# Stormshield

> Protect the Stormshield SSL VPN with Ironchip over RADIUS: create the network object, enable the captive portal, and set the RADIUS timeout.

URL: https://docs.ironchip.com/en/identidad/integraciones/red/stormshield/

This guide explains how to protect the **Stormshield** SSL VPN with Ironchip over [RADIUS](https://docs.ironchip.com/en/identidad/protocolos/radius/) through [NPS](https://docs.ironchip.com/en/identidad/integraciones/red/nps/).

## Requirements

- Access to the Ironchip admin console.
- A Windows server with the [NPS](https://docs.ironchip.com/en/identidad/integraciones/red/nps/) role installed.
- A RADIUS client created in NPS that points to the Stormshield IP, with its shared secret.
- A user with the permissions needed to make changes in Stormshield.

## Configure Stormshield

### Server configuration

Sign in as an administrator.

1. Go to **Objects > Network Objects**, click **+Add**, and create an object named `Ironchip`.
2. Go to **VPN > SSL VPN**.

   [Image: Configuration menu with VPN > SSL VPN selected]

3. In the **General** window, select **Enable SSL VPN**. In the same window, configure the application servers, web servers, and user profiles according to your needs.

   [Image: SSL VPN window with Enable SSL VPN selected]

4. Go to **Users > Authentication**. On the **General** tab, enable the **Captive Portal**.
5. On the **Available Methods** tab, click **Add an authentication method** and select **Radius**.

   [Image: Add an authentication method menu with the Radius option]

6. Under **Access to the server**, fill in the RADIUS configuration and click **Apply**:

   - **Server**: the network object that corresponds to the NPS server.
   - **Port**: the RADIUS port NPS listens on.
   - **Pre-shared Key**: the shared secret of the RADIUS client configured in NPS for Stormshield.

   If you have a second NPS server, configure it under **Backup server**.

   [Image: RADIUS configuration in Stormshield with Server, Port, and Pre-shared Key]

### RADIUS timeout

To configure the RADIUS timeout, run these commands:

```text
CONFIG AUTH RADIUS timeout=30000 retry=1 btimeout=30000 bretry=1
CONFIG AUTH ACTIVATE
```

## Verify the integration

Give users access to the application created in the Ironchip admin console. Sign in to the SSL VPN as one of them: after you enter your username and password, you are asked to authenticate with Ironchip.

## Troubleshooting

- **Authentication fails with a timeout**: check that you ran the [RADIUS timeout](#radius-timeout) commands (`timeout=30000` and `retry=1` for the primary and backup servers), to give the user time to respond to Ironchip.
- **The RADIUS server rejects the connection**: check that the Stormshield IP is configured as a RADIUS client in NPS and that the shared secret is the same in **Pre-shared Key** and in NPS.