How-To: Create Cloud RADIUS Network Policies for Local User Authentication

In this page we go through how set up your EZRADIUS access policy for local users using PAP, MSCHAPv2, and EAP-TTLS. This allows legacy devices and users without certificates to authenticate against Cloud RADIUS.

Prerequisites

Introduction to Managing Cloud RADIUS Network Policies in EZRADIUS

The Policies page in EZRADIUS allows you to create and manage your Cloud RADIUS network policies. Each policy defines the conditions under which a user or device can connect to your network, including authentication methods, accepted certificate authorities, and access policies.

Visit the Manage RADIUS Policies guide to learn more about the Policies page layout and features.

How to Create Cloud RADIUS Network Policies with Local User Authentication

Now that you are familiar with the layout of the Policies page in EZRADIUS, you can set up a new RADIUS network policy that uses local users for authentication. These are commonly used with PAP, MSCHAPv2, and EAP-TTLS authentication methods for legacy devices or users without certificates. The following steps will guide you through the process.

Step 1: Name Your RADIUS Server Policy

Begin by entering a friendly name for your RADIUS server policy. This name is for your records to help you identify the policy later. Behind the scenes, EZRADIUS will create a unique identifier for the policy, so feel free to choose a name that makes sense to you.

Input field to name your RADIUS server policy in EZRADIUS

Step 2: Enable RadSec and/or Classic RADIUS

Next we have to enable which authentication methods you are going to use, you can use RadSec, Classic RADIUS, or both.

EZRADIUS Cloud RADIUS RADIUS Server Policy form showing Enable RadSec and Enable Classic RADIUS checkboxes both checked

How to Set Up Classic RADIUS for Cloud RADIUS

(optional) Always Send Message Authenticator

Depending on your networking device, you may need to enable the “Always Send Message Authenticator” option. This is required by some devices to ensure proper RADIUS communication, especially for devices from Fortinet.

EZRADIUS Cloud RADIUS Classic RADIUS allowed IP addresses table with Always Send Message Authenticator checkbox highlighted

How to Configure RadSec for Cloud RADIUS

If you enabled RadSec, you have to add a certificate authority or certificate that is accepted by the RADIUS server. This is dependant on your networking device (for example, if you are using a Cisco device, you will need to add the Root CA of the certificate that signed the certificate of the device. If you are using a Ubiquiti device, it allows you to upload your own certificate from your CA).

Add Certificate Authorities to RadSec Using EZCA

If your RadSec certificate is issued by your EZCA Certificate Authority, then you can easily add the CA to the cloud RADIUS server by:

  1. From the “Certificate Source” dropdown, select “EZCA”.
  2. Under the “EZCA Instance URL” dropdown , select your EZCA instance.
  3. Under the “EZCA CA” dropdown, select the CA you want to add.
  4. Click Add CA to add the CA to the RADIUS server.
  5. Your CA will now be listed under the “Trusted Certificate Authorities” section. EZRADIUS Cloud RADIUS Network Policy add EZCA Cloud Certificate Authority CA for RadSec
Add Certificate Authorities to RadSec Using 3rd Party CA

If your device uses a certificate from a 3rd party CA, you can add the CA to the cloud RADIUS server by:

  1. From the “Certificate Source” dropdown, select “Local CA”.
  2. Upload your CA certificate in PEM format.
  3. Your CA will now be listed under the “Trusted Certificate Authorities” section. EZRADIUS Cloud RADIUS Network Policy add CA from Microsoft Cloud PKI, SCEPMAN, or ADCS for RadSec
Add Self-Signed Certificate to RadSec

If your networking device only supports self-signed certificates for RadSec, you can upload the single certificate to your cloud RADIUS policy by:

  1. Leave the “Authorized Certificate Authorities” section empty. You don’t need to add any CAs for self-signed certificates.
  2. Under “Authorized Certificate Templates”, enter a certificate Friendly Name (This is just for your records, useful if have multiple locations).
  3. Upload the certificate in PEM format.
  4. Your certificate will now be listed under the “Trusted Certificates” section. EZRADIUS Cloud RADIUS Network Policy add Self-Signed Certificate for Radsec

Step 3: Add Certificate Authorities to RADIUS for Certificate Authentication

Because local user authentication does not use certificates, you can skip this step and move to the server certificate section.

Step 4: Add Server Certificate to RADIUS

A certificate is required to uniquely identify the RADIUS server to the devices connecting to the network. Without it, your clients will not be able to connect and will return errors. There are three ways to add a server certificate:

  1. Use a free, auto-generated certificate
  2. Use EZCA to create and manage the certificate
  3. Upload a certificate from a 3rd party CA.

Create a Free Certificate with EZRADIUS’ Integrated Certificate Authority

If you do not have a your own CA, you can use EZRADIUS’ integrated CA to create a free certificate. The certificate will be automatically created and renewed by EZRADIUS.

  1. From the ‘Certificate Source’ dropdown, select Auto-Generated Certificate. Automatic Certificate Creation for RADIUS

Add Server Certificate to RADIUS Using EZCA

If you are already an EZCA customer, you can leverage your existing EZCA CA to issue a RADIUS server certificate.

