Step C: RADIUS Clients configuration

By default a single row appears populated with client information that can be modified in the Edit RADIUS Client section on the RADIUS Clients page:

  • Client Name – a friendly name for the client can be manually entered.

  • IP Address – asterisk ( * ) indicates the client IP will be mapped to all RADIUS client IPs configured. You can also use partial wildcards, for example, 1.1.*.*=1.1.0.0/16

  • Authentication Workflow – default workflow selection is Password | Second Factor.

Additionally, you can add and remove identifiers and their values by using the plus and minus icons to the right of each field. Identifiers are useful for restricting access, which enables additional control over the client configuration. For a complete list of identifiers available for you to add, see page 23 in RADIUS RFC.

Note

To view details about a client...

1. Click the "i" at the start of the row. A window displays the details about the RADIUS client.

RADIUS Client section shows:

  • Identifier – IP address or an asterisk ( * ) which indicates the client IP will be mapped to all RADIUS client IPs configured.

    In the following image, NAS-Port, NAS-Identifier, NAS-Port-Id, and Framed-IP-Address are examples of identifiers you can configure. For a complete list of identifiers, see page 23 in RADIUS RFC.

  • Date Created – Client creation date using the MM-DD-YYYY format.

  • Date Modified – Most recent client modification date using the MM-DD-YYYY format.

IdP Settings section shows:

  • IdP Realm – URL or realm number selected.

  • Workflow – one of eight selections made for this client (the default is Password | Second Factor).

  • Adaptive Authentication – "Active" or "Inactive" status depending on whether or not this feature is enabled.

2. Click Edit to go to the Edit RADIUS Client page, or click the "X" in the upper right corner to exit the window.

60574148.png
Add RADIUS Client

1. Click Add Client

60574146.png

2. Enter a friendly Client Name. For example: "Cisco".

3. Enter the IP Address, located under Identifier, to filter the RADIUS client. In general, the NAS-IP address should be entered.

However, to filter the RADIUS client by the client IP address, and not the NAS-IP address, then additionally enable Use Client Source IP Address.

TIP: You can use a wild card to allow machines from only a specified subnet to connect, as in this example: 10.1.2.*

SecureAuth IdP Settings

4. Select the SecureAuth IdP Realm from the dropdown.

Selections only include Authentication API realms added on the IdP Realms page.

5. Select the Authentication Workflow from the dropdown – this must match a workflow configured and enabled on the realm selected in step 4:

  • Password | Second Factor

  • Password & Mobile Login Request (Approve / Deny)

  • Password Only

  • One-Time Passcode (TOTP/HOTP) Only

  • One-Time Passcode / Password

  • Password | One-Time Passcode (TOTP/HOTP)

  • One-Time Passcode (TOTP/HOTP) | Password

  • Username | Second Factor

  • Username | Second Factor | Password

  • PIN + OTP

  • Password & One-Time Passcode (TOTP/HOTP)

  • Yubico OTP Only

  • Password | Yubico OTP

  • Username | Fingerprint

  • Username | Face Recognition

NOTE: Not all authentication workflows are supported by all RADIUS clients due to RADIUS client configuration limitations. See Multi-Factor Methods configuration for links to versions of documents that explain how to configure realms for the supported authentication workflows.

6. OPTIONAL: If using Adaptive Authentication, check Enable Adaptive Authentication.

6a. Calling-Station-Id appears by default in the RADIUS End User IP field. This attribute is used to verify the end user's IP address.

6b. Edit the value in this field if using Palo Alto Networks or Juniper Networks platforms:

    • For Palo Alto Networks, enter PaloAlto-Client-Source-IP

    • For Juniper Networks, enter Tunnel-Client-Endpoint

NOTE: IP verification is only supported on Cisco, NetScaler, and Palo Alto Networks platforms.

7. Data Attribute Mapping is used to map an attribute from the configured SecureAuth IdP Data Store to the RADIUS client – this feature is often used with a VPN for making policy decisions.

NOTE: Only string values are supported for data attribute mapping.

Note

To add a row and map a data attribute...

7a. Click the "+" button preceding Add Attribute.

60574144.png

7b. By default auxId1 appears under IdP Property. Modify this entry to map a field or a User Group to a supported SecureAuth IdP Property; this entry is case-sensitive.

7c. For RADIUS Attribute, enter the name of the RADIUS client attribute (for example, Class) that is mapped to the SecureAuth IdP Property specified in step 7b; this entry is case-sensitive.

60574142.png

7d. To map another attribute, click the "+" button at the end of the last row; this action adds a new row below.

60574140.png

NOTE: To remove a row from the Data Attribute Mapping table, click the "-" button at the end of the row to be removed.

60574138.png

8. Custom Attribute Mapping is used to map an attribute from the configured SecureAuth IdP Data Store to a vendor specific attribute – this usually occurs in a scenario in which the VPN appliance is unable to perform an LDAP lookup.

The Attribute field is mandatory and must be set in this step or in the Static Value Mapping in step 9.

Note

To add a row and map a custom attribute...

8a. Click the "+" button preceding Add Attribute.

8b. By default auxId1 appears under IdP Property. Modify this entry to map a field or a User Group to a supported SecureAuth IdP Property; this entry is case-sensitive.

8c. Enter the numeric Vendor ID.

8d. Enter the numeric Vendor-Specific Attribute that is mapped to the SecureAuth IdP Property specified in step 8b.

8e. Select the RADIUS attribute type from the Field Type dropdown:

  • string – variable-length string field used for printable text strings.

  • date – UNIX timestamp in seconds, as of January 1, 1970 GMT.

  • octets – variable-length string field used for binary data.

  • short – two-byte integer.

  • integer – unsigned 32-bit integer.

  • ipaddr – IPv4 address.

  • ipv6addr – IPv6 address.

60574137.png

NOTE: The Field Type selection must be accurately defined in order to be accepted by the client.

8f. To map another attribute, click the "+" button at the end of the last row; this action adds a new row below.

60574134.png

NOTE: To remove a row from the Custom Attribute Mapping table, click the "-" button at the end of the row to be removed.

60574132.png

9. Static Value Mapping is used to map data to the RADIUS Vendor-Specific Attribute (VSA) configuration.

The Attribute field is mandatory and must be set in this step or in Custom Attribute Mapping in step 8.

Note

To add a row and map a static value attribute...

9a. Click the "+" button preceding Add Attribute.

9b. Enter a Static Value to be mapped to the RADIUS Attribute.

9c. Enter the numeric Vendor ID.

9d. Enter the numeric Vendor-Specific Attribute that is mapped to the Static Value specified in step 9b.

9e. Select the RADIUS attribute type from the Field Type dropdown:

  • string – variable-length string field used for printable text strings.

  • date – UNIX timestamp in seconds, as of January 1, 1970 GMT.

  • octets – variable-length string field used for binary data.

  • short – two-byte integer.

  • integer – unsigned 32-bit integer.

  • ipaddr – IPv4 address.

  • ipv6addr – IPv6 address.

60574130.png

NOTE: The Field Type selection must be accurately defined in order to be accepted by the client.

9f. To map another attribute, click the "+" button at the end of the last row; this action adds a new row below.

NOTE: To remove a row from the Static Value Mapping table, click the "-" button at the end of the row to be removed.

10. Click Add Client after all client entries are made, or click Cancel to return to the RADIUS Clients page without adding a client.

60574129.png