Network Policy Server (NPS) is a crucial component in Windows Server environments, especially for organizations prioritizing robust network access control and security. This article provides an in-depth overview of NPS, exploring its functionalities as a RADIUS server and proxy, its diverse applications, and its configuration within Windows Server. Whether you are managing a small business network or a large enterprise infrastructure, understanding NPS is essential for maintaining a secure and efficiently managed network environment.
Understanding Network Policy Server (NPS)
Network Policy Server (NPS), a feature within Windows Server’s Network Policy and Access Services (NPAS), is designed to centralize the management of network access policies across an organization. It acts as a central point for connection authentication and authorization requests, ensuring consistent security protocols are applied whenever users or devices attempt to connect to the network.
NPS’s versatility extends to its role as a Remote Authentication Dial-In User Service (RADIUS) proxy. In this capacity, it can forward connection requests to other RADIUS servers, whether they are remote NPS instances or servers from different vendors. This proxy functionality is invaluable for load balancing connection requests and directing them to the appropriate domain for authentication and authorization.
Key capabilities of NPS include:
- Centralized Authentication, Authorization, and Accounting (AAA): NPS simplifies network access management by providing a single platform to configure and oversee authentication, authorization, and accounting policies.
- RADIUS Server and Proxy Functionality: NPS can operate as both a RADIUS server, directly handling authentication requests, and a RADIUS proxy, forwarding requests to other servers as needed.
- Support for Diverse Network Access Types: NPS accommodates various network access methods, including wireless, VPN, dial-up, authenticating switches, and router-to-router connections.
It’s important to note that Network Access Protection (NAP), along with related features like Health Registration Authority (HRA) and Host Credential Authorization Protocol (HCAP), are not available in Windows Server 2016 and later versions. Organizations relying on NAP in older systems should consider alternative solutions when upgrading to newer Windows Server versions.
NPS offers flexible deployment options. A single Nps Server can be configured to function as a RADIUS server for VPN connections while simultaneously acting as a RADIUS proxy, forwarding specific requests to a remote RADIUS server group for authentication in another domain. This adaptability makes NPS a powerful tool for diverse network environments.
NPS Functionality Across Windows Server Editions
The features available within NPS can vary based on the Windows Server edition in use.
Windows Server Standard/Datacenter Editions
In Windows Server 2016, 2019, and later Standard or Datacenter editions, NPS provides full functionality, allowing for the configuration of an unlimited number of RADIUS clients and remote RADIUS server groups. Furthermore, these editions support specifying RADIUS clients using IP address ranges, simplifying the management of large networks.
It’s worth mentioning that the Network Policy and Access Services feature, which includes NPS, is not available on Server Core installations of Windows Server.
Delving Deeper: RADIUS Server and Proxy Roles
NPS’s core strength lies in its dual capability as both a RADIUS server and a RADIUS proxy. Understanding these roles is key to leveraging NPS effectively.
NPS as a RADIUS Server
NPS is Microsoft’s implementation of the RADIUS protocol, a standard defined by the Internet Engineering Task Force (IETF). As a RADIUS server, NPS centralizes authentication, authorization, and accounting for various network access types. This includes:
- Wireless network access
- Authenticated switch connections
- Dial-up and VPN remote access
- Router-to-router connections
NPS integrates seamlessly with Windows Server environments and is compatible with a wide array of network equipment, including wireless access points, switches, VPN gateways, and remote access servers.
For detailed guidance on deploying NPS as a RADIUS server, refer to dedicated resources on Deploying Network Policy Server.
NPS leverages Active Directory Domain Services (AD DS) or the local Security Accounts Manager (SAM) database to authenticate user credentials. When NPS is part of an AD DS domain, it utilizes the domain’s directory service for user account information, contributing to a single sign-on experience. This unified credential system simplifies network access control and domain logon.
It’s important to note that NPS uses both user account dial-in properties and network policies to determine connection authorization, offering granular control over network access.
Organizations and Internet Service Providers (ISPs) benefit significantly from NPS as a RADIUS server, especially when managing diverse network access types. The RADIUS protocol enables centralized administration, regardless of the network equipment vendor. RADIUS operates on a client-server model, where network access devices (RADIUS clients) forward authentication and accounting requests to the NPS RADIUS server.
The RADIUS server validates user credentials against its user account database. Upon successful authentication and authorization based on defined conditions, the server grants network access and logs connection details for accounting purposes. This centralized approach simplifies management and enhances security by consolidating user authentication, authorization, and accounting data in one location.
Scenarios for Utilizing NPS as a RADIUS Server
Consider using NPS as a RADIUS server in these scenarios:
- Centralized User Account Database: When using AD DS or the local SAM database for user accounts.
- Centralized Management for Remote Access: For managing multiple dial-up, VPN servers, or demand-dial routers, centralizing network policy configuration, logging, and accounting.
- Outsourced Network Access: When outsourcing dial-up, VPN, or wireless access to a service provider, and access servers use RADIUS for authentication and authorization.
- Heterogeneous Access Server Environment: For centralizing AAA for diverse access servers from different vendors.
Alt text: Diagram illustrating NPS functioning as a RADIUS server, managing authentication requests from various access clients like Wireless Access Points, VPN Servers, and Routers.
NPS as a RADIUS Proxy
In its role as a RADIUS proxy, NPS forwards authentication and accounting messages to other RADIUS servers. It acts as a central routing point for RADIUS traffic between network access servers (RADIUS clients) and RADIUS servers responsible for user authentication, authorization, and accounting.
