Making Windows Network Policy Server work with VyOS/EdgeOS L2TP over IPSec VPN using Radius Auth

For those with the daunting task of connecting a VyOS or Ubiquiti EdgeOS device to a Windows Network Policy (NPS) for authentication via Radius for L2TP over IPsec , I present the following instructions:

  1. Setup your L2TP/IPSec server using local accounts first.
    Before diving into radius auth with Window’s NPS, make sure you’ve setup your L2TP/IPSec server using local accounts. Try the following tutorials to get this setup:

    1. EdgeMAX – Set up L2TP over IPsec VPN server – Ubiquiti …
    2. Set Up Vyatta / Vyos as an L2TP/IPsec VPN Server …
    3. L2TP/IPSec on a Ubiquiti EdgeMax | One Bad Pixel
  2. Install the Network Policy Server (NPS) Role
    Head on over to the Server Manager on the Windows 2008/2012 R2 Server that you would like to host the NPS role. This assumes that you have a full Active Directory domain setup.
  3. Add a new Radius Client
    Once you have the NPS role installed, head on over to Radius Clients to add a new Radius Client. Replace x.x.x.x with the internal IP address of your VyOS/EdgeOS device.
    Screen Shot 2015-03-05 at 3.43.09 AMScreen Shot 2015-03-05 at 3.42.47 AM
  4. Add new Connect Request Policy.
    Use the following¬†details when creating a new Connection Request Policy.¬†If you don’t see the setting in a screenshot, keep the default settings.
    Screen Shot 2015-03-05 at 3.40.53 AMScreen Shot 2015-03-05 at 3.41.17 AMScreen Shot 2015-03-05 at 3.41.34 AM
  5. Add new Network Policy
    The following details will help your EdgeOS/VyOS device authenticate correctly. If you don’t see the setting in a screenshot, keep the default settings.
    Screen Shot 2015-03-05 at 3.43.38 AMScreen Shot 2015-03-05 at 3.44.00 AMScreen Shot 2015-03-05 at 3.44.13 AMScreen Shot 2015-03-05 at 3.45.02 AM
  6. Enable Radius on VyOS/EdgeOS

    configure
    set vpn l2tp remote-access authentication mode 'radius'
    set vpn l2tp remote-access authentication radius-server x.x.x.x key '{shared secret here}'
    commit
  7. Enjoy your L2TP/IPSec VPN!
    Feel free to leave a comment if you feel like something isn’t right or not working.

Leave a Reply

Your email address will not be published. Required fields are marked *

 

Proudly powered by WordPress
Theme: Esquire by Matthew Buchanan.