  1. From the ‘Certificate Source’ dropdown, select EZCA.
  2. If you are using an EZCA private instance, select the Private Instance checkbox and enter your EZCA Issuance URL.
  3. From the ‘EZCA CA’ dropdown with the certificates authorities you have in your EZCA instance, select the CA you want to use.
  4. Click Request Certificate to create a new RADIUS server certificate. EZRADIUS will automatically create the certificate for you. You do not need to specify an existing certificate or create a CSR. The certificate will be automatically renewed before it expires. EZRADIUS Cloud RADIUS Network Policy add RADIUS Certificate for EAP-TLS
  5. You should now see the certificate in the list of certificates: EZRADIUS Cloud RADIUS Network Policy add RADIUS Certificate for EAP-TLS
Add Server Certificate to RADIUS Using 3rd Party CA

If you are using a 3rd party CA, you can generate a CSR in EZRADIUS, submit it to your CA, and then upload the signed certificate back to EZRADIUS.

  1. From the ‘Certificate Source’ dropdown, select Local CA.
  2. Click the Create CSR button. EZRADIUS Cloud RADIUS Network Policy add RADIUS Certificate for EAP-TLS
  3. Download the CSR by clicking the Save CSR button. EZRADIUS Cloud RADIUS Network Policy add RADIUS Certificate for EAP-TLS
  4. Submit the CSR to your CA and download the certificate.
  5. Also download the certificate of your root CA.
  6. Once you have the certificate, scroll down and either copy and paste the certificate PEM content or click on Upload Certificate and select the certificate in PEM format. EZRADIUS Cloud RADIUS Network Policy add RADIUS Certificate for EAP-TLS
  7. After you upload your certificate, you must upload the certificate of the Root CA that signed the certificate. Scroll down and either copy and paste the certificate PEM content or click on Upload Root CA Certificate and select the certificate in PEM format. EZRADIUS Cloud RADIUS Network Policy add RADIUS Certificate for EAP-TLS
  8. You will now have both the RADIUS server certificate and the Root CA certificate listed under your certificates. EZRADIUS Cloud RADIUS Network Policy add RADIUS Certificate for EAP-TLS

Step 5: Add Local User Access Policy to RADIUS Network Policy

If you want your users to authenticate to your network directly using local user accounts and legacy protocols, you will need to create an access policy that enables local user authentication.

How to Create a Local User Access Policy

Follow the steps below to configure such an access policy:

  1. Click Add Access Policy to create a blank access policy.

  2. Provide a Policy Name, such as “Local Users”.

  3. Check the box for Enable Password Authentication, which will allow PAP, PEAP-MSCHAPv2, and EAP-TTLS RADIUS methods to be used for authentication.

    The Enable Password Authentication selection being checked, enabling PAP, PEAP-MSCHAPv2, and EAP-TTLS RADIUS methods

  4. Leave Enable Identity Provider (IDP) Delegation unchecked, as this is only needed when using Entra ID for authentication.

Done!

You have successfully created a Cloud RADIUS network policy that uses local users for authentication. Make sure to test the configuration with a device to ensure everything is working as expected.

Advanced Settings

If you have more advanced requirements for your access policies, you can configure them by expanding the Advanced Settings tab and configuring the available options.

optional

Advanced Access Policy Settings

Optionally configure advanced settings for your access policies

If you want to bypass authentication for devices based on their MAC address, you can:

  1. Check the box for Enable MAC Authentication Bypass (MAB).
  2. Either directly add your MAC addresses, or enable Bulk Upload Addresses to add multiple MAC addresses at once.

Collapses this section and completes the checkmark.

EZRADIUS checks CRLs (Certificate Revocations Lists) by default but if you also want to check OCSP, you can check the Enable OCSP checkbox. you can read more about the difference between CRL and OCSP here

Collapses this section and completes the checkmark.

If you want to require that the certificate being used for authentication has specific Extended Key Usages such as “Client Authentication”:

  1. Check the box for Require Extended Key Usage.
  2. Either select an EKU from Predefined Extended Key Usages, or enter a custom EKU in the Custom Extended Key Usage > Name and Object Identifier fields.
  3. Click Add Extended Key Usage to add the EKU configuration.

Collapses this section and completes the checkmark.

If you want to match attributes in the request (for example, matching the SSID name sent as a called station ID), you can add the attributes in the Match Attributes in Request and enter the value and the matching scheme (either contains or equals). Some common attributes to match are:

  • Called-Station-ID: Usually set-up to contain the SSID of the network or the MAC address of a device when carrying out MAC-Authentication-Bypass.
  • NAS Identifier (NAS-ID): Usually set-up to contain the SSID of the network or the MAC address of a device when carrying out MAC-Authentication-Bypass.

Collapses this section and completes the checkmark.

If you want to send attributes in the response (for example, sending the Filter-Id to the device), you can add the attributes in the Sent Attributes in Response and enter the value. Supported attributes are:

  • Filter-Id: Can be used to assign a pre-defined access control list (ACL) to the user that successfully authenticates with the access policy
  • Cisco-AVPair: Cisco-specific attribute

Collapses this section and completes the checkmark.

You can always come back to configure these settings later.

Priority Order of Access Policies

The access policies are checked in the order they are sorted, you can change the order of the access policies by clicking on the up and down arrows on the right side of the access policy.

EZRADIUS Cloud RADIUS access policy list showing up and down arrow buttons to reorder policy priority
  1. Once your policy is ready, save the policy.