You have a Windows Server 2008 R1 Active Directory (AD) environment already setup and configured.
You know the IP addresses of your AD server as well as your devices that will act as RADIUS clients.
You have a password to use as the “Shared Secret”. For documentation sake, we will use the password: P@ssword
You’re using the “Domain Admins” user group as the group to allow access to the devices
The username ‘cstevens’ (The user you will be logging as) is part of the “Domain Admins” group
1) We need to add Radius support to Active Directory. In order to do that you will need to install a new role on your AD server.
a) In server manager, click on the Roles then Add Roles.
b) In the “Add Roles Wizard” select Network Policy and Access Services and click Next.
c) At the Network Policy and Access Services screen, Click Next.
d) In “Select Role Services” check Network Policy Server and click next.
e) At the “Confirm installations Selections” click Install.
f) Once the install completes, select Close.
2) Add a RADIUS client in Network Policy Server.
a) Click Start -> Administrative Tools -> Network Policy Server
b) In the Network Policy Server MMC, right click on NPS (Local) and select “Register Server in Active Directory”. Click OK to authorize this computer to read users’ dial-in properties. Click OK again at the next screen.
c) Expand “RADIUS Clients and Servers”. Right click on RADIUS clients and select “New RADIUS Client”
d) In the New RADIUS Client window fill out the friendly name, the IP address of your JunOS device and the secret password and click OK.
3) Create a network policy
a) Expand the “Policies”, right click on Network Policies and select “New”
b) Specify a policy name and click Next.
c) On the “Specify Conditions” window, click Add, select Windows Groups, click Add Groups and enter in Domain Admins. Click OK until you get back to the Specify Conditions window and click Next
d) In the “Specify Access Permission” window check the Access Granted radio button and click next.
e) In the Configure Authentication Methods window make sure only the “Microsoft Encrypted Authentication Version 2” is checked and click Next.
f) Next, at the Configure Constraints screen, you can leave everything unchecked in the “Idle timeout”, “Session Timeout”, “Called Station ID”, “Day and time restrictions” and “NAS port type.” Click next to continue.
g) At the “Configure Settings” window, under Radius Attributes -> Standard, removed Framed Protocol and change Service-Type to login. (Note to self: is this even needed?) Also select the “Encryption” option and check to use only strong encryption. Click next.
4) JunOS Configuration
a) Log into your JunOS device. You will need to create each user that you will want to log into the device. For example, I’ll add my own name, but note to NOT assign a password to the user.
b) Set your radius server information
c) Set your radius server options for mschap-v2
d) Here’s what you should see when you do a “show | compare”
e) Oh, we’ll also need to set the authentication order:
f) Don’t forget to commit the changes!
That should be it!