How to allow RADIUS admin to login the switch? (by Windows Server)
In the following example, we will only provide the necessary settings on the NPS of Windows Server 2019. If you haven't finished the switch settings, please check this article to complete.
Topology
Configuration of NPS
1. Set RADIUS Clients to 10.214.36.29 with shared secret 12345678.
2. Create your user account in "Active Directory Users and Computers". We will use zyuser as an example.
3. Add a login attribute to the Network policies of NPS.
(Please make sure that the login account (zyuser) is contained in the Windows Groups that you specified in the Conditions tab of NPS policy)
4. Create a new attribute string: “Zyxel-Privilege-AVPair” whose attribute ID is “3”. The vendor ID of Zyxel is “890” on the same Network policy.
Zyxel-Privilege-AVPair(3)
shell:priv-lvl=14
Verifications:
- Telnet or SSH from the customer to the switch
- Check packet replied from the Windows Server
What could go wrong
1. If you always fail to authenticate, check the Event Viewer on Windows Server to see what is the reason. For instance:
2. Unencrypted authentication (PAP, SPAP) must be enabled.
Categories
- All Categories
- 414 Beta Program
- 2.2K Nebula
- 130 Nebula Ideas
- 90 Nebula Status and Incidents
- 5.4K Security
- 171 USG FLEX H Series
- 256 Security Ideas
- 1.4K Switch
- 71 Switch Ideas
- 1K Wireless
- 36 Wireless Ideas
- 6.2K Consumer Product
- 235 Service & License
- 372 News and Release
- 77 Security Advisories
- 24 Education Center
- 5 [Campaign] Zyxel Network Detective
- 2.9K FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 80 About Community
- 69 Security Highlight