Windows NPS (RADIUS) with Palo Alto Networks firewalls

Integrating Windows NPS (RADIUS) with Palo Alto Networks firewalls lets you centralize VPN and admin authentication via Active Directory. Here’s a full deep-dive for both GlobalProtect VPN and admin GUI/CLI login with RADIUS + optional MFA.

---

🔁 Integration Overview

• NPS acts as a RADIUS server, authenticating users against Active Directory.
• Palo Alto is configured as a RADIUS client.
• Optional: integrate MFA (like Microsoft NPS Extension for Azure MFA, Duo, etc.).

---

🧱 Windows NPS Configuration

1. Add Palo Alto as a RADIUS Client

• Open NPS console → RADIUS Clients and Servers → RADIUS Clients
• New Client:
  • Name: PaloAlto-FW
  • Address: Firewall’s IP (mgmt or tunnel interface depending on use)
  • Shared Secret: Strong password (you’ll use this on Palo)
  • Vendor Name: RADIUS Standard

---

2. Connection Request Policy

Usually not needed unless you forward requests to other RADIUS servers.

---

3. Network Policy

• Go to NPS → Policies → Network Policies
• Add a new policy for VPN or admin login:
  • Conditions:
    • Windows Group = VPN_Users or PA_Admins
  • Constraints:
    • Authentication Method: MS-CHAPv2, or PEAP
  • Settings → RADIUS Attributes:
    • You can use Filter-Id or Class attributes for Palo Alto role mapping.

🔐 Example for Role Mapping:

text

Attribute: Class
Value: Admin

---

🔥 Palo Alto Firewall Configuration

1. RADIUS Server Profile

Go to Device → Server Profiles → RADIUS → Add:

• Name: NPS-AD-RADIUS
• Server: IP of NPS
• Secret: Match the shared secret from NPS
• Authentication Protocol: PAP or MSCHAPv2 (MSCHAPv2 preferred)
• Port: 1812 (default)

2. Authentication Profile

Go to Device → Authentication Profile → Add:

• Name: RADIUS-NPS
• Type: RADIUS
• Server Profile: NPS-AD-RADIUS
• Username Modifier: %USERINPUT% or %USERDOMAIN%\%USERINPUT% depending on NPS config
• Allow List: AD groups (optional)

---

3. GlobalProtect VPN Integration

Go to:

• Network → GlobalProtect → Portals → [your portal]
• Under Authentication, use the RADIUS-NPS profile.
• Do the same under Gateways → Authentication.

Optional:

• Setup Group Mapping (Device → User Identification → Group Mapping) if you want to use AD group names in firewall policies.

---

4. Admin Access via RADIUS

Go to:

• Device → Admin Roles → Create custom roles (e.g., NPS-Admin, ReadOnly)
• Device → Admins → Add:
  • Name: radius-admin
  • Authentication Profile: RADIUS-NPS
  • Role: Match string in NPS RADIUS attribute (Class or Filter-Id)

e.g., if NPS sends:

text

Class: Admin

Then the admin role name must be Admin.

---

🛡️ Optional: MFA with NPS

Option 1: Microsoft Azure MFA

• Install NPS Extension for Azure MFA
• Auth flow: nginxCopyEditPalo → NPS → AD → Azure MFA

Option 2: Duo MFA

• Install Duo Authentication Proxy
• Configure as a RADIUS proxy in front of NPS

---

📈 Logging & Troubleshooting

On Windows NPS:

• Event Viewer → Custom Views → Server Roles → Network Policy and Access Services
• Common event IDs:
  • 6272 = Success
  • 6273 = Failure (check reason code)

Enable NPS logging:

• Log to file or SQL (for long-term retention)

---

🧪 Test Auth from CLI

On Palo:

bash

test authentication authentication-profile "RADIUS-NPS" username testuser password