Home
Contents
CLOSE
AuthLite Interactive Documentation
FEATURES: What can AuthLite Do? TOKEN TYPES: What "Factors" are supported? INSTALL: How and where to install AuthLite? CONFIGURE AuthLite for your needs CHOOSE USERS: Choose 2-factor Users ENFORCE 2-factor Logons ADMINISTER AuthLite Tokens LDAP logon support/enforcement VPN and RADIUS Configuration How to Log In Event Logging
CLOSE
New RADIUS client
New RADIUS client
Connection Request Policies
Connection Request Policies
New Network Policy
New Network Policy
Windows Groups
Windows Groups
Select group(s)
Select group(s)
Grant access
Grant access
Add PAP
Add PAP
Add Filter-Id
Add Filter-Id
Filter-Id = Watchguard group string
Filter-Id = Watchguard group string
  • Install the NPS role and the Network Policy Server feature on one or more member servers or DCs
  • In the Network Policy Server administrative tool, add a RADIUS client
  • It should match the *LAN* IP Address of your Watchguard, i.e. the IP address that will communicate to the RADIUS server
  • Make sure Connection Request Policies has "Use Windows authentication for all users" (default)
  • Create a new Network Policy for the watchguard VPN
  • Set a condition for the AD group(s) you would like to match to allow VPN access
  • Specify Access Granted
  • Add "Unencrypted authentication (PAP, SPAP)

Note: it is not *really* unencrypted; that dialog message is a hold-over from the old PPTP days when the tunnel security was tied to the password hashing protocol. These days the tunnel is encrypted by SSL, and the communication between the Watchguard and the RADIUS server is encrypted by the RADIUS shared secret.

  • In the Constraints dialog add a "Standard RADIUS Attribute"
  • Select Filter-Id
  • Enter the exact same string here that you set for the Group name *in the Watchguard* earlier, i.e. "SSL VPN Users".  This string doesn't necessarily correspond to an AD group, it is just the value that the Watchguard is set to look for