To request this to be available for your school please raise a support case here and we will expose these options for you.
RADIUS can be set up to report who is connected to your school network via wireless, without it being a school owned device and having an agent, however it relies on them using local authentication through your wireless provision.
The set up is done in two parts:
- in the SchoolProtect admin portal
- In your local Windows NPS/specific local RADIUS accounting device. Note: we have tested Windows NPS only as that is the typical use case.
For each group of users you want to target, a policy group is set up in SchoolProtect which generates a unique configuration guid which is what you need for the accounting packet.
Prerequisites
- Case raised to request access to service.
- Wireless that provides accounting packets that contain the Framed-IP-Address of the source device.
- NPS/RADIUS accounting that allows an additional Class to be added to the accounting packet.
- Each device must have a unique LGfL IP address (10.x.x.x), not behind a school/Meraki NAT or proxy.
Instructions
Setup in SchoolProtect
- Browse to Settings > RADIUS.
- Toggle RADIUS authentication to on to enable the service options, this will provide the RADIUS secret and the endpoints to send your accounting to.
-
Browse to Policies > Policy Configuration
- Create a new policy, choose what to base it on (system default or copy existing policy) and give it a sensible name.
- Click Edit on your new group at the bottom to enter the Policy Group page (this is where you can configure time schedules and edit the policy allowed/blocked URLs, categories and Bundles).
- You should not enter anything into the Priority box.
- Click RADIUS & BYOD.
- Take note of that guid (which is also on the RADIUS enable page.)
Enabling RADIUS from within SchoolProtect:
Note the RADIUS secret and the server endpoints. These endpoints can differ depending on where your school is based.
Each LGfL network has 2 RADIUS servers. The 2 server addresses per network are:
To confirm what network you are a part of, you can check your schools deployment page, if IP addresses say OLDN, you are Outside London.
Within Policy Configuration, you should now get access to the RADIUS & BYOD button.
Enabling will show the GUID, and a link to the main RADIUS config page which will contain all GUIDs and server endpoints.
Full page showing the secret, endpoints and the GUIDs per policy - Note that your endpoints may be different.
Setup in Windows NPS
Within Windows NPS, you would need to configure the Network Policy to include the GUID. To do that find the relevant policy. You would ideally be splitting this based on user type/group to give you the ability to filter appropriately.
Click on the relevant policy that accepts the users and press properties.
Choose Settings and press Add on the RADIUS Attributes > Standard option.
Choose Class and press Add.
Enter the GUID that relates to the policy, so for this I have added the Student policy GUID, then press OK.
Close the Add Standard RADIUS Attribute page, then press Apply on the remaining properties page, note the Class is showing now.
Repeat for your other groups if required.
To forward these requests with the Class, you need to add a remote server group. Right click Remote RADIUS Server within NPS then New,
For ease, I've called the server group SchoolProtect.
Here you add one of the server endpoints provided on your RADIUS config page, they may differ to this screenshot.
Press the Authenticaton/Accounting tab and add your shared secret from the SchoolProtect RADIUS config page. Make sure the accounting port is 1813.
Repeat to add the second server IP and set the loadbalancing weight to 100. Press OK and that server group is complete.
Create a Connection Request Policy to forward these packet, right click and choose New, give it a similar name for ease.
Select the option for Client IPv4 address to catch all requests from the LAN, you can be specific to the VLAN you have, or you can allow all.
I have allowed all, a * will account for any IP address on the LAN. Press OK to continue.
This is how it should be displayed, which will allow you to press next.
Choose the accounting option, then tick Forward Accounting, then select the server group you created earlier, then press next.
Press next on the specify authentication methods as we are not authenticating, only accounting.
Press next on Configure Settings, no changes are needed here.
Press Finish to complete the change on NPS.
