Skip to main content

Configure RADIUS Clients settings

In this task, you'll add information for the RADIUS client to enable use with SecureAuth RADIUS. For example, Cisco VPN. This completes the process to set up the communication between SecureAuth RADIUS Server and the RADIUS client.

Add RADIUS Client

  1. In the SecureAuth RADIUS admin console, select the RADIUS Clients tab and click Add Client.

    radius_24_01_client_1.png
  2. In the Add RADIUS Client section, set the following:

    Client Name

    Enter a name for the RADIUS client.

    For example, Cisco.

    Identifier

    By default, the first identifier is IP Address. Add or remove identifiers and their values by clicking the + or icons to the right of each field.

    Identifiers are useful for restricting access, which enables additional control over the client configuration. For example, NAS-Port or Framed-IP-Address.

    For a complete list of identifiers available for you to add, see page 23 of RADIUS RFC.

    Value

    Enter the value that corresponds to the set Identifier.

    For the default IP Address Identifier, enter the IP Address to filter the RADIUS client. Typically, this is the NAS-IP address.

    You can use a wildcard to allow machines from only a specified subnet to connect. For example, 10.1.2.*.

    Learn more about How the SecureAuth RADIUS server processes rules when users attempt to connect via the RADIUS server.

    To filter the RADIUS client by the client IP address, and not the NAS-IP address, select the Use Client Source IP Address check box.

    RADIUS_add_client_1.png
  3. In the SecureAuth IdP Settings section, set the following:

    IdP Realm

    Select the Identity Platform realm to connect with SecureAuth RADIUS.

    Selections only include Authentication API realms added on the IdP Realms page of the SecureAuth RADIUS admin console.

    Authentication Workflow

    Select the same Login Workflow that you enabled on the realm to connect with SecureAuth RADIUS.

    The default workflow selection is Password | Second Factor.

    NOTE: Not all login workflows are supported by all RADIUS clients due to RADIUS client configuration limitations.

    Enable Adaptive Authentication

    Optional. Select this check box if you are using Adaptive Authentication.

    RADIUS End User IP

    This attribute is used to verify the end user's IP address. By default, Calling-Station-Id appears.

    If the RADIUS Client is Palo Alto Networks or Juniper Networks, edit the value of the field to one of the following:

    • For Palo Alto Networks, enter PaloAlto-Client-Source-IP.

    • For Juniper Networks, enter Tunnel-Client-Endpoint.

    NOTE: IP verification is only supported on Cisco, NetScaler, and Palo Alto Networks platforms.

    RADIUS_add_client_2.png
  4. Optional. The (Network Policy Server) NPS Proxy Configuration section is for organizations using MS-CHAPv2 with Cisco or NetScaler. To configure SecureAuth RADIUS as a proxy, set the following:

    IP Address

    Set to the IP of the NPS.

    For example, 10.81.1.45.

    Port

    Set to the port where the NPS will be listening.

    For example, 1823.

    RADIUS_add_client_3.png
  5. In the Data Attribute Mapping section, do the following:

    1. Click the + icon next to Add Attribute to map an attribute from the configured Identity Platform data store to the RADIUS client. This feature is often used with a VPN for making policy decisions.

      Value entry boxes appear.

      60574144.png
    2. Set the following:

      Note

      Only string values are supported for data attribute mapping.

      IdP Property

      By default auxId1 appears. Modify this entry to map a field or a User Group to a supported SecureAuth Identity property.

      This entry is case-sensitive.

      RADIUS Attribute

      Enter the name of the RADIUS client attribute that is mapped to the specified IdP Property.

      For example, Class.

      This entry is case-sensitive.

      60574142.png
    3. Click the + icon to add more attribute mappings or the ­­ icon to delete attribute mappings.

  6. In the Custom Attribute Mapping section, do the following:

    1. Click the + icon next to Add Attribute to map an attribute from the configured SecureAuth Identity Platform data store to a vendor specific attribute. This usually occurs in a scenario in which the VPN appliance is unable to perform an LDAP lookup.

      Value entry boxes appear.

    2. Set the following:

      Note

      The Attribute field is mandatory and must be set in this section or in the Static Value Mapping section.