When functioning as a RADIUS proxy, NPS logs information about forwarded messages for accounting purposes. This proxy role is particularly useful in complex network environments.
Scenarios for Utilizing NPS as a RADIUS Proxy
Consider using NPS as a RADIUS proxy in these situations:
- Service Provider for Multiple Customers: If you are a service provider offering outsourced network access to multiple clients. The NPS RADIUS proxy can route connection requests to the appropriate RADIUS server based on the user’s realm.
- Authentication Across Untrusted Domains or Forests: To authenticate users in untrusted domains, one-way trusted domains, or different forests. NPS proxy can forward requests to the correct domain based on the username’s realm.
- Non-Windows Account Databases: For authentication against databases other than Windows account databases, such as NDS or SQL databases. Requests can be forwarded to RADIUS servers that interface with these databases.
- Load Balancing for Connection Requests: To distribute a large volume of connection requests across multiple RADIUS servers. The NPS proxy dynamically balances the load, enhancing performance and resilience.
- Simplified Firewall Configuration for Outsourced Services: To minimize intranet firewall configuration when providing RADIUS authentication for outsourced service providers. Placing an NPS proxy in the perimeter network reduces the firewall rules needed compared to using a full NPS server.
It’s crucial to remember that while NPS supports cross-forest authentication without a RADIUS proxy in certain scenarios (Windows Server 2003 forest functional level or higher with two-way trust), using a RADIUS proxy is mandatory for cross-forest authentication when employing certificate-based authentication methods like EAP-TLS or PEAP-TLS.
Alt text: Diagram depicting NPS operating as a RADIUS proxy, routing authentication requests from RADIUS clients to various RADIUS servers.
By utilizing NPS, organizations can outsource remote access infrastructure to service providers while maintaining control over user authentication, authorization, and accounting policies.
NPS configurations can be tailored for various scenarios, including:
- Wireless network access
- Organization-managed dial-up or VPN remote access
- Outsourced dial-up or wireless access services
- Internet access control
- Authenticated access to extranet resources for business partners
NPS Configuration Examples: RADIUS Server and Proxy
Here are examples illustrating different NPS configurations:
-
NPS as a RADIUS Server (Default Configuration): NPS operates solely as a RADIUS server, processing all connection requests locally using the default connection request policy. It authenticates and authorizes users within its domain and trusted domains.
-
NPS as a RADIUS Proxy (Forwarding to Untrusted Domains): NPS functions as a RADIUS proxy, forwarding requests to remote RADIUS server groups in untrusted domains. The default policy is removed, and new policies direct requests to specific untrusted domains. No local processing occurs.
-
NPS as Both RADIUS Server and Proxy (Hybrid Configuration): NPS acts as both. The default policy handles local requests, while an additional “Proxy policy” forwards requests to an untrusted domain. Policy order is crucial, with the Proxy policy evaluated first.
-
NPS as RADIUS Server with Remote Accounting: NPS handles authentication and authorization locally but forwards RADIUS accounting messages to a remote RADIUS server group.
-
NPS with Remote RADIUS to Windows User Mapping: NPS serves as both a RADIUS server and proxy for each request. Authentication is forwarded to a remote RADIUS server, but authorization uses a local Windows user account. This requires configuring “Remote RADIUS to Windows User Mapping” and creating local user accounts matching remote accounts.
Configuring NPS: Standard and Advanced Methods
NPS configuration can be approached through two primary methods: standard and advanced.
Standard Configuration (Wizards)
Standard configuration utilizes wizards within the NPS console to simplify setup for common scenarios:
- RADIUS server for dial-up or VPN connections
- RADIUS server for 802.1X wireless or wired connections
To use standard configuration, open the NPS console and select one of these scenarios to launch the corresponding wizard.
Advanced Configuration (Manual Setup)
Advanced configuration allows for manual setup of NPS as either a RADIUS server or proxy, offering greater customization.
To access advanced configuration, open the NPS console and expand the “Advanced Configuration” section.
Configuring NPS as a RADIUS Server (Advanced)
Setting up NPS as a RADIUS server in advanced configuration involves configuring:
- RADIUS clients (network access devices)
- Network policies (access control rules)
- RADIUS accounting (logging and auditing)
Detailed instructions for these configurations are available in dedicated documentation on configuring RADIUS server settings.
Configuring NPS as a RADIUS Proxy (Advanced)
Configuring NPS as a RADIUS proxy in advanced mode requires setting up:
- RADIUS clients
- Remote RADIUS server groups (defining target RADIUS servers)
- Connection request policies (routing rules for requests)
Specific guidance for these steps can be found in resources detailing RADIUS proxy configuration.
NPS Logging: RADIUS Accounting
NPS logging, also known as RADIUS accounting, is vital for monitoring and auditing network access. NPS logging can be tailored regardless of whether NPS is used as a RADIUS server, proxy, or a combination.
Configuration involves:
- Selecting events to log and view in Event Viewer.
- Choosing additional information to log.
- Deciding on the logging destination: text files on the local server or a SQL Server database (local or remote).
For comprehensive details on configuring NPS logging, refer to documentation on Configuring Network Policy Server Accounting.
In conclusion, Network Policy Server is a powerful and flexible tool for managing network access control within Windows Server environments. Its dual functionality as a RADIUS server and proxy, coupled with its comprehensive feature set, makes it a cornerstone of secure and efficient network administration. By understanding its capabilities and configuration options, administrators can effectively leverage NPS to meet the diverse network access needs of their organizations.
