<\/div>\n\n\n\n
Add the Firebox as a RADIUS Client<\/strong><\/p>\n\n\n\nIn NPS \u2192 RADIUS Clients and Servers \u2192 RADIUS Clients<\/strong>:<\/p>\n\n\n\n\nFriendly name:<\/strong> Firebox name<\/li>\n\n\n\nAddress:<\/strong> (usually the internal IP address of the Firebox that is local to the RADIUS server)<\/li>\n\n\n\nShared Secret:<\/strong> Must match what you configure on the Firebox<\/li>\n<\/ul>\n\n\n\n\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Ensure the Default Connection Request Policy Is Enabled<\/strong><\/p>\n\n\n\nIn Policies \u2192 Connection Request Policies<\/strong>, make sure the default policy is active. (You normally don\u2019t need to modify it for SSLVPN.)<\/p>\n\n\n\n\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Policies \u2192 Network Policies \u2192 New<\/strong><\/p>\n\n\n\n\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Specify Conditions<\/strong><\/p>\n\n\n\n\nWindows Group:<\/strong> Domain Users (or a specific VPN group)<\/li>\n\n\n\nAuthentication Type:<\/strong> PAP<\/li>\n\n\n\nYou can add more conditions if needed or just add the Win group<\/li>\n<\/ul>\n\n\n\n\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Specify Access Permission<\/strong><\/p>\n\n\n\nLeave at Access granted<\/strong> (default)<\/p>\n\n\n\n\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Configure Authentication Methods<\/strong><\/p>\n\n\n\nSelect only Unencrypted authentication (PAP,SPAP)<\/strong><\/p>\n\n\n\n\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Configure Constraints<\/strong><\/p>\n\n\n\nKeep defaults<\/p>\n\n\n\n\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Configure Settings<\/strong><\/p>\n\n\n\nAdd a Filter\u2011Id<\/strong> attribute:Add<\/strong>Filter\u2011Id<\/strong>\n\t\t\t\n\t\t\t\tImportant:<\/strong><\/p>\n\n\n\n\nThe Filter\u2011Id must match exactly<\/strong> the group name configured in the Firebox IKEv2 settings<\/li>\n\n\n\nIt is case\u2011sensitive<\/strong><\/li>\n\n\n\nDefault Firebox group name is SSLVPN-Users<\/strong><\/li>\n<\/ul>\n\n\n\nFinish the wizard<\/strong><\/p>\n\n\n\n\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Configure RADIUS on the Firebox<\/strong><\/p>\n\n\n\nIn Authentication \u2192 Servers \u2192 RADIUS<\/strong>:<\/p>\n\n\n\n\nDomain name:<\/strong> Any label name<\/li>\n\n\n\nIP address:<\/strong> NPS server IP<\/li>\n\n\n\nShared Secret:<\/strong> Same as in NPS<\/li>\n\n\n\nLeave other settings at default<\/li>\n<\/ul>\n\n\n\n\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
Configure IKEv2 to Use RADIUS<\/strong><\/p>\n\n\n\nIn VPN \u2192 Mobile VPN \u2192 SSLVPN \u2192 Authentication<\/strong>:<\/p>\n\n\n\n\nSelect the RADIUS<\/strong> server you created<\/li>\n\n\n\nEnsure the Group Name<\/strong> matches the NPS Filter\u2011Id (e.g., SSLVPN-Users<\/em>)<\/li>\n<\/ul>\n\n\n\n\n\t\t\t\n\t\t\t\t<\/div>\n\n\n\n
How Radius Authentication Works<\/strong><\/p>\n\n\n\n\nThe SSLVPN client connects to the Firebox<\/li>\n\n\n\n Firebox sends the username\/password to NPS via RADIUS<\/li>\n\n\n\n NPS validates the user against Active Directory<\/li>\n\n\n\n If authentication succeeds, NPS sends back:\n\nAccess\u2011Accept<\/strong><\/li>\n\n\n\nFilter\u2011Id = SSLVPN-Users<\/strong><\/li>\n<\/ul>\n<\/li>\n\n\n\nFirebox applies the matching SSLVPN group policy and firewall rules<\/li>\n<\/ol>\n\n\n\n<\/p>\n","protected":false},"excerpt":{"rendered":"
LDAP is the preferred method for authenticating SSLVPN users against an on\u2011premises Active Directory server. However, it is also possible to use a Windows NPS RADIUS server to authenticate AD users. The configuration is almost the same as when you set up IKEv2 Mobile VPN to authenticate on\u2011prem AD users. The only differences are: Install…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,12,10,4,2],"tags":[],"class_list":["post-362","post","type-post","status-publish","format-standard","hentry","category-authentication","category-radius","category-sslvpn","category-vpn","category-watchguard"],"_links":{"self":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts\/362","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/comments?post=362"}],"version-history":[{"count":17,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts\/362\/revisions"}],"predecessor-version":[{"id":385,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts\/362\/revisions\/385"}],"wp:attachment":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/media?parent=362"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/categories?post=362"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/tags?post=362"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"http:\/\/mangen.kitabara.org\/wp-content\/uploads\/2026\/04\/NPS-radius.png\")