z-notes

配置RADIUS服务器（WINDOWS 2016）和服务端

1.基础搭建

2.配置AD域服务

安装完成后会自动重启

3.配置组策略

3.1.配置密码策略

强制刷新策略

4.改DNS

5.配置RADIUS服务

5.1.配置网络策略和访问服务

打开网络策略服务

5.1.1.共享机密

5.1.2.配置RADIUS客户端

5.1.3.配置网络策略

##–概述

##–条件

##–约束

5.2.创建用户

5.2.1.创建一个OU

5.2.2.创建新用户

6.配置3A服务客户端

AR3

<Huawei>sys    

#创建认证方案
[Huawei]aaa
[Huawei-aaa]authentication-scheme renzheng
[Huawei-aaa-authen-renzheng]authentication-mode radius
[Huawei-aaa-authen-renzheng]quit

#创建计费方案
[Huawei-aaa]accounting-scheme jifei
[Huawei-aaa-accounting-jifei]accounting-mode radiu
[Huawei-aaa-accounting-jifei]accounting start-fail offline 
[Huawei-aaa-accounting-jifei]quit

#创建RADIUS服务器模板
[Huawei]radius-server template Windows2016
[Huawei-radius-Windows2016]radius-server authentication 192.168.80.129 1812
[Huawei-radius-Windows2016]radius-server accounting 192.168.80.129 1813
[Huawei-radius-Windows2016]radius-server shared-key cipher 51cto
[Huawei-radius-Windows2016]radius-server retransmit 2 timeout 5
[Huawei-radius-Windows2016]quit

#创建域
[Huawei]aaa
[Huawei-aaa]domain 51cto.com
[Huawei-aaa-domain-51cto.com]authentication-scheme renzheng  #添加认证方案
[Huawei-aaa-domain-51cto.com]accounting-scheme jifei         #添加计费方案
[Huawei-aaa-domain-51cto.com]radius-server Windows2016       #添加连接模块
[Huawei-aaa-domain-51cto.com]quit
[Huawei-aaa]quit

#添加通讯地址
[Huawei]display ip interface brief
[Huawei]interface GigabitEthernet 0/0/0
[Huawei-GigabitEthernet0/0/0]ip address 192.168.80.111 24
[Huawei-GigabitEthernet0/0/0]quit

#创建远程登录
[Huawei]user-interface vty 0 4
[Huawei-ui-vty0-4]authentication-mode aaa
[Huawei-ui-vty0-4]user privilege level 3
[Huawei-ui-vty0-4]quit

[Huawei]display current-configuration 
[V200R003C00]
#
 snmp-agent local-engineid 800007DB03000000000000
 snmp-agent 
#
 clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load portalpage.zip
#
 drop illegal-mac alarm
#
 set cpu-usage threshold 80 restore 75
#
radius-server template Windows2016
 radius-server shared-key cipher %$%$~R$Z#o0joVs>T`=Ep;N="Qo8%$%$
 radius-server authentication 192.168.80.129 1812
 radius-server accounting 192.168.80.129 1813
 radius-server retransmit 2
#
aaa 
 authentication-scheme default
 authentication-scheme renzheng
  authentication-mode radius
 authorization-scheme default
 accounting-scheme default
 accounting-scheme jifei 
  accounting-mode radius
 domain default 
 domain default_admin 
 domain 51cto.com  
  authentication-scheme renzheng 
  accounting-scheme jifei 
  radius-server Windows2016
 domain 51cto 
 local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
 local-user admin service-type http

7.测试

是否能通讯

安装telnet

远程登录测试