This video covers the installation of the NPS, CA and Remote Access Server roles on a Microsoft Windows 2019 Server. We then configure those roles to support RADIUS authentication within Ubiquiti’s UniFi platform.
What is the difference between an Active Directory Security Group and a Distribution Group?
Distribution Groups – These are used for email distribution. Let’s say we have a group called “Sales” and there are 50 users in that group. We need to send an email to all of them at once. How do we accomplish that? We’d use a distribution group. Within Active Directory, you’d create a group, we’ll call it sales, and add all your sales users to that group. Now when you want to send out a blast email to your entire sales team, you would use a single email address like email@example.com
Additionally, groups can also be updated as users come and go. This helps keep things organized for you, as an Active Directory administrator, as well as your end users.
Security Groups – Security groups have a similar concept to that of distribution groups except that they are used to secure a network resource instead of sending out an email message. Again, lets pretend we have a sales department at Test Company. Test Company has a file server with a shared folder called sales. Only the sales department should have access to this folder. How would you accomplish this?
You could add all of your sales users to the folder individually but that would be extremely messy. You’d have to adjust permissions every time someone left or started at Test Company. Not an efficient way of doing things. So instead, you would create a security group and assign the group permissions to the folder. Let’s call it the Sales-RW group. We know from looking at it, that the group is Sales, and they have Read-Write (RW) access if they are in that group. Now when someone starts or leaves your company, you update the group and the permissions on the folder stay the same. This is a much cleaner way of doing things.
Learn how to add a VLAN to over a Ubiquti Nanostation M5 P2P Link for a security camera or other device. I am using 2 Ubiquiti Nanostation M5s in my setup to get a wireless link from one of the out buildings on my property. I have my security cameras on a segmented VLAN in order to keep them from talking to the web. I show you how to pass that second (or multiple) VLAN over the point to point (P2P) link created between the two Nanostations.
This post will be focusing on the Cisco 2960G Switch I acquired in my post titled “Homelab Rebuild – Part 1 – Intro“. Here I will be working on configuring the switch. This includes adding a VLAN for my WAN connection, adding ports to the VLANs and setting up a management interface.
Creating VLANs on a Cisco 2960G switch is a pretty straight forward task. You will need a Cisco WS-C2960G-8TC-L Switch and a USB to Serial Converter. Putty, or your favorite serial/SSH client, will also be needed. This tutorial assumes you already know how to connect to your switch using Putty.
First off, we need to enter configuration mode on the Cisco 2960G Switch. To accomplish this, type: “conf t” and hit the enter key.
Create VLAN5 – this our WAN VLAN. Type the command “vlan 5” and hit enter. Give your VLAN a name. In my case, VLAN5 is used for my WAN connection, so I gave it the name of “WAN” – you do not have to type name twice. I goofed on the first attempt. I wanted WAN in all caps. Then type “exi” or “exit” and hit enter.
Create VLAN25 – this is our management/production VLAN. Type “vlan 25” and hit enter. Again, give your VLAN a name. Type “name Production” and hit enter. Exit VLAN 25.
Change the host name
Also, while we are in config mode, lets take a moment to setup the switch’s host name. You do this by entering the command “hostname SW-ACH-WAN” and hitting enter. You will now see the switch’s host name change.
After creating our VLANs, we need to assign switch ports to them. Otherwise, they are just VLANs. You can issue the command “show vlan” and the switch will show you all of the VLANs present on the Cisco 2960G and which switch ports are assigned to which VLAN.
In the screenshot above, you can see all eight ports are assigned to VLAN 1. You can also see we’ve created VLAN 5 with the name of “WAN” and VLAN 25 with the name of “Production”.
To assign ports to these VLANs, you must again enter config mode by typing “conf t” and hitting the enter key. Then, you need to enter each interface. Enter an interface by typing “interface gigabitEthernet 0/#” – Where the # is, is the port number. So, “interface gigabitEthernet 0/1” and hit enter.
Next, type “switchport access vlan 5” – this allows the switch port to access vlan 5. Then add your description by typing: description “Modem Uplink” and hitting enter. Finally, exit the interface you are working on and proceed to the next.
The table below gives a good break down of each port that I am using, what VLAN it is on and the purpose.
This port is where I will plug my Spectrum modem into, thus being my modem uplink on VLAN 5
Uplink to ACH-FW01
I will plug the physical NIC on HOST01 that is assigned to my firewall, ACH-FW01 into this port so that it can access the WAN connection.
Uplink to ACH-FW02
I will plug the physical NIC on HOST02 that is assigned to my firewall, ACH-FW02 into this port so that it can access the WAN connection.
This will connect the switch to my Dell switch stack so that I can manage the WAN switch