. Now, you need to create a Network Polity to allow authentication.
  2. Right click on the Network Policies folder and select the New option.
  3. Enter a name to the network policy and click on the Next button.


nps - network policy name

  1. Click on the Add condition button.
  2. We are going to allow members of the SSL-VPN-Users group to authenticate.

mikrotik radius user group
  1. Select the User group option and click on the Add button.
nps - user group condition

  1. Click on the Add Groups button and locate the SSL-VPN-Users group.
  2. Select the Access granted option and click on the Next button.
  3. This will allow members of the new SSL-VPN-Users group to authenticate on the Radius server.

NPS Access granted
  1. On the Authentication Methods screen, select the Unencrypted authentication (PAP, SPAP) option.
Radius server authentication method
  1. If the following warning is presented, click on the No button.
NPS Warning message
  1. Select the Vendor Specific radius attribute option and click on the Add button
Vendor Specific Settings
  1. Select the Custom vendor option.
  2. Select the Vendor-Specific Attribute and click on the Add button.
Vendor Specific Attribute
  1. Click on the Add button.
Vendor Attribute Information
  1. Set the Vendor Code: 14988
  2. Select: Yes, it conforms.
  3. Click on the Configure Attribute button.
Radius Vendor
  1. Set the Vendor-assigned attribute number: 3
  2. Select the Attribute format: String
  3. Enter the Attribute Value: full
radius attribute full
  1. The NPS Radius server will pass the vendor specific information back to the SSL VPN device.
active directory vendor specific
  1. Verify the RADIUS server configuration summary and click on the Finish button.
Active Directory LDAP


The RADIUS server configuration is now complete.