Configure External Authentication on Catalyst Center using Windows Server

Introduction

This document describes how to configure External Authentication in Cisco DNA Center using Network Policy Server (NPS) in Windows Server as RADIUS.

Prerequisites

Requirements

Basic Knowledge on:

• Cisco DNA Center Users & Roles
• Windows Server Network Policy Server, RADIUS and Active Directory

Components Used

• Cisco DNA Center 2.3.5.x
• Microsoft Windows Server Version 2019 acting as Domain Controller, DNS Server, NPS and Active Directory

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Note: The Cisco Technical Assistance Center (TAC) does not provide technical support to the Microsoft Windows Server. If you experience issues with the Microsoft Windows Server configuration, please contact Microsoft Support for technical assistance.

Configure

Admin Role Policy

1. Click in the Windows Start menu and search for NPS. Then select Network Policy Server:
   Windows Start Menu
2. From the navigation panel in the left side, perform a Right-click in the NPS (Local) option and select Register server in Active Directory:
   Windows Network Policy Service
   
   
3. Click on OK twice.
   
   
4. Expand RADIUS Clients and Servers, right-click RADIUS Clients, and select New:
   Add RADIUS Client
   
   
5. Enter the Friendly name, the Cisco DNA Center management IP address, and a shared secret (This can be used later):
   Radius Client Configuration
6. Click OK to save it.
   
   
7. Expand Policies, right-click Network Policies and select New:
   Add New Network Policy
   
   
8. Enter a policy name for the rule and click Next:
   Policy Name
   
   
9. To allow a specific domain group, add these two conditions and click Next:
   • User Group – Add your domain group that can have an Admin Role on Cisco DNA Center (For this example Sup_Ad_NPS group is used).
   • ClientIPv4Address – Add your Cisco DNA Center management IP address.
     Policy Conditions
     
     
10. Select Access Granted and click Next:
    Use Access Granted
    
    
11. Only select Unencrypted authentication (PAP, SPAP):
    Select Unencrypted authentication
    
    
12. Select Next since default values are used:
    Configure Constraint Window
    
    
13. Remove Standard attributes:
    Define Attributes to use
    
    
14. On RADIUS Attributes select Vendor Specific, then Click Add, select Cisco as a Vendor, and click Add:
    Add Cisco AV-Pair
    
    
15. Click Add, write Role=SUPER-ADMIN-ROLE and click OK twice:
    Cisco AV-Pair Attribute added
    
    
16. Select Close, then select Next. 
17. Review your policy settings and Select Finish to save it.

Policy Summary

Observer Role Policy.

1. Click in the Windows Start menu and search for NPS. Then select Network Policy Server.
2. From the navigation panel in the left side, perform a Right-click in the NPS (Local) option and select Register server in Active Directory.
3. Click on OK twice.
4. Expand RADIUS Clients and Servers, right-click RADIUS Clients, and select New.
5. Enter a Friendly name, the Cisco DNA Center management IP address, and a shared secret (This can be used later).
6. Click OK to save it.
7. Expand Policies, right-click Network Policies, and select New.
8. Enter a policy name for the rule and click Next.
9. To allow a specific domain group, you need to add these two conditions and select Next.
   • User Group – Add your domain group in order to assign an Observer Role on Cisco DNA Center (For this example Observer_NPS group is used).
   • ClientIPv4Address – Add your Cisco DNA Center management IP.
10. Select Access Granted and then select Next.
11. Only select Unencrypted authentication (PAP, SPAP).
12. Select Next since default values are used.
13. Remove Standard attributes.
14. On RADIUS Attributes select Vendor Specific, then Click Add, select Cisco as a Vendor, and click Add.
15. Select Add, write ROLE=OBSERVER-ROLE, and OK twice.
16. Select Close, then Next.
17. Review your policy settings and select Finish to save it.

Enable External Authentication

1. Open the Cisco DNA Center Graphical User Interface (GUI) in a web browser and Log in using an admin privileged account:
   

   Cisco DNA Center Login Page

2. Navigate to Menu > System > Setting > Authentication and Policy Servers and select Add > AAA:
   Add Windows Server
   
   
3. Type your Windows Server IP address and the Shared Secret used in the previous steps and Click Save:
   Windows Server Values
   
   
4. Validate that your Windows Server status is Active:
   Windows Server Summary
5. Navigate to Menu > System > Users & Roles > External Authentication and select your AAA server:
   Windows Server as AAA Server
   
   
6. Type Cisco-AVPair as the AAA attribute and click Update:
   AV-Pair on External User
   
   
7. Click in the check-box Enable External User to enable External Authentication:
   

Verify

You can open the Cisco DNA Center Graphical User Interface (GUI) in a web browser and Log in with an external user configured in the Windows Server to validate that you can Log in successfully using External Authentication. 

Cisco DNA Center Login Page