Filter:

Submit Search

# Managing Radius users

The SMC server can be connected to a Radius server to authorize the company’s users to manage a pool of firewalls.

This type of authentication is intended to work with a Radius or FreeRADIUS server on Microsoft Windows Server 2016, 2019 and 2022.

Authentication via Radius server is configured in the SMC web administration interface.

To authorize administrators to connect to the SMC server via a Radius server, follow the three steps below:

1. Configure the connection to the Radius server,
2. Test the connection to the server,
3. Authorize users and define their access privileges.

Configuring the connection to the Radius server

To configure and enable the connection to a Radius server:

1. Go to Maintenance > SMC Server > Administrators, and click on Edit local authentication settings,
2. In the Radius tab, select Radius authentication enabled.
3. By default, the Enable automatic switching between Radius and LDAP servers when the Radius server is unavailable is disabled. Enable the option if you wish to send authentication requests to the LDAP server when the Radius server is unavailable.

   WARNING
   By enabling this option, during a switch, the security level of your authentication will be same level that you have set in your LDAP configuration.

4. Fill in the following fields:

   Field | Description
   --- | ---
   Main server
   Host | IP address or FQDN of the main Radius server. If the server’s FQDN is used, the DNS service must be configured beforehand.
   Port | Port number to access the Radius server: 1812 by default
   Pre-shared key | Secret key shared to enable authentication on the server
   Backup server - Optional
   Host | IP address or FQDN of the backup Radius server. If the server’s FQDN is used, the DNS service must be configured in advance.
   Port | Port number to access the Radius server: 1812 by default
   Pre-shared key | Secret key shared to enable authentication on the server

Testing the connection to the Radius server

To test the connection to a Radius server, use the radtest tool available in command line on the SMC server:

EXAMPLE
radtest <user-id> <user-password> <radius-server-ip>:<radius-server-port> <NAS-server-port> <pre-shared-key>

Allowing Radius users

To allow Radius users to authenticate on the SMC server, the super administrator must add them to the list of administrators in the web administration interface.

1. Go to Maintenance > SMC Server > Administrators, and click on Add an administrator.

2. Fill in the following mandatory fields:

Field | Description
--- | ---
ID | ID of the Radius user
Name | Name of the Radius user shown in SMC.

3. Select the access privileges. For more information, refer to the section Managing administrator privileges as super administrator and the section Restricting folder administrators' access privileges.

4. Unselect This administrator can use local authentication if you do not wish to define local authentication for the Radius user.

The following terms are reserved on SMC, so cannot be used as IDs: root, daemon, bin, sys, sync, games, man, lp, mail, news, uucp, proxy, www-data, backup, list, irc, gnats, sshd, dhcpcd, messagebus, fwadmin-server, nobody.

NOTE
The IDs of users authenticated via the Radius directory must not contain spaces in order to be able to connect to the SMC server.

Adding Radius groups

Users can belong to Radius groups.

Configure the Vendor Specific Attribute (VSA) in advance on the Radius server as shown below, so that groups are visible to SMC:

- Vendor code = 11256

- Vendor-assigned attribute number = 1

- Attribute format = string

- Attribute value = group1, group2... (group names)

To add a Radius user group:

1. In the Maintenance > SMC server > Administrators menu, click on Add an LDAP/Radius group.

2. Fill in the following mandatory fields:

Field | Description
--- | ---
Radius identifier | ID of the Radius group
Name | Name of the Radius group

3. Select the access privileges. For more information, refer to the section Managing administrator privileges as super administrator.

If an administrator has a personal account in his/her name, and is also a member of one or several groups, the privileges that apply will be those assigned to the personal account.

NOTE
The IDs of users authenticated via the Radius directory must not contain spaces in order to be able to connect to the SMC server.