Network policy using radius vendor-specific attribute as a condition

• Question

• 

  

  0

  Sign in to vote

  Windows 2008 R2 NPS

  I have difficulty setting up a network policy to use radius vendor-specific attribute as a condition for processing a VPN radius authentication request from a cisco asa firewall. On the firewall, "debug radius all" is on and the firewall debug info indicates vendor type 146 and type 150 data are sent upstream to nps, along with other standard radius attributes. From the hex dump info, Cisco vendor attributes appear to conform to rfc. From the nps log (xml format) on the windows server, it also confirms receiving the two vendor specific data in data_type 2, and the hex strings are the same as displayed by the cisco firewall.
  
  I read a post about how to use the setting portion of the NPS GUI to create a vendor specific data string.  After creating the settings, use the command "netsh nps sh np" to display the string and then setup the condition for the policy with the command,
  
  netsh nps set np name = "policy 2" state="enable"
   conditionid = "0x1a" conditiondata = "0100000C049208Policy"
   other conditions omitted....
  
  At this point this policy is not working because NPS decides the incoming cisco radius request is not a match for the policy conditions. The event log authentication event shows the policy is a match when the 1A condition is removed, but will use the next policy in line when the 1A condition is present. Any idea on how the condition data should look like to match the tunnel name "Policy"? Thanks in advance.

  Wednesday, February 3, 2016 9:40 PM