VMware NSX Network Detection and Response RADIUS Integration

The following terms are used in this documentation:

FreeRADIUS

An open source, high performance, RADIUS suite that supports all common authentication protocols. The VMware NSX Network Detection and Response integration has been tested with the FreeRADIUS server implementation.

RADIUS Dictionary

The dictionary file contains a list of RADIUS attributes and values. These attributes and values are then used to map between descriptive names and on-the-wire-data. The names have no meaning outside of the RADIUS server itself, and are never exchanged between server and clients. The dictionary is specific to each RADIUS server.

Network Access Server

A Network Access Server (NAS) is a single point of access to a remote resource. In this integration, the On-Premises Analyst, Manager, or All-In-One is the NAS.

When using the VMware NSX Network Detection and Response/RADIUS integration, the On-Premises Analyst, Manager, or All-In-One can be configured to send RADIUS Authentication requests to a configured RADIUS server. Users then have the option to choose whether they want to authenticate using the default On-Premises Analyst, Manager, or All-In-One authentication or through the RADIUS Server.

The current implementation of RADIUS authentication uses PAP authentication by passing a shared secret between the NAS and the RADIUS server. The protocol conceals the actual password using the following implementation.

Upon a successful authentication response from the RADIUS Server, the On-Premises Analyst, Manager, or All-In-One will authenticate the user to the User Portal. The authentication will only work if the user account already exists on the User Portal and its mapping is correct (see RADIUS mapping). These conditions do not apply if the attribute provision_users=true.

After the RADIUS authentication has completed and is validated, the user will be logged into the On-Premises Analyst, Manager, or All-In-One.

Configure the VMware NSX Network Detection and Response Appliance

To configure a RADIUS server to be used for authentication for the On-Premises Analyst, Manager, or All-In-One, refer to the Lastline RADIUS API documentation. Specifically, refer to the /papi/radius/configure method, which is used to configure an appliance to perform authentication through a RADIUS server.

Authentication

Account-based authentication is the only supported authentication method for RADIUS configuration. Use the following curl command to authenticate a user:

curl -X POST "https://<FQDN>/papi/login" -d "username=USERNAME&password=PASSWORD" -c COOKIENAME

In the above example:

• FQDN — The fully qualified domain name of the On-Premises Analyst, Manager, or All-In-One.

• USERNAME — The VMware NSX Network Detection and Response portal account username.

• PASSWORD — The VMware NSX Network Detection and Response portal account password.

• COOKIENAME — The name that you enter for the cookie.

After the user is authenticated, you can use the following curl command as a test:

curl -X POST "https://<FQDN>/papi/ping" -b COOKIENAME

Configure a dictionary

The following dictionary is an example of a valid RADIUS configuration:

{
  "appliance_uuid": "0a1b2c3d4e5f6e7d8c9b9a8b7c6d5e4f",
  "enabled": true,
  "server_type": "freeradius",
  "server": "freeradius.example.com",
  "auth_port": 1812,
  "secret": "mysupersharedradiussecret",
  "nas_identifier ": "LL Manager"
}

This configuration can be performed using a curl command, such as the following:

$ curl --data "appliance_uuid=0a1b2c3d4e5f6e7d8c9b9a8b7c6d5e4f" \
       --data "enabled=true" \
       --data "server_type=freeradius" \
       --data "server=freeradius.example.com" \
       --data "auth_port=1812" \
       --data "secret=mysupersharedradiussecret" \
       --data "nas_identifier=LLManager" \
       --cookie COOKIENAME \
       --request POST "https://<FQDN>/papi/radius/configure"

In the above example:

• FQDN — The fully qualified domain name of the On-Premises Analyst, Manager, or All-In-One.

Configure a custom dictionary

The VMware NSX Network Detection and Response/RADIUS integration has been tested with the FreeRADIUS server implementation. If you use a different type of RADIUS server (not compatible with FreeRADIUS), or the default dictionary provided with the installation does not work, you can provide a custom dictionary. This custom dictionary must be placed in the following directory: /var/lib/pyrad/dicts/other/dictionary. The server_type for configuration MUST be set to other.

The allowed values for server_type are freeradius, vmware_nsx, or other.

Successful configuration

After a successful POST to the configuration API, the On-Premises Analyst, Manager, or All-In-One executes a retrigger configuration operation. This may take a few minutes. After it completes, the User Portal login page will have a RADIUS Sign On prompt:

If the RADIUS Sign On checkbox is selected, the user authenticates through the configured RADIUS server. If the checkbox is not selected, then authentication is performed through the User Portal on the On-Premises Analyst, Manager, or All-In-One.

If this login page is not displayed, then there was either an error in the configuration or the configuration process is still pending. To view this information, visit the appliance action logs page, located on the Admin→Appliances→Logs→Action Logs tab on the User Portal. Refer to the Action logs tab help page.