Deploying Secure 802.11 Wireless Networks with Microsoft Windows

IAS

IAS in Windows 2000 Server is the Microsoft implementation of a RADIUS server. IAS in Windows Server 2003 is the Microsoft implementation of a RADIUS server and proxy. IAS performs centralized connection authentication, authorization, and accounting for many types of network access, including wireless, authenticating switch, dial-up, virtual private network (VPN) remote access, and site-to-site connections. IAS supports RFCs 2865 and 2866, as well as additional RFCs and Internet drafts that define RADIUS extensions.

IAS enables the use of a heterogeneous set of wireless, switch, remote access, or VPN equipment, and can be used with the Windows 2000 Server or Windows Server 2003 Routing and Remote Access service.

When an IAS server is a member of an Active Directory based domain, IAS uses Active Directory as its user account database and is part of a single sign-on solution. The same set of credentials is used for network access control (authenticating and authorizing access to a network), to log on to an Active Directory-based domain, and to access secured resources in the domain.

IAS configurations can be created for the following solutions:

More Info For detailed information about how to configure IAS for wireless access, see Chapter 8, Intranet Wireless Deployment Using EAP-TLS, Chapter 10, Intranet Wireless Deployment Using PEAP-MS-CHAP v2", and Chapter 11, Additional Intranet Wireless Deployment Configurations.

The following sections describe the global properties of IAS for Windows 2000 Server and Windows Server 2003, regardless of its role as a RADIUS server or RADIUS proxy.

More Info For more information about how IAS is used for solutions that do not involve wireless access, see Windows 2000 Server Help or Windows Server 2003 Help and Support.

Installing IAS

IAS is not installed by default in Windows Server 2000 and Windows Server 2003. To install IAS, go to Control Panel, choose Add Or Remove Programs, and then Add/Remove Windows Components. In the list of components, select Networking Services and click Details to list the subcomponents of Networking Services, which includes IAS. After IAS is installed, you configure it by using the Internet Authentication Service snap-in, which is available in the Administrative Tools folder.

IAS Configuration Settings for Windows 2000 Server

The global properties of IAS consist of server properties and remote access logging properties. (The settings shown in the following screen shots reflect the default settings, unless otherwise noted.)

Server Properties

To configure the global properties of an IAS server running Windows 2000 Server in the Internet Authentication Service snap-in, right-click Internet Authentication Service and then click Properties.

Service Tab

Figure 4-2 shows the Service tab for IAS in Windows 2000 Server.

Figure 4-2. The Service tab for IAS in Windows 2000 Server.

From the Service tab, you can view and configure the following:

RADIUS Tab

Figure 4-3 shows the RADIUS tab for IAS in Windows 2000 Server.

Figure 4-3. The RADIUS tab for IAS in Windows 2000 Server.

From the RADIUS tab, you can view and configure the following:

Realms Tab

Figure 4-4 shows the Realms tab for IAS in Windows 2000 Server.

Figure 4-4. The Realms tab for IAS in Windows 2000 Server.

You use the Realms tab to configure a prioritized list of find-and-replace rules to manipulate realm names before attempting to resolve the name to an account and perform authentication. The realm is the portion of the username in the authentication credentials that identifies the location of the user account. There are different forms of realm names:

Pattern-matching syntax is used to specify the strings to find and replace. Find-and-replace rules can be added, edited, and removed. The rules are applied to the incoming username in the order in which they are listed. Use the Move Up and Move Down buttons to specify the order.

More Info For more information about pattern matching syntax, see the topic titled Pattern Matching Syntax in Windows 2000 Server Help.

NOTE IAS for Windows Server 2003 does not include a Realms tab. Realm name manipulation for Windows Server 2003 IAS is done by using connection request policies.

Remote Access Logging-Local File Properties

Within the Remote Access Logging folder of the Internet Authentication Service snap-in, is the Local File object. This object allows IAS to log connection accounting information to a file. To configure its properties, right-click Local File in the details pane and click Properties.

Settings Tab

Figure 4-5 shows the Settings tab for the Local File object in Windows 2000 Server IAS.

Figure 4-5. The Settings tab for the Local File object in Windows 2000 Server IAS.

From the Settings tab, you can view and configure the following:

Local File Tab

Figure 4-6 shows the Local File tab for the Local File object in Windows 2000 Server IAS.

Figure 4-6. The Local File tab for the Local File object in Windows 2000 Server IAS.

From the Local File tab, you can view and configure the following:

More Info For more information about log file formats, see Windows 2000 Server Help.

IAS Configuration Settings for Windows Server 2003

The IAS global properties consist of server properties and remote access logging properties. (The settings shown in the following screenshots reflect the default settings, unless otherwise noted.)