      IdP Property

      By default auxId1 appears. Modify this entry to map a field or a User Group to a supported SecureAuth Identity Platform property.

      This entry is case-sensitive.

      Vendor ID

      Enter the numeric Vendor ID.

      Attribute

      Enter the numeric vendor specific attribute that is mapped to the specified IdP Property.

      Field Type

      Select the RADIUS attribute type. The options are:

      • string – variable-length string field used for printable text strings.

      • date – UNIX timestamp in seconds, as of January 1, 1970 GMT.

      • octets – variable-length string field used for binary data.

      • short – two-byte integer.

      • integer – unsigned 32-bit integer.

      • ipaddr – IPv4 address.

      • ipv6addr – IPv6 address.

      NOTE: The Field Type selection must be accurately defined in order to be accepted by the client.

      60574137.png
    3. Click the + icon to add more attribute mappings or the ­­ icon to delete attribute mappings.

  7. In the Static Value Mapping section, do the following:

    1. Click the + icon next to Add Attribute to map data to the RADIUS Vendor-Specific Attribute (VSA) configuration.

      Value entry boxes appear.

    2. Set the following:

      Note

      The Attribute field is mandatory and must be set in this section or in the Custom Attribute Mapping section.

      Static Value

      Enter the Static Value to map to the RADIUS attribute.

      Vendor ID

      Enter the numeric Vendor ID.

      Attribute

      Enter the numeric vendor specific attribute that is mapped to the specified Static Value.

      Field Type

      Select the RADIUS attribute type. The options are:

      • string – variable-length string field used for printable text strings.

      • date – UNIX timestamp in seconds, as of January 1, 1970 GMT.

      • octets – variable-length string field used for binary data.

      • short – two-byte integer.

      • integer – unsigned 32-bit integer.

      • ipaddr – IPv4 address.

      • ipv6addr – IPv6 address.

      NOTE: The Field Type selection must be accurately defined in order to be accepted by the client.

      60574130.png
    3. Click the + icon to add more attribute mappings or the ­­ icon to delete attribute mappings.

  8. Click Add Client after all client entries are made.

View RADIUS Client information

When you select the RADIUS Clients tab, the following information appears for each RADIUS client:

  • Client Name

  • IP Address – an asterisk ( * ) indicates the client IP will be mapped to all RADIUS client IPs configured.

  • Authentication Workflow

To view additional information, click the i icon next to the RADIUS client name. The following information appears:

RADIUS Client
  • Identifier – IP address or an asterisk ( * ) which indicates the client IP will be mapped to all RADIUS client IPs configured.

    In the following image, NAS-Port, NAS-Identifier, NAS-Port-Id, and Framed-IP-Address are examples of identifiers you can configure. For a complete list of identifiers, see page 23 in RADIUS RFC.

  • Date Created – Client creation date using the MM-DD-YYYY format.

  • Date Modified – Most recent client modification date using the MM-DD-YYYY format.

IdP Settings
  • IdP Realm – URL or realm number selected.

  • Workflow – one of eight selections made for this client (the default is Password | Second Factor).

  • Adaptive Authentication – "Active" or "Inactive" status depending on whether or not this feature is enabled.

Click Edit to update RADIUS Client information. See Edit or remove RADIUS Client for more information.

radius_24_01_client_4.png

Edit or remove RADIUS Client

  1. Select the RADIUS Clients tab.

  2. To edit a RADIUS Client, click the pencil icon next to it. Update any information that has changed for the client and click Save Changes.

    radius_24_01_client_2.png
  3. To disable a RADIUS Client, slide the toggle next to it to Off. Any request to the disabled client will be rejected and end users will not be able to log in.

    This action moves the client to the Disabled Clients list.

    Logs will show the message: RadiusSession: Radius client can't be found for IP: x.x.x.x.

    radius_24_01_client_3.png
  4. If the Client is disabled, the Remove Clients option becomes available. Do one of the following:

    • Slide the toggle to On to enable the client again for use with the realm and RADIUS server. This action removes the client from the Disabled Clients list and includes it in the Enabled Clients list.

    • To permanently remove the client from the Disabled Clients list and from the RADIUS server, click the pencil icon next to the Client. Click Remove Clients.

      60574122.png
  5. Click Save Changes.