28. Configuring RADIUS Authentication for VPN with NPS

Video Series on Advance Networking with Windows Server 2019:
In this video guide, I will explain how to set up a RADIUS server on Windows Server 2019 and get it to work with a VPN server for authentication with Active Directory.
1: Install Network Policy and Access Service.
2: Setup RADIUS server configuration.
3: Install and Configure Remote Access Server role.
4: Setup Radius Authentication with VPN
5: Test Radius Authentication with VPN.
Follow my blogs:
msftwebcast.bl...

[@gammalite]

thank you, sir, a great presentation and very easy to follow. I love your enthusiasm as well. It made the presentation great.

[@sikhumbuzomthombeni5903]

Brilliant video, straight to the point and really makes a lot of sense. Thank you.

[@sreepriyanks]

haa finaly i got the exact one. your idea is crystal clear and thank you. please continue..

[@MdOmarFaruk-pt2uv]

Thank You for Making this video.

[@trautitrauti9094]

What exactly is a “VPN-server”? The NPS? The DC? What if I have L2TP or IPSec VPN?

[@ThePatsev]

When I go to Properties - Security I want to choose the Radius Authentication but I don't have this option. Instead I get a message saying "Because Network Policy Server NPS is installed you must use it to configure authentication and accounting providers" What should I do to get rid of this message and be able to choose the Radius Auth

[@guptaramkumar52]

Thank you with the help of your video I am able to perform lab. Could you please help me how to create network policy with the help of powershell/ CMD to automate this task.

[@jeffreywilliams9432]

Any reason you didn't host RADIUS and VPN on the same server? Also, why is your VPN server not on the domain and in a workgroup? Will it still have access to group policy with this configuration if the VPN server is not on the domain? Security reasons?

[@lioneldurant2115]

yeah as long as he logon with an Active directory account with (mydomaine\adminuser)

[@lioneldurant2115]

Good video , but 2 major points to bring in the table : 1st : lets make it more clear regarding FQDN which is way more important than ip for DNS issues that you never used here 2nd : would be way better to do the final test from a vm or a machine outside of your internal network (pointless in the same network cause you dont need to specify public ip and port number) Very good explanation , but not enough of practical procedures Thanks anyway !

[@jets8003vinh]

Thanks. Since I need to configure RADIUS server with 1 user for 1 device only, hence, could you help me?

[@MohamedAli-yw9nz]

Thanks for sharing this Please Can u do another lab for Radius wired & wireless authentication

[@techtest5490]

Thank you! This helped a lot!

[@MSFTWebCast]

Glad it helped!

[@michaelcena3589]

What if my VPN server is a firewall (Cisco MX250 to be exact)? Do I add the MX250 LAN IP in minute 7:01?

[@No-Tick]

Apologies for my ignorance here... Is there a reason you didn't put the VPN server (WS2K19-SRV02) on your AD domain? (@12:05)

[@MSFTWebCast]

For security reason. Actually VPN server will be in DMZ (in production scenario) and we dont want any direct communication with Active Directory (As VPN is in workgroup, Single Sign On will also not work).

[@No-Tick]

@@MSFTWebCast That makes complete sense. Thanks for answering my question and thank you for all the MS2k19 videos. They're very helpful!

[@tanaysamanta4730]

Which username and password you are giving to connect VPN from windows 10, is it any username, presented in Active Directory? Kindly let me know. Thank you!

[@vetribull8318]

Hi sir, I couldn't find the wired one.. Did you have any videos regarding wired?

[@wamonarcisse4652]

very good video

[@manjitbhatia9909]

Good but you have not used any certicates , As we published VPN server over internet need secure access .

[@damargalihkalicki6530]

hi sir, im getting problem to registry nps to active directory. in my condition NPS Server and AD Server different VM and different IP but can ping each other. can you info what wrong with my config ?

[@simonclausen8132]

Very Nice

[@BPITRohini]

I have configured the radius and NPS services by following the same steps but when try to connect Wi-Fi a error showing "unable to connected" how to resolve this problem

[@MSFTWebCast]

First check logs on NPS server that might help.

[@manjimmukulsharma9077]

A connection between your computer and the VPN server has been established but the VPN connection cannot be completed. Error Code 806 - The most common cause for this failure is that at least one Internet device (for example, a firewall or router) between your computer and the VPN server is not configured to allow Generic Routing Encapsulation (GRE) protocol packets. If the problem persists, contact your network administrator or Internet Service Provider.

[@mbilalkhaan]

Great Video, Keep up the good work

[@darylzero3139]

Can you do a video with a SSTP VPN using MFA? DUO MFA

[@jeffreywilliams9432]

Hi, thanks for the video. At 5:07, after the server was registered with active directory, it did not create the 'RAS and IAS Servers' security group. Any suggestions? Should I try to stop the service and re-register it?

[@jeffreywilliams9432]

It wasn't showing up in AD. Did several refreshes. It finally showed up under 'Domain/Groups/RAS and IAS Servers'.

[@tanaysamanta4730]

Login as \Administrator

[@tanaysamanta4730]

Has the client windows 10 to be part of domain?

[@MSFTWebCast]

No.

[@jairovalencia1392]

I cant access the "Register server in Active Directory" it is blanked out.

[@MSFTWebCast]

Login using domain administrators credential.

[@vetriforward6819]

Hi bro, is This 802.1x ?

[@yogeshneerudu8704]

UR awesome bro.. Nice explanation crystal clear.. super.. Can you please tell if i want to change the shared secret password later what is the procedure.

[@manjimmukulsharma9077]

cannot connect the VPN.getting error "GRE protocol error". ANy suggestion

[@MSFTWebCast]

I think probably router or firewall is blocking the traffic. You need to access the admin page of your router and look for PPTP and/or PPTP pass through settings. Configure the network firewall to permit GRE protocol 47 and make sure that the network firewall permits TCP traffic on port 1723.

[@manjimmukulsharma9077]

Just to add I am using three VM on Azure … one for AD one for VPN Server one for Radius Server and one windows 10 client …I have added the GRE ports in inbound and outbound firewall advance settings also..

[@CodeWithTanuj]

Pl told NPS authentication with L2Sw

[@ahmedsaad-lk2og]

thanks

[@pahadigamer4916]

Hi , I am one of your subscriber can you help me with this task

[@howtoparentsolo]

can i have some curry in the hurry please

[@gammalite]

dumb comment.