cancel
Showing results for 
Search instead for 
Did you mean: 

Psa 5000 and microsot nps Server

Highlighted
New Member

Psa 5000 and microsot nps Server

Hello i'm trying to configure a Microsoft nps server (radius) is there any documentation on how to do that cause i have errors and i don't understand why ...

6 REPLIES 6
Moderator

Re: Psa 5000 and microsot nps Server

I am not familiar with any specific NPS configuration guide. Which errors are you seeing? I know I have configured it in the past (that lab has been torn down so i don't have an easy way to go check). Are the errors on the PCS side or NPS side? i remember the NPS side being significantly more difficult to configure than some of the other RADIUS servers I have tested.
do other RADIUS clients complete authentication successfully?
Moderator
Moderator

Re: Psa 5000 and microsot nps Server

Please capture a dump on the VPN server, see if Access-Reject packets are being sent by the NPS server. If yes, please check the event log of the AD NPS to get some insight about the cause. Smiley Happy

Pulse Connect Secure Certified Expert
New Contributor

Re: Psa 5000 and microsot nps Server

Same problem here. TCPdump capture shows "Code: Access-Reject (3)" The event log shows Reason Code 49, Reason The RADIUS request did not match any configured connection request policy (CRP). I've tried changing the CRP to match on things like Client Name and Client IP Address (matching exactly to the values in the event in the Security log) but I keep getting the same error. I had a ticket open earlier where I was trying to match on the external IP of the PSA-5000 which was quickly corrected. The support engineer somehow got it working, but the next day it stopped working. This is extremely frustrating. There's got to be someone out there SUCCESSFULLY using Server 2016 NPS for RADIUS auth.

Moderator
Moderator

Re: Psa 5000 and microsot nps Server

Can you confirm what type of Network Access Server was selected on the CRP? Please set it to "Unspecified" and check the behavior.

 

image.png

 

Pulse Connect Secure Certified Expert
New Contributor

Re: Psa 5000 and microsot nps Server

I tried Unspecified but I'm still getting the same error. I have a case open with Microsoft. Hopefully they can figure it out.

New Contributor

Re: Psa 5000 and microsot nps Server

The supporter from Microsoft was able to get me up and running. MS has a dearth of documentation for getting this up and running with Pulse Secure.

 

To benefit anyone else who runs into this...don't use the wizard unless you're prepared to go back and edit both the CRP and Network Policies. I'd prefer to manually add and not have to go back and make changes. In the NPS console right-click on the CRP folder on the left. Give your policy a name, but leave the server type as Unspecified and click Next. Now set your condition. Since we allow all users VPN access I chose a Day and time restrictions set to...Permitted all days and times! Click Next and Next. Do NOT overide the authentication settings. Click Next twice more and Finish.

 

Right-click on the Network Policies folder to create a new policy. Give your policy a name and leave the serrver type as Unspecified. Click Next. Since we allow all users VPN access I added a condition for Windows Groups set to Domain Users. Click Next. Select Access granted and click Next. For configure authentication methods check off only PAP (uncheck MS-CHAP and MS-CHAPv2). No, I don't want to see the Help topic, I'm following your instructions. Accept the defaults for the next two screens, then click Finish.

 

Assuming you set up a user realm or two that uses the RADIUS auth server you set up and have assigned a sign-in page and set a unique URL. Then browse to the URL and sign in. You should see Event ID 6272 in the Network Policy and Access Server custom view, or directly in the Security log in Event Viewer. This indicates the NPS server granted access to the user.

 

I'm going to run this way for a few more days for testing before I install the NPS extension for Azure MFA.