Microsoft NPS

NPS (Network Policy Server) lets you create and apply network access policies for the authentication and authorization of connection requests across the organization. Use this guide to protect it with Ironchip over RADIUS, so that you can use Ironchip in other services, such as RDP or VPN.

Ironchip NPS pluginlatest version v1.0.1, released on November 15, 2024

• ironchip_nps_plugin.msi 13.7 MB

All versions and their release notes

Requirements

• A functional Active Directory.
• DHCP and DNS services active. If you do not have them, see Prepare the Windows environment.
• An HTTP-MFA integration (MFA application) created in Ironchip. See Create an HTTP-MFA integration.

Configure Ironchip

1. In the admin console, create the application that references the HTTP-MFA integration. In External ID, enter the name of the network policy you will protect with the plugin (in this guide, IronchipProtected) and click Add service.

   

2. Save the API key that Ironchip shows when you create the application. It only appears this once, and you need it to install the plugin.

3. Add users to that application, using the format Domain\User.

Create the Ironchip application and add users for NPSPlay video

Configure Microsoft NPS

Install NPS on the server

Install the Network Policy and Access Services role from Add roles and features.

Create the network policy

1. Open the Network Policy Server. On the Policies tab, right-click Network Policies and create a new policy.

   

2. Give it an identifying name and click Next. You use this name when you install the NPS plugin to determine which policy to protect.

   

3. Select the user group the policy applies to.

4. On the next tab, leave Access granted selected.

   

5. Configure the authentication methods the policy uses and click Next.

   

6. Configure the constraints that automatically deny access if they are not met. Complete it with the options you want and click Next.

   

7. Add the settings that apply when the policy constraints are met, and click Next.

   

8. Review the summary of the configuration and click Finish.

   

The network policy is created. You can now install the NPS plugin.

Install the NPS plugin

1. In the Plugins section of the Ironchip admin console, find Windows NPS and click Download.

   

2. Run the installer.

   

3. Click Next, accept the terms of use, and click Next again.

   

4. Complete the next screen and click Next:

   • Ironchip Host: your Ironchip host. If you use the cloud solution, it is api.ironchip.com; otherwise, enter your custom host.
   • Ironchip API Key: your company’s API key, which you got when you created the service.
   • NPS Policies: the name of the network policy you want to protect with Ironchip NPS. In the example, it is the policy you created, IronchipProtected. To add more than one, separate the names with commas.

   

5. With all parameters correct, click Install.

   

6. When the installation succeeds, click Finish.

   

Install the https://api.ironchip.com certificate on every device that will use this service.

Install on Windows Server 2008 and Windows Server 2012

Before you install the Ironchip NPS plugin on these versions, you need to install JDK and .NET (our team provides these components) and change the format of the Ironchip certificate so that it is accepted.

Install the JDK

1. Open the program and click Next.
2. Accept the terms of the agreement and click Next again.
3. The next window lets you customize the installation. The default configuration is enough, so just click Next.
4. Click Install.
5. When the installation finishes, click Finish.

Install .NET

This step is optional on Windows Server 2012.

1. Run the program, accept the terms and conditions, and click Install.
2. When the installation finishes, click Finish.

Change the format of the Ironchip certificate

1. Open api.ironchip.com in your browser (any browser works).
2. Click Not secure and then The certificate is not valid.
3. In the next window, go to Details and click Copy to File….
4. Choose the third option and select Include all certificates in the chain if possible. Click Next.
5. In the new window, click Next.
6. Choose the path where you want to export the certificate and the name for the file. Click Next.
7. When the export finishes, click Finish.

The certificate is now on your computer in the right format. Import it next:

1. Search for mmc in the program search and open it.
2. Choose File and then Add/Remove Snap-ins.
3. Select Certificates and click Add.
4. Choose Computer account and click Next.
5. Choose the first option shown and click Finish.
6. Under Console Root, click Certificates (Local Computer) and choose Trusted Root Certification Authorities.
7. Expand the Certificates folder inside it. In the rightmost pane, choose More Actions, then All Tasks, and then Import.
8. Choose the location where you exported the certificate. Select the right extension: choose All Files (*.*). Click Next.
9. In the next window, click Next again.
10. Check the import summary and click Finish.
11. When you see the successful import message, click OK.

Verify the integration

Check the plugin logs

1. Open the Event Viewer to see the Ironchip NPS plugin logs.
2. If everything is OK, you see NPSP Ironchip Plugin in the list of applications and services logs. Click it. If the plugin is installed, the logs show Ironchip NPS plugin initialized successfully.

Note

If you get the message Unable to load IronChip license key., check that it is the correct license and try again. If the problem persists, contact Ironchip support.

Test RADIUS access with NTRadPing

To check that everything is configured correctly and working, use the third-party tool NTRadPing.

1. Download the application from NTRadPing.

2. Create a RADIUS client so that you can run the test: open the Network Policy Server, go to RADIUS Clients and Servers, and create a new one by right-clicking RADIUS Clients.

   

3. In the panel that opens, enter this data:

   1. An identifying name for the RADIUS client.
   2. The IP of the server where you will install it.
   3. A secret key for RADIUS.

   

4. Restart the service to apply the settings.

5. Open NTRadPing and fill in the fields:

   1. IP of your server.
   2. Port to connect to (default is 1645).
   3. Time before aborting and how many times it runs.
   4. The user’s password.
   5. The RADIUS server key.
   6. The user to use.

   

Video tutorial

Ironchip with NPS tutorialPlay video

Troubleshooting

Each section quotes the message exactly as the plugin shows it and explains what it means.

“User XXX is not authenticated in service XXX. Please, try again.”

The user is not authenticated, or the authentication was not valid. Try the authentication again on the same page.

“Unable to load IronChip license key”

The full message is: “Unable to load IronChip license key. Check that it is the correct license and try again. If problem persist contact IronChip support for help.”

The license format is not valid. Email info@ironchip.net with the error. We validate the license key you used and give you a valid one if it is not valid.

“Event ID 4402: There is no domain controller available for the domain”

You do not need to rename your domain or roll back. You can resolve this issue by adding the following registry key, which forces authentication to use the DNS name instead of the NetBIOS name:

• New string value (REG_SZ): Default Domain.
• Data: example.loc (or example.domain.loc).

“The API-Key provided is not valid”

The full message is: “The API-Key provided is not valid. Please, contact IronChip support and send logs for assistance.”

The license has the correct format, but it is old or invalid. Email info@ironchip.net with the error. We validate the license key you used and give you a valid one if it is not valid.

“Ironchip has failed. Sorry.”

The full message is: “Ironchip has failed. Sorry. Contact support to allow us to solve the problem.”

Something unexpected happened. Contact Ironchip support at info@ironchip.net and attach the error log printed in the Ironchip MFA logs in Event Viewer.