Table of Contents Capstone Project Summary ................docx
- 1. Table of Contents Capstone Project Summary ............................................................................................... ......... 1 Review of Other Work ............................................................................................... ................ 3 Project Rationale ............................................................................................... ......................... 5 Systems Analysis and Methodology .......................................................................................... 7 Goals and Objectives ............................................................................................... ................. 10 Project Deliverables ............................................................................................... .................. 15 Project Timeline ............................................................................................... ........................ 21 Project Development ............................................................................................... ................. 21
- 2. Conclusion ............................................................................................... ................................. 26 Appendix A: Implementation Configuration Documentation ................................................. 28 Appendix B: Testing Documentation ...................................................................................... 29 Appendix C: Maintenance Procedures .................................................................................... 32 References ............................................................................................... ................................. 34 Configuring Active Directory Authentication for Force 10 Switches Page 1 Capstone Project Summary I have been employed with a medium sized financial institution, as a Network and Data Center Administrator for the last five years. The company has a headquarters location and seven branch locations. Some of my assigned duties are the
- 3. management of network devices, management of Microsoft Windows servers, and access control management for user account access to network resources. The company’s security policy requires all users to change their user account passwords every forty days. The policy includes all network access user accounts including the accounts of the network administrators that manage devices. The security policy is actively enforced on Microsoft Active Directory user accounts. There is a Group Policy set up in Active Directory that causes each user account password to expire after forty days forcing users to change their passwords. The user accounts used by network administrators to manage the company’s network switches were not the same as their Active Directory user accounts and the policy was only passively enforced. Each switch was configured to use a local database of user accounts for administrators. There are a total of fifteen network switches in the company and three network administrators to manage them. There are eight switches
- 4. installed at the headquarters location and one switch at each of the seven branch locations. Since each switch had its own database of user accounts, the network administrators were required to connect to each switch every forty days to change their password. There were mixed results for each administrator every forty days. Sometimes an administrator would change their passwords on all fifteen switches as required by the security policy, but unfortunately it didn’t always happen that way. There were times they would change their passwords on some, but not all of the switches leaving some Configuring Active Directory Authentication for Force 10 Switches Page 2 completely unchanged. Many times the passwords were not changed in the forty-day time frame as required. When the appropriate password changes did not meet the forty-day requirement, the administrator, and the department, were no longer compliant with the security policy. To resolve the possible non-compliance issues, it was
- 5. determined that the network administrators should use their Microsoft Active Directory user accounts to access and manage these switches. As mentioned above, there is a Group Policy in place forcing users to change their account passwords every forty days. By using their one centrally managed Microsoft Active Directory user account for network management it eliminates the requirement for the administrators to change user account passwords on all fifteen switches every forty days. The company already utilized a Remote Authentication Dial-In User Service or RADIUS configured on a Windows Server to authenticate with Active Directory user accounts for VPN access. For this project I configured RADIUS to also be used to authenticate the user accounts of the network administrators for managing the network switches. To complete this project, I configured each switch as a RADIUS client on the Windows Server. I then, on that same server, created a network policy that grants access to the three network administrator’s Active Directory user accounts.
- 6. Once the RADIUS configuration was completed on the server I configured each of the fifteen switches. Each individual switch needed to be configured with the IP address of the RADIUS server, and to use that server for its authentication method. Each switch was then configured to use both RADIUS and a local user account database as a backup in case the server is unavailable. The individual local user accounts for the network administrators were removed from each switch and a single local user account has been created for that backup purpose. Configuring Active Directory Authentication for Force 10 Switches Page 3 At the completion of each switch configuration, access was tested for all three network administrator’s user accounts and recorded in a report for documentation of its success. Other documentation of this project includes sample Force 10 configuration commands detailing how RADIUS was implemented, a sampling of the RADIUS debug command output recording a user
- 7. being authenticated for management access to a switch, and documentation on maintaining users and switches in the future. Review of Other Work The proposed solution to the issue of the corporate security policy’s forty-day password requirement and network administrators’ non-compliance will required multiple technologies, but there was one technology at the solution’s core and that is Remote Authentication Dial-In User Service (RADIUS). RADIUS is an Internet Engineering Task Force (IETF) standard protocol described by Cisco Systems (2006) as “a client/server protocol” where the “client passes user information to designated RADIUS servers…RADIUS servers receive user connection requests, authenticate the user, and then return the configuration information necessary” Using the description from Cisco Systems as a model, the Force 10 switches were configured as the RADIUS clients, that pass user information to the company RADIUS server.
- 8. The RADIUS server then authenticates the network administrator user accounts from Active Directory to grant access for management of the switches. To allow this communication between the switches and the server using the RADIUS protocol both the server and the switches required new configuration changes. The company already utilized a server with Windows Server 2008 R2 and the Network Policy Server (NPS) role installed. “Network Policy Server (NPS) is Microsoft’s implementation Configuring Active Directory Authentication for Force 10 Switches Page 4 of a RADIUS server in Windows Server 2008 R2.” (Panek, 2011, p. 662). Within NPS there were two necessary configuration changes. The first NPS configuration change was to add each Force 10 switch as an individual RADIUS client. The requirements for a RADIUS client configuration are the IP address of the switch and a phrase or word that will be used as a shared secret. A shared secret is “a text string
- 9. that serves as a password between: A Remote Authentication Dial-In User Service (RADIUS) client and RADIUS server.” (Microsoft TechNet Library, 2008). The second NPS configuration change was to create a Network Access Policy to be used with the RADIUS clients. This policy is used to “determine who can and cannot connect; you define rules with conditions that the system evaluates to see whether a particular user can connect.” (Panek, 2011, p. 689). Each Network Access Policy has assigned attributes, and this new policy has been assigned a Windows Group and the newly created clients. Any user accounts assigned to the Windows Group chosen in the policy will be granted access to the RADIUS client. A new group was created in Active Directory for this purpose. Microsoft Active Directory is defined as “an extensible directory service that enables centralized management of network resources.” (Smart Brain Training
- 10. Solution s, 2014, p. 7). Active Directory’s role or responsibility is determined to be “authorizing access, managing identities, and controlling the relationships between the resources.” (Smart Brain Training