{"id":308,"date":"2026-04-22T22:46:46","date_gmt":"2026-04-22T19:46:46","guid":{"rendered":"https:\/\/mangen.kitabara.org\/?p=308"},"modified":"2026-07-07T21:58:35","modified_gmt":"2026-07-07T18:58:35","slug":"configure-microsoft-nps-to-authenticate-on-prem-ad-users-for-firebox-ikev2-mobile-vpn","status":"publish","type":"post","link":"https:\/\/mangen.kitabara.org\/index.php\/configure-microsoft-nps-to-authenticate-on-prem-ad-users-for-firebox-ikev2-mobile-vpn\/","title":{"rendered":"Configure Microsoft NPS to authenticate on\u2011prem AD users for Firebox IKEv2 mobile VPN"},"content":{"rendered":"\n

IKEv2 with MS\u2011CHAPv2 cannot<\/strong> authenticate directly against LDAP, so a RADIUS server is required. The simplest option is Microsoft NPS<\/strong>, which is included with Windows Server. (FreeRADIUS works too<\/a>, but this guide focuses on NPS.)<\/p>\n\n\n\n

Install NPS on a Windows Server<\/strong><\/h2>\n\n\n\n

You can install NPS on any Windows Server, including a Domain Controller.<\/p>\n\n\n\n

Server Manager<\/strong>
Manage \u2192 Add Roles and Features<\/em>
Select Network Policy and Access Services<\/strong><\/p>\n\n\n\n

PowerShell (Admin):<\/strong>
Install-WindowsFeature NPAS -IncludeManagementTools<\/p>\n\n\n

\n
\"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n
<\/div>\n\n\n\n

Add the Firebox as a RADIUS Client<\/strong><\/h2>\n\n\n\n

In NPS \u2192 RADIUS Clients and Servers \u2192 RADIUS Clients<\/strong>:<\/p>\n\n\n\n

    \n
  • Friendly name:<\/strong> Firebox name<\/li>\n\n\n\n
  • Address:<\/strong> (usually the internal IP address of the Firebox that is local to the RADIUS server)<\/li>\n\n\n\n
  • Shared Secret:<\/strong> Must match what you configure on the Firebox<\/li>\n<\/ul>\n\n\n
    \n
    \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n
    <\/div>\n\n\n\n

    Ensure the Default Connection Request Policy Is Enabled<\/strong><\/h2>\n\n\n\n

    In Policies \u2192 Connection Request Policies<\/strong>, make sure the default policy is active. (You normally don\u2019t need to modify it for IKEv2.)<\/p>\n\n\n

    \n
    \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n
    <\/div>\n\n\n\n

    Policies \u2192 Network Policies \u2192 New<\/strong><\/h2>\n\n\n
    \n
    \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n
    <\/div>\n\n\n\n

    Specify Conditions<\/strong><\/p>\n\n\n\n

      \n
    • Windows Group:<\/strong> Domain Users (or a specific VPN group)<\/li>\n\n\n\n
    • Authentication Type:<\/strong> MS\u2011CHAP\u2011v2<\/li>\n\n\n\n
    • You can add more conditions if needed or just add the Win group<\/li>\n<\/ul>\n\n\n
      \n
      \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n
      <\/div>\n\n\n\n

      Specify Access Permission<\/strong><\/p>\n\n\n\n

      Leave at Access granted<\/strong> (default)<\/p>\n\n\n

      \n
      \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n
      <\/div>\n\n\n\n

      Configure Authentication Methods<\/strong><\/p>\n\n\n\n

      Select only Microsoft Encrypted Authentication version 2 (MS\u2011CHAP\u2011v2)<\/strong><\/p>\n\n\n

      \n
      \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n
      <\/div>\n\n\n\n

      Configure Constraints<\/strong><\/p>\n\n\n\n

      Keep defaults<\/p>\n\n\n

      \n
      \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n
      <\/div>\n\n\n\n

      Configure Settings<\/strong><\/p>\n\n\n\n

      Add a Filter\u2011Id<\/strong> attribute:
      Click Add<\/strong>
      Choose Filter\u2011Id<\/strong>
      Enter: IKEv2-Users<\/p>\n\n\n

      \n
      \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n
        \n
      1. <\/li>\n<\/ol>\n\n\n\n

        \u26a0\ufe0f Important:<\/strong><\/p>\n\n\n\n

          \n
        • The Filter\u2011Id must match exactly<\/strong> the group name configured in the Firebox IKEv2 settings<\/li>\n\n\n\n
        • It is case\u2011sensitive<\/strong><\/li>\n\n\n\n
        • Default Firebox group name is IKEv2-Users<\/strong><\/li>\n<\/ul>\n\n\n\n

          Finish the wizard<\/strong><\/p>\n\n\n

          \n
          \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n
          <\/div>\n\n\n\n

          Configure RADIUS on the Firebox<\/strong><\/h2>\n\n\n\n

          In Authentication \u2192 Servers \u2192 RADIUS<\/strong>:<\/p>\n\n\n\n

            \n
          • Domain name:<\/strong> Any label name<\/li>\n\n\n\n
          • IP address:<\/strong> NPS server IP<\/li>\n\n\n\n
          • Shared Secret:<\/strong> Same as in NPS<\/li>\n\n\n\n
          • Leave other settings at default<\/li>\n<\/ul>\n\n\n
            \n
            \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n
            <\/div>\n\n\n\n

            Configure IKEv2 to Use RADIUS<\/strong><\/p>\n\n\n\n

            In VPN \u2192 Mobile VPN \u2192 IKEv2 \u2192 Authentication<\/strong>:<\/p>\n\n\n\n

              \n
            • Select the RADIUS<\/strong> server you created<\/li>\n\n\n\n
            • Ensure the Group Name<\/strong> matches the NPS Filter\u2011Id (e.g., IKEv2-Users<\/em>)<\/li>\n<\/ul>\n\n\n
              \n
              \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n\n\n
              <\/div>\n\n\n\n

              How Radius Authentication Works<\/strong><\/p>\n\n\n\n

                \n
              1. The IKEv2 client connects to the Firebox<\/li>\n\n\n\n
              2. Firebox sends the username\/password to NPS via RADIUS<\/li>\n\n\n\n
              3. NPS validates the user against Active Directory<\/li>\n\n\n\n
              4. If authentication succeeds, NPS sends back:\n
                  \n
                • Access\u2011Accept<\/strong><\/li>\n\n\n\n
                • Filter\u2011Id = IKEv2-Users<\/strong><\/li>\n<\/ul>\n<\/li>\n\n\n\n
                • Firebox applies the matching IKEv2 group policy and firewall rules<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

                  IKEv2 with MS\u2011CHAPv2 cannot authenticate directly against LDAP, so a RADIUS server is required. The simplest option is Microsoft NPS, which is included with Windows Server. (FreeRADIUS works too, but this guide focuses on NPS.) Install NPS on a Windows Server You can install NPS on any Windows Server, including a Domain Controller. Server ManagerManage…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,5,12,4,2],"tags":[],"class_list":["post-308","post","type-post","status-publish","format-standard","hentry","category-authentication","category-ikev2","category-radius","category-vpn","category-watchguard"],"_links":{"self":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts\/308","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/comments?post=308"}],"version-history":[{"count":25,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts\/308\/revisions"}],"predecessor-version":[{"id":904,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts\/308\/revisions\/904"}],"wp:attachment":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/media?parent=308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/categories?post=308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/tags?post=308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}