Server Properties

To configure the global properties of an IAS server running Windows Server 2003 in the Internet Authentication Service snap-in, right-click Internet Authentication Service, and then click Properties.

General Tab

Figure 4-7 shows the General tab for IAS in Windows Server 2003.

Figure 4-7. The General tab for IAS in Windows Server 2003.

From the General tab, you can view and configure the following:

Ports Tab

Figure 4-8 shows the Ports tab for IAS in Windows Server 2003.

Figure 4-8. The Ports tab for IAS in Windows Server 2003.

From the Ports tab, you can view and configure the following:

Remote Access Logging

The Remote Access Logging folder of the Internet Authentication Service snap-in contains the Local File and SQL Server objects. These objects represent two different ways that IAS can log connection accounting information: to a file and to a structured query language (SQL) server. To configure the Local File or SQL Server object properties, right-click one of them in the details pane of the snap-in and click Properties.

Local File-Settings Tab

Figure 4-9 shows the Settings tab for the Local File object in Windows Server 2003 IAS.

Figure 4-9. The Settings tab for the Local File object in Windows Server 2003 IAS.

From the Settings tab, you can view and configure the following:

Local File-Log File Tab

Figure 4-10 shows the Log File tab for the Local File object in Windows Server 2003 IAS.

Figure 4-10. The Log File tab for the Local File object in Windows Server 2003 IAS.

From the Log File tab, you can view and configure the following:

More Info For more information about log file formats, see Windows Server 2003 Help and Support.

SQL Server-Settings Tab

Figure 4-11 shows the Settings tab for the SQL Server object in Windows Server 2003 IAS.

Figure 4-11. The Settings tab for the SQL Server object in Windows Server 2003 IAS.

From the Settings tab, you can view and configure the following:

IAS as a RADIUS Server

IAS can be used as a RADIUS server to perform authentication, authorization, and accounting for RADIUS clients. A RADIUS client can be either an access server or a RADIUS proxy. IAS as a RADIUS server is shown in Figure 4-12.

Figure 4-12. IAS as a RADIUS server.

Between the access server and IAS server, RADIUS messages are exchanged. Between the IAS server and the Active Directory domain controller, there is a secure communications channel.

When IAS is used as a RADIUS server, it provides the following:

You can use IAS as a RADIUS server in the following circumstances:

More Info For more information about using IAS as a RADIUS server, see Windows 2000 Server Help or Windows Server 2003 Help and Support.

Configuring RADIUS Clients

As a RADIUS server, IAS must be configured with RADIUS clients that correspond to either the access servers or RADIUS proxies that will be sending RADIUS request messages. RADIUS clients are added, configured, and removed from the Clients folder in the Internet Authentication Service snap-in for Windows 2000 Server IAS and from the RADIUS Clients folder in the Internet Authentication Service snap-in for Windows Server 2003 IAS.

To add a RADIUS client for Windows 2000 Server IAS, right-click the Clients folder and click New Client. To add a RADIUS client for Windows Server 2003 IAS, right-click the RADIUS Clients folder and click New RADIUS Client. A New RADIUS Client Wizard or a set of dialog boxes guides you through the configuration of a RADIUS client.

Figure 4-13 shows the properties of a RADIUS client in Windows Server 2003 IAS.

Figure 4-13. The properties of a RADIUS client in Windows Server 2003 IAS.

From the Settings tab, you can view and configure the following:

Remote Access Policy Overview

For a connection attempt to be accepted, it must be both authenticated and authorized. Authentication is done by verifying the credentials of the access client. Authorization is granted on the basis of user account dial-in properties and remote access policies. Remote access policies are an ordered set of rules that define how connections are either authorized or rejected. For each rule, there are one or more conditions, a set of profile settings, and a remote access permission setting.

When a connection is authorized, the remote access policy profile specifies a set of connection restrictions. The dial-in properties of the user account also provide a set of restrictions. Where applicable, user account connection restrictions override the remote access policy profile connection restrictions.

Remote Access Policy Conditions and Restrictions

Before authorizing the connection, remote access policies can validate a number of connection settings, including the following:

After authorizing the connection, remote access policies can specify connection restrictions, including the following:

For example, you can have policies that specify different maximum session times for different types of connections or groups. Additionally, you can have policies that specify restricted access for business partners or unauthenticated connections.

Remote Access Policy Configuration

A remote access policy is a named rule that consists of the following elements:

Remote access policies are configured from the Remote Access Policies object in the tree pane of the Internet Authentication Service snap-in. In Windows 2000 Server IAS, the Add Remote Access Policy Wizard guides you through the configuration of the elements of a remote access policy. In Windows Server 2003 IAS, the New Remote Access Policy Wizard greatly simplifies remote access policy creation.

Figure 4-14 shows the properties of a remote access policy named Wireless Access that was created for wireless connections.

Figure 4-14. Properties of a remote access policy.

Remote Access Policy Conditions

Remote access policy conditions are one or more attributes that are compared with the properties of the connection attempt. If there are multiple conditions, all conditions must be met in order for the connection attempt to match the policy.

More Info For a list of all the conditions and a description of each one, see Windows 2000 Server Help or Windows Server 2003 Help and Support.

Remote Access Permission

If all the conditions of a remote access policy are met, remote access permission is either granted or denied. Use the Grant Remote Access Permission option or the Deny Remote Access Permission option to set remote access permission for a policy.

Remote access permission is also configured on each account. When the remote access permission on the account is set to either Allow Access or Deny Access, the account remote access permission overrides the policy remote access permission. When remote access permission on an account is set to Control Access Through Remote Access Policy, the policy remote access permission determines whether the connection has remote access permission.

Granting access through the Account Remote Access Permission setting or the Policy Remote Access Permission setting is only the first step of accepting a connection. The connection attempt is then subjected to the settings of the account properties and the policy profile properties. If the connection attempt does not match the conditions or constraints of the account properties or the profile properties, the connection attempt is rejected.

NOTE By default, the New Remote Access Policy Wizard for Windows Server 2003 configures Grant Remote Access Permission.

Remote Access Policy Profile Settings

The remote access policy profile is a set of properties that is applied to a connection when the connection is granted remote access permission either through the account remote access permission setting or the policy permission setting. A profile consists of the following groups of properties:

These groups of properties are configured from tabs in the Edit Dial-In Profile dialog box. (The settings shown in the following screen shots reflect the default settings, unless otherwise noted.)

NOTE Because the remote access policy configuration dialog boxes are so similar between Windows 2000 Server and Windows Server 2003, only the dialog boxes for Windows Server 2003 are shown. Differences between Windows Server 2003 and Windows 2000 Server are noted as needed.

Dial-In Constraints Tab

Figure 4-15 shows the Dial-In Constraints tab for a remote access policy in Windows Server 2003 IAS.

Figure 4-15. The Dial-In Constraints tab for a remote access policy.

From the Dial-In Constraints tab, you can view and configure the following:

IP Tab

Figure 4-16 shows the IP tab for a remote access policy in Windows Server 2003 IAS.

Figure 4-16. The IP tab for a remote access policy.

From the IP tab, you can view and configure the following:

Multilink Tab

Figure 4-17 shows the Multilink tab for a remote access policy in Windows Server 2003 IAS.

Figure 4-17. The Multilink tab for a remote access policy.

From the Multilink tab, you can set properties that enable multilink and determine the maximum number of ports that a multilink connection can use. Additionally, you can set Bandwidth Allocation Protocol (BAP) policies that determine BAP usage and when extra BAP lines are dropped. The multilink and BAP properties are specific to Windows dial-up remote access.

Authentication Tab

Figure 4-18 shows the Authentication tab for a remote access policy in Windows Server 2003 IAS.

Figure 4-18. The Authentication tab for a remote access policy.

From the Authentication tab, you can set properties to enable the types of authentication that are allowed for a connection and specify the list of EAP types and their order of negotiation that must be used. For Windows Server 2003 IAS, the default authentication methods depend on your choices in the New Remote Access Policy Wizard.

For Windows 2000 Server IAS, you can select only a single EAP type for use with EAP-based authentication.

Encryption Tab

Figure 4-19 shows the Encryption tab for a remote access policy in Windows Server 2003 IAS.

Figure 4-19. The Encryption tab for a remote access policy.

From the Encryption tab, you can view and configure the following:

These encryption settings correspond to the MS-MPPE-Encryption-Policy and MS-MPPE-Encryption-Types RADIUS attributes (RFC 2548). For Windows Server 2003 IAS, the default encryption strengths depend on your choices in the New Remote Access Policy Wizard.

Advanced Tab

Figure 4-20 shows the Advanced tab for a remote access policy in Windows Server 2003 IAS.

Figure 4-20. The Advanced tab for a remote access policy.

From the Advanced tab, you can set properties to specify the series of additional RADIUS attributes that are sent back to the RADIUS client by the IAS server. To add RADIUS attributes, click Add. You can select from the list of RADIUS attributes or select the Vendor-Specific attribute to configure RADIUS VSAs. The VSAs are saved with the profile settings for each policy.

For Windows Server 2003 IAS, the default attributes depend on your choices in the New Remote Access Policy Wizard. For wireless connections, the Service-Type attribute is set to Framed by default.

Authorizing Access with Remote Access Policy

There are two ways to use remote access policies to grant authorization, as described in the following sections.

Authorization by User

If you are managing authorization by user, set the remote access permission on the user or computer account to either Grant Access or Deny Access, and (optionally) create different remote access policies based on different types of connections. For example, you might want to have one remote access policy that is used for dial-up connections and a different remote access policy that is used for wireless connections. Managing authorization by user is recommended only when you have a small number of user or computer accounts to manage.

If you are managing authorization by user, the basic process for authorizing a connection attempt occurs as follows:

Authorization by Group

If you are managing authorization by group, set the remote access permission on the user account to Control Access Through Remote Access Policy, and create remote access policies that are based on different types of connections and group membership. For example, you might want to have one remote access policy for dial-up connections for employees (members of the Employees group) and a different remote access policy for dial-up connections for contractors (members of the Contractors group).

If you are managing authorization by group, the basic process for authorizing a connection attempt occurs as follows:

NOTE The Control Access Through Remote Access Policy remote access permission setting is available only on accounts that are members of a Windows 2000 native-mode Active Directory domain or a Windows Server 2003, Windows 2000 native, or Windows Server 2003 functional level domain.

IAS as a RADIUS Proxy

IAS can be used as a RADIUS proxy to provide the routing of RADIUS messages between RADIUS clients (access servers) and RADIUS servers that perform user authentication, authorization, and accounting for the connection attempt. When used as a RADIUS proxy, IAS is a central switching or routing point through which RADIUS access and accounting messages flow. IAS records information in an accounting log about the messages that are forwarded. Figure 4-21 shows IAS as a RADIUS proxy.

Figure 4-21. IAS as a RADIUS proxy.

When IAS is used as a RADIUS proxy between a RADIUS client and a RADIUS server, RADIUS messages for network access connection attempts are forwarded in the following way:

  1. Access servers such as dial-up network access servers, VPN servers, and wireless access points receive connection requests from access clients.

  2. The access server configured to use RADIUS as the authentication, authorization, and accounting protocol creates an Access-Request message and sends it to the IAS server that is being used as a RADIUS proxy.

  3. The IAS RADIUS proxy receives the Access-Request message and, based on the locally configured connection request policies, determines where to forward the Access-Request message.

  4. The IAS RADIUS proxy forwards the Access-Request message to the appropriate RADIUS server.

  5. The RADIUS server evaluates the Access-Request message.

  6. If required, the RADIUS server sends an Access-Challenge message to the IAS RADIUS proxy, where it is forwarded to the access server.

  7. The access server processes the challenge with the access client and sends an updated Access-Request to the IAS RADIUS proxy, where it is forwarded to the RADIUS server.

  8. The RADIUS server authenticates and authorizes the connection attempt.

  9. If the connection attempt is both authenticated and authorized, the RADIUS server sends an Access-Accept message to the IAS RADIUS proxy, where it is forwarded to the access server.

    If the connection attempt is either not authenticated or not authorized, the RADIUS server sends an Access-Reject message to the IAS RADIUS proxy, where it is forwarded to the access server.

  10. The access server completes the connection process with the access client and sends an Accounting-Request message to the IAS RADIUS proxy. The IAS RADIUS proxy logs the accounting data and forwards the message to the RADIUS server.

  11. The RADIUS server sends an Accounting-Response to the IAS RADIUS proxy, where it is forwarded to the access server.

You can use IAS as a RADIUS proxy under the following circumstances:

More Info For more information about using Windows Server 2003 IAS as a RADIUS proxy, see Windows Server 2003 Help and Support.

Connection Request Processing

To determine if a RADIUS client message should be processed locally or forwarded to another RADIUS server, a Windows Server 2003 IAS server uses connection request processing. Connection request processing is a combination of the following:

Connection Request Policies

Connection request policies are rules specifying conditions and profile settings that give you flexibility to configure how the IAS server handles incoming authentication and accounting request messages. With connection request policies, you can create a series of policies so that some RADIUS request messages are processed locally (IAS is being used as a RADIUS server), and other types of messages are forwarded to another RADIUS server (IAS is being used as a RADIUS proxy).

Connection request policies allow you to use IAS as a RADIUS server or as a RADIUS proxy, based on the time of day and day of the week, the realm name in the request, the type of connection being requested, the IP address of the RADIUS client, and so on.

It is important to remember that with connection request policies, a RADIUS request message is processed only if the settings of the incoming RADIUS request message match at least one of the connection request policies. For example, if the attributes of an incoming RADIUS Access-Request message do not match at least one of the connection request policies, an Access-Reject message is sent.

A connection request policy is a combination of the following:

Figure 4-22 shows the connection request policy properties for the default policy named Use Windows Authentication For All Users.

Figure 4-22. Properties of a connection request policy.

More Info For a complete list of conditions and their descriptions, see Windows Server 2003 Help and Support.

Authentication Tab

Figure 4-23 shows the Authentication tab for a connection request policy in Windows Server 2003 IAS.

Figure 4-23. The Authentication tab for a connection request policy.

From the Authentication tab, you can view and configure the following:

Accounting Tab

Figure 4-24 shows the Accounting tab for a connection request policy in Windows Server 2003 IAS, which determines how IAS handles RADIUS Accounting-Request messages.

Figure 4-24. The Accounting tab for a connection request policy.

From the Accounting tab, you can specify that RADIUS Accounting-Request messages are forwarded to another RADIUS server in a specified remote RADIUS server group. In this case, the IAS server is acting as a RADIUS proxy. IAS always records the accounting information for Accounting-Request messages based on remote access logging settings.

Attribute Tab

Figure 4-25 shows the Attribute tab for a connection request policy in Windows Server 2003 IAS.

Figure 4-25. The Attribute tab for a connection request policy.

From the Attribute tab, you can configure a set of find-and-replace rules that manipulate the text strings of one of the following attributes:

Find-and-replace rule processing occurs for one of the preceding attributes before the RADIUS message is subject to authentication and accounting settings. Configuring attribute manipulation for the User-Name attribute is equivalent to configuring realm replacement rules for Windows 2000 Server IAS.

If you use the MS-CHAP v2 authentication protocol, you cannot manipulate the User-Name attribute if the connection request policy is used to forward the RADIUS message. The only exception occurs when a backslash (\) character is used, and then the manipulation affects only the information to the left of it. A backslash character is typically used to indicate a domain name (the information to the left of the backslash character) and a user account name within the domain (the information to the right of the backslash character). In this case, only attribute manipulation rules that modify or replace the domain name are allowed.

NOTE Find-and-replace rules apply only to a single attribute. You cannot configure find-and-replace rules for each attribute, and you cannot add to the list of attributes available for manipulation.

Advanced Tab

Figure 4-26 shows the Advanced tab for a connection request policy in Windows Server 2003 IAS.

Figure 4-26. The Advanced tab for a connection request policy.

From the Advanced tab, you can set properties to specify the series of RADIUS attributes that are

Remote RADIUS Server Groups

A remote RADIUS server group is a named group that contains one or more RADIUS servers. When IAS is being used as a RADIUS proxy for RADIUS request messages, a remote RADIUS server group must be specified. This group is used to facilitate the common configuration of both a primary and at least one backup RADIUS server. You can specify various settings to either determine the order in which the servers are used or distribute the RADIUS messages across all servers in the group.

Figure 4-27 shows the properties of a remote RADIUS server group named RAD1.

Figure 4-27. The properties of a remote RADIUS server group.

After a remote RADIUS server group is configured, it can be specified in the authentication and accounting settings of a connection request policy; so you should configure a remote RADIUS server group first. Next, you can configure the connection request policy to use the newly configured remote RADIUS server group. Alternately, you can use the New Connection Request Policy Wizard to create a new remote RADIUS server group while you are creating the connection request policy.

NOTE Remote RADIUS server groups are separate from Windows groups.

Each server in a remote RADIUS server group has the following groups of properties:

Address Tab

Figure 4-28 shows the Address tab for a RADIUS server in a remote RADIUS server group in Windows Server 2003 IAS.

Figure 4-28. The Address tab for a RADIUS server in a remote RADIUS server group.

On the Address tab, you can configure the name or address of the RADIUS server. If you specify a name, you can click Verify to resolve the name and select the correct resolved address.

Authentication/Accounting Tab

Figure 4-29 shows the Authentication/Accounting tab for a RADIUS server in a remote RADIUS server group in Windows Server 2003 IAS.

From the Authentication/Accounting tab, you can view and configure the following:

Figure 4-29. The Authentication/Accounting tab for a RADIUS server in a remote RADIUS server group.

Load Balancing Tab

Figure 4-30 shows the Load Balancing tab for a RADIUS server in a remote RADIUS server group in Windows Server 2003 IAS.

Figure 4-30. The Load Balancing tab for a RADIUS server in a remote RADIUS server group.

From the Load Balancing tab, you can view and configure the following:

Related

Категории