# Microsoft NPS

> Protect Microsoft NPS with the Ironchip plugin: create the network policy, install the plugin, register the application, and test RADIUS access with NTRadPing.

URL: https://docs.ironchip.com/en/identidad/integraciones/red/nps/

NPS (Network Policy Server) lets you create and apply network access policies for the authentication and authorization of connection requests across the organization. Use this guide to protect it with Ironchip over [RADIUS](https://docs.ironchip.com/en/identidad/protocolos/radius/), so that you can use Ironchip in other services, such as RDP or VPN.

## Requirements

- A functional Active Directory.
- DHCP and DNS services active. If you do not have them, see [Prepare the Windows environment](https://docs.ironchip.com/en/identidad/integraciones/puestos/rdp/#prepare-the-windows-environment).
- An HTTP-MFA integration (MFA application) created in Ironchip. See [Create an HTTP-MFA integration](https://docs.ironchip.com/en/identidad/administracion/aplicaciones/#create-an-http-mfa-integration).

## Configure Ironchip

1. In the admin console, create the application that references the HTTP-MFA integration. In **External ID**, enter the name of the network policy you will protect with the plugin (in this guide, `IronchipProtected`) and click **Add service**.

   [Image: Add a new application window with the HTTP_MFA configuration and the External ID]

2. Save the API key that Ironchip shows when you create the application. It only appears this once, and you need it to install the plugin.
3. Add users to that application, using the format `Domain\User`.

Video: [Create the Ironchip application and add users for NPS](https://play.hubspotvideo.com/v/7745202/id/130733054997)

## Configure Microsoft NPS

### Install NPS on the server

Install the **Network Policy and Access Services** role from **Add roles and features**.

### Create the network policy

1. Open the Network Policy Server. On the **Policies** tab, right-click **Network Policies** and create a new policy.

   [Image: Context menu to create a new network policy]

2. Give it an identifying name and click **Next**. You use this name when you install the NPS plugin to determine which policy to protect.

   [Image: Network policy name]

3. Select the user group the policy applies to.

4. On the next tab, leave **Access granted** selected.

   [Image: Access granted option]

5. Configure the authentication methods the policy uses and click **Next**.

   [Image: Authentication methods of the policy]

6. Configure the constraints that automatically deny access if they are not met. Complete it with the options you want and click **Next**.

   [Image: Policy constraints]

7. Add the settings that apply when the policy constraints are met, and click **Next**.

   [Image: Policy settings]

8. Review the summary of the configuration and click **Finish**.

   [Image: Network policy summary]

The network policy is created. You can now install the NPS plugin.

[Image: Network policy added in the Network Policy Server]

### Install the NPS plugin

1. In the **Plugins** section of the Ironchip admin console, find **Windows NPS** and click **Download**.

   [Image: Plugins section of the console with the Windows NPS plugin download]

2. Run the installer.

   [Image: Plugin installer start screen]

3. Click **Next**, accept the terms of use, and click **Next** again.

   [Image: Installer terms of use]

4. Complete the next screen and click **Next**:

   - **Ironchip Host**: your Ironchip host. If you use the cloud solution, it is `api.ironchip.com`; otherwise, enter your custom host.
   - **Ironchip API Key**: your company's API key, which you got when you created the service.
   - **NPS Policies**: the name of the network policy you want to protect with Ironchip NPS. In the example, it is the policy you created, `IronchipProtected`. To add more than one, separate the names with commas.

   [Image: Host, API key and network policy fields]

5. With all parameters correct, click **Install**.

   [Image: Installation confirmation screen]

6. When the installation succeeds, click **Finish**.

   [Image: Installation completed]

Install the `https://api.ironchip.com` certificate on every device that will use this service.

### Install on Windows Server 2008 and Windows Server 2012

Before you install the Ironchip NPS plugin on these versions, you need to install JDK and .NET (our team provides these components) and change the format of the Ironchip certificate so that it is accepted.

#### Install the JDK

1. Open the program and click **Next**.
2. Accept the terms of the agreement and click **Next** again.
3. The next window lets you customize the installation. The default configuration is enough, so just click **Next**.
4. Click **Install**.
5. When the installation finishes, click **Finish**.

#### Install .NET

This step is optional on Windows Server 2012.

1. Run the program, accept the terms and conditions, and click **Install**.
2. When the installation finishes, click **Finish**.

#### Change the format of the Ironchip certificate

1. Open `api.ironchip.com` in your browser (any browser works).
2. Click **Not secure** and then **The certificate is not valid**.
3. In the next window, go to **Details** and click **Copy to File…**.
4. Choose the third option and select **Include all certificates in the chain if possible**. Click **Next**.
5. In the new window, click **Next**.
6. Choose the path where you want to export the certificate and the name for the file. Click **Next**.
7. When the export finishes, click **Finish**.

The certificate is now on your computer in the right format. Import it next:

1. Search for `mmc` in the program search and open it.
2. Choose **File** and then **Add/Remove Snap-ins**.
3. Select **Certificates** and click **Add**.
4. Choose **Computer account** and click **Next**.
5. Choose the first option shown and click **Finish**.
6. Under **Console Root**, click **Certificates (Local Computer)** and choose **Trusted Root Certification Authorities**.
7. Expand the **Certificates** folder inside it. In the rightmost pane, choose **More Actions**, then **All Tasks**, and then **Import**.
8. Choose the location where you exported the certificate. Select the right extension: choose **All Files (\*.\*)**. Click **Next**.
9. In the next window, click **Next** again.
10. Check the import summary and click **Finish**.
11. When you see the successful import message, click **OK**.

## Verify the integration

### Check the plugin logs

1. Open the **Event Viewer** to see the Ironchip NPS plugin logs.
2. If everything is OK, you see **NPSP Ironchip Plugin** in the list of applications and services logs. Click it. If the plugin is installed, the logs show `Ironchip NPS plugin initialized successfully.`

:::note
If you get the message `Unable to load IronChip license key.`, check that it is the correct license and try again. If the problem persists, contact Ironchip support.
:::

### Test RADIUS access with NTRadPing

To check that everything is configured correctly and working, use the third-party tool NTRadPing.

[Image: NTRadPing application]

1. Download the application from [NTRadPing](https://ntradping.apponic.com/).
2. Create a RADIUS client so that you can run the test: open the Network Policy Server, go to **RADIUS Clients and Servers**, and create a new one by right-clicking **RADIUS Clients**.

   [Image: Context menu to create a RADIUS client]

3. In the panel that opens, enter this data:

   1. An identifying name for the RADIUS client.
   2. The IP of the server where you will install it.
   3. A secret key for RADIUS.

   [Image: RADIUS client properties panel]

4. Restart the service to apply the settings.
5. Open NTRadPing and fill in the fields:

   1. IP of your server.
   2. Port to connect to (default is `1645`).
   3. Time before aborting and how many times it runs.
   4. The user's password.
   5. The RADIUS server key.
   6. The user to use.

   [Image: NTRadPing fields filled in]

### Video tutorial

Video: [Ironchip with NPS tutorial](https://play.hubspotvideo.com/v/7745202/id/145774813226)

## Troubleshooting

Each section quotes the message exactly as the plugin shows it and explains what it means.

### "User XXX is not authenticated in service XXX. Please, try again."

The user is not authenticated, or the authentication was not valid. Try the authentication again on the same page.

### "Unable to load IronChip license key"

The full message is: "Unable to load IronChip license key. Check that it is the correct license and try again. If problem persist contact IronChip support for help."

The license format is not valid. Email [info@ironchip.net](mailto:info@ironchip.net) with the error. We validate the license key you used and give you a valid one if it is not valid.

### "Event ID 4402: There is no domain controller available for the domain"

You do not need to rename your domain or roll back. You can resolve this issue by adding the following registry key, which forces authentication to use the DNS name instead of the NetBIOS name:

- New string value (`REG_SZ`): `Default Domain`.
- Data: `example.loc` (or `example.domain.loc`).

### "The API-Key provided is not valid"

The full message is: "The API-Key provided is not valid. Please, contact IronChip support and send logs for assistance."

The license has the correct format, but it is old or invalid. Email [info@ironchip.net](mailto:info@ironchip.net) with the error. We validate the license key you used and give you a valid one if it is not valid.

### "Ironchip has failed. Sorry."

The full message is: "Ironchip has failed. Sorry. Contact support to allow us to solve the problem."

Something unexpected happened. Contact Ironchip support at [info@ironchip.net](mailto:info@ironchip.net) and attach the error log printed in the Ironchip MFA logs in Event Viewer.