NPS/RADIUS

Question 1

What are two policies found within the framework of the NPS that governs whether or not a client gets access to the network?

Answer 1

Connection Request Policies and Network Policies

Question 2

What does RADIUS stand for?

Answer 2

Remote Access Dial-In User Service.

Question 3

What is the difference between Connection Request Policies and Network Policies?

Answer 3

Connection Request Policies determine where a client’s authentication takes place, e.g., RADIUS server or locally.

Network Policies provides authorization to allow the VPN traffic.

Question 4

Even if the Network Policy Server role is not installed, a “lite” version of the NPS is installed with Remote Access. True or False?

Answer 4

True.

Question 5

Within the Connection Request Policies, the processing order is determined numerically starting with the lowest numbers. True or False?

Answer 5

True.

Question 6

Using the Routing and Remote Access tool, which policy can be configured?

Answer 6

Network policies.

Question 7

Which tab within the properties of a Connection Request policy, configures where authentication will take place for VPN clients?

Answer 7

Settings tab.

Question 8

When viewing the Connection Request Policy properties, which tab provides the option to enable or disable the policy?

Answer 8

Overview tab.

Question 9

Once a network policy is matched, no other network policies are considered. True or False?

Answer 9

True.

Question 10

How do you alter the order of Network Policies within the Network Policies list?

Answer 10

Right click on the policy and select “Move Up or Move Down”.

Question 11

Within a user’s account, what are their Dial-In properties set to by default?

Answer 11

Control access through NPS Network Policy

Question 12

A Network Policy can override a user’s Dial-In permissions if the proper box is checked within the Network Policies Overview tab. True or False?

Answer 12

True.

Question 13

Which role installs the Network Policy Server tool and turns a server into a NPS server?

Answer 13

Network Policy Server.

Question 14

How do you configure a RADIUS server?

Answer 14

1. Install the Network Policy and Access Services role
2. Within the NPS tool, utilize the Getting Started screen and choose, from the drop down list, what your going to be using the RADIUS server for (VPN, wireless, or wired connections).
3. For VPN connections, you’ll use the Configure VPN or Dial-Up Wizard.

As a result of the wizard, you’ll have created both Connection Request Policies and Network Policies for that connection (VPN/Dial-Up).

Question 15

How do you configure a RAS server to forward authentication requests to a centralized RADIUS server?

Answer 15

1. Navigate to: RAS server > NPS tool > Connection Request Polices > R-Click on policy > Settings tab > Authentication
2. Click on “New” (to create a new Security group for our RADIUS servers) and add each RADIUS server to the group.
3. Select the “Forward requests to the following remote RADIUS server group for authentication” radio button.

Question 16

What filter in Wireshark will only show RADIUS packets?

Answer 16

RADIUS (for the RADIUS protocol)

Question 17

The Network Access Server (NAS) or Remote Access Server (RAS) can forward authentication requests over to a centralized RADIUS server through a properly configured Connection Request Policy. True or False?

Answer 17

True.

Question 18

When using a connection request policy to forward authentication requests to a remote RADIUS server group, the RADIUS server will be used for the network policy for that connection. True or False?

Answer 18

True.

Question 19

What is a RADIUS proxy?

Answer 19

The middleman between the RADIUS server and the client.

Question 20

From the perspective of a device using a RADIUS proxy, the proxy appears as a RADIUS server. True or False?

Answer 20

True.

Question 21

By inserting a RADIUS proxy between the clients and the servers, it could help with a more even distribution of authentication requests to the actual servers. True or False?

Answer 21

True.

Question 22

RADIUS servers see the RADIUS proxies as _____.

Answer 22

Clients.

Question 23

How do we configure RADIUS proxies?

Answer 23

1. On the backend RADIUS server, navigate to NPS tool > RADIUS clients. Configure the RADIUS server to listen only for the IPs of the servers acting as RADIUS proxies.
2. On the RADIUS proxy, navigate to NPS tool > RADIUS Clients. Add the RADIUS client to the list by inputting their IP Address and the shared password.
3. Still within the NPS tool, add the RADIUS server group containing the RADIUS servers to the list in “Remote RADIUS Server Groups”. Each server will need to have the shared secret, IP Address, and optional load balancing settings configured to be added to the group.
4. On the proxy, configure it to forward authentication requests to the RADIUS server group by creating/editing a Connection Request Policy and, within the Authentication setting of the Settings tab, select the “Forward requests to the following remote RADIUS server group for authentication” radio button.
5. On the RADIUS client, navigate to the NPS tool > Remote RADIUS Server Groups > Add/Edit a RADIUS server group to point to the IP Address of the RADIUS proxy.

Question 24

What is the difference between Authentication, Authorization, and Accounting?

Answer 24

Authentication is defining who someone is.

Authorization is about what their authorized to do.

Accounting defines what they did.

Question 25

Where is the default log file location?

Answer 25

C:\Windows\System32\LogFiles

Question 26

How do you configure a RADIUS client to forward accounting data to the RADIUS server?

Answer 26

1. From the RADIUS client, within the NPS tool. Navigate to Connection Request Policies > Edit existing policy > Settings > Accounting.
2. Check the box that says “Forward accounting requests to this remote server group”.

Question 27

If a RAS server is sending accounting records to a centralized RADIUS server, it MUST also use that same server for authentication request processing as well. True or False?

Answer 27

False.

Question 28

To send accounting records to a separate RADIUS server, what is modified on a RADIUS client?

Answer 28

Connection Request Policy.