将ASA的AAA-SERVER的RADIUS认证和WINDOWS2012结合,并且用IAS LOG VIEWER进行日志报告输出汇总...

昨天升级了ESX,为节约资源,进行服务器整合.

就涉及将ASA的AAA-SERVER的RADIUS认证和WINDOWS2012结合,并且用IAS LOG VIEWER进行日志报告输出.

ASA的调整如下:

ASA上配置如下

aaa-server ACS-Server protocol radius
aaa-server ACS-Server host
172.1.1.1
key 1234567890
并在tunnel-group中调用
tunnel-group internal1 type
ipsec-ra
tunnel-group internal1 general-attributes
address-pool
xxx
authentication-server-group ACS-Server
default-group-policy
xxxx
radius-common-pw 1234567890

WINDOWS2012新建NPS(以前的IAS)过程如下(分四步,思路不能乱A,注册NPS服务器,B,建立RADIUS客户端,C,创建一个连接请求策略,D,创建一个网络策略):

Registering the server.

1. After launching the NPS tool right-click on the entry NPS(Local) and click the Register Server in Active Directory.
2. Follow the default prompts.

Create a RADIUS client entry for the ASA.

1. Expand the RADIUS Clients and Servers folder.
2. Right-click on RADIUS Clients and select New RADIUS Client.
3. Create a Friendly Name for the ASA device. I used “CiscoASA” but if you had more than one you might want to make it more unique and identifiable. Make sure you document the Friendly Name used as it will be used later in some of the policies created.
4. Enter the Server Secret Key specified on during the ASA configuration in the Shared secret and Confirm shared secret field.
5. Leave the default values for the other settings and click OK. See Figure 1 for all the complete RADIUS Client properties.
   

Figure 1

Create a Connection Request Policy.

1. Expand the Policies folder.
2. Right-click on the Connection Request Policies and click New.
3. Set the Policy Nameto something meaningful. I used CiscoASA because this policy is geared specifically for that RADIUS client. Leave the Type of network access server as Unspecified and click Next.
4. Under Conditions click Add. Scroll down and select the Client Friendly Name condition and click Add…
5. Specify the friendly name that you used when creating the RADIUS Client above. Click OK and Next.
6. On the next two pages leave the default settings and click Next.
7. Under the Specify a Realm Name select the Attribute option on the left. From the drop down menu next to Attribute: on the right select User-Name. Click Next again.
8. Review the settings on the next page and click Finish.

Create a Network Policy.

1. Right-click the Network Policy folder and click New.
2. Set the Policy Name to something meaningful. Leave the Type of network access server as Unspecified and click Next.
3. Under Conditions click Add.
4. Add a UsersGroup condition to limit access to a specific AD user group. You can use a generic group like Domain Users or create a group specifically to restrict access.
5. Add a Client Friendly Name condition and again specify the Friendly Name you used for your RADIUS client.
6. Click Next. Leave Access granted selected and click Next again.
7. (Important Step) On the authentication methods leave the default selection and add Unencrypted authentication (PAP, SPAP).
8. Accept the default Constraints and click Next.
9. Accept the default Radius Settings and click Next. Review the settings and click Finish.

Restart the Network Policy Server service.

• • This may not be necessary, but I did this at various points and cannot be certain the above steps work without restarting the service.

测试如下:

1〉通过命令行测试。

ASA 5510# test aaa-server authentication vpngroup username user1 password passwd111 Server IP Address or name: 192.168.1.7 INFO: Attempting Authentication test to IP address <192.168.1.7> (timeout: 10 seconds) INFO: Authentication Successful

2>通过ASDM测试

Test Your RADIUS Authentication

The ASDM utility includes functionality to test RADIUS Authentication.

1. If necessary re-launch the ASDM utility.
2. Return to Configuration -> Remote Access VPN -> AAA Setup -> AAA Server Groups.
3. Select the new Server Group you created.
4. From the Servers in the Selected Group section highlight the server you created. Click the Test button on the right.
5. Select the Authentication radio button. Enter the Username and Password of a user that meets the conditions specified in the Network Policy created above then click OK.
6. If everything works as designed you should see something similar to:

而IAS LOG VIEWER的安装配置和以前一样,定位好LOG目录即可.

http://blog.sina.com.cn/s/blog_6840674701017nkr.html

http://fixingitpro.com/2009/09/08/using-windows-server-2008-as-a-radius-server-for-a-cisco-asa/

 

 

转载于:https://www.cnblogs.com/aguncn/archive/2013/04/15/3021744.html