# VPN

## Basics

1. To create a VPN rule, add an **item** under the **Rule collection** hive and select **VPN Rule.** 
2. Give the rule a **Name** that explains for what the rule is used for. Furthermore, a descriptive name will help you to identify authentication requests processed by this rule in your logs easily later on.
3. Do not forget to **Enable** the rule!

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2F1mDm5qPMxBfR2JSTJilR%2Fimage.png?alt=media&#x26;token=762460e6-4681-4a73-a56c-89b451e92502" alt=""><figcaption><p>Showing VPN rule</p></figcaption></figure>

## **Authentication**&#x20;

Under the **Authentication** hive, your first choice is whether you want to allow or decline **Certificate-based** or **Username/Password-based** authentication for this rule.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FL27ShA3DyBy8Xk1mcTS6%2Fimage.png?alt=media&#x26;token=3af29c0b-2d3a-4ce7-a168-605f31834f57" alt=""><figcaption><p>Showing VPN authntication</p></figcaption></figure>

### **Certificate-based authentication**

For certificate-based authentication you have the following choices to further constrain incoming authentication requests.

#### Allow only specific CAs (Trusted CAs)

This allows you to narrow down incoming authentication requests to specific trusted root or issuing CAs. Those CAs can be a subset of all Trusted Roots you have configured on the RADIUSaaS platform.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FwTTeU5yiS9IIWuOH1TzD%2Fimage.png?alt=media&#x26;token=3dd60827-e693-4d56-800e-4531bd89beaa" alt=""><figcaption><p>Showing certificate filtering</p></figcaption></figure>

#### Filter for Intune IDs&#x20;

This is a historical setting. If your clients are authenticating with certificates that your clients received during the AAD-Join, you want to filter for your Intune Tenant ID.&#x20;

In case you have entered your Tenant IDs as described [here](https://docs.radiusaas.com/admin-portal/trusted-roots#intune-id), the default behaviour of RADIUSaaS is that only machines presenting a certificate with extension OID **1.2.840.113556.5.14** and a whitelisted value for the Tenand ID will get access to the network. With the rule engine, you now have the option to further restrict the access to specific Intune IDs for a specific rule or to ignore the certificate extension. This allows you to have a multi-deployment setup, where some clients come with certificates providing the respective OID and some do not.&#x20;

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FS9j7IPx75GcWX5Mf5vIJ%2Fimage.png?alt=media&#x26;token=95674b05-9bc7-42dd-bd85-67e1c516ed6f" alt=""><figcaption><p>Showing Intune ID filtering</p></figcaption></figure>

### Username/Password-based authentication

After enabling **Username/Password-based** authentication, you can apply additional filtering by configuring a Regex on the **Username**. Default is all Usernames.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FWXCuKgwusQZoEOoqH7AG%2Fimage.png?alt=media&#x26;token=b693bc2b-d6bd-4c7e-b46a-93ac314a4df8" alt=""><figcaption><p>Showing username / password-based authentication</p></figcaption></figure>

## Configuration

Under the **Configuration** hive you are able to configure additional filter criteria based on the origin of authentication requests as well as return additional RADIUS attributes, e.g. Filter-Id.

### NAS Identifier filter

{% hint style="info" %}
In case you are unsure what identifier your NAS uses, you can check the logs (Logtype = detail). RADIUSaaS looks for a property called *NAS-Identifier* to match against the trusted NAS Identifiers.&#x20;
{% endhint %}

To set a NAS Identifier filter, either select **Identifiers** or **Groups**.&#x20;

* If you select **Identifiers**, you can specify multiple **Identifiers.**
* If you select **Groups,** you can reference one or more of your pre-defined **NAS Identifier Groups**.&#x20;

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2FYRbROA5Is4ZBGHGucJ0y%2Fimage.png?alt=media&#x26;token=2692b122-c23c-4560-8b34-b07aafbbb3b7" alt=""><figcaption><p>Showing NAS Identifier</p></figcaption></figure>

### NAS IP Address filter

To set a NAS IP address filter, either select **IPs** or **Groups**.&#x20;

* If you select **IPs**, you can specify multiple **IPs.**
* If you select **Groups,** you can reference one or more of your pre-defined **NAS IP Address Groups**.

<figure><img src="https://1222554226-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSWU1DQ4UGkqER7uGNUOm%2Fuploads%2F34DcxYs1Uj4ZEULE81e6%2Fimage.png?alt=media&#x26;token=d11c9f16-8c01-496b-8ab7-ab7ac4126a22" alt="" width="401"><figcaption><p>Showing NAS IP Address Filter</p></figcaption></figure>

### RADIUS attribute return

{% hint style="info" %}
In case you require return attributes that are not available by default, please add them [here](https://docs.radiusaas.com/admin-portal/settings/general-structure#radius-attributes).
{% endhint %}

The RADIUSaaS rule engine provides several ways to return additional RADIUS attributes. The following options are available:

#### Static

Statically specify the return attribute(s) and their value(s) which should be assigned based on the related rule.

#### By Certificate Extension

{% hint style="info" %}
Currently it is not supported to add custom certificate extensions to SCEP profiles in many MDM systems, including Microsoft Intune and JAMF.

We therefore recommend to use the [Certificate Subject Name](#by-certificate-subject) of the certificate instead to add a VLAN assignment.
{% endhint %}

* Select one of your created Certificate Extensions
* The filter is set to match the Value of the specified return attribute to your specified extension (OID)
* Wildcards will be translated to .\* Regex

#### By Certificate Subject Name Property

* You can also return additional RADIUS attributes based on properties in the Subject Name of your certificate
* Therefor, specify in which property the return attribute value is stored
* Then, configure which string the return attribute value is prefixed with
* The value provided in the Subject Name property is not required to have a prefix. However, it can be required to use a prefix in case your Subject Name carries the same attribute more than once (e.g. several CN's are quite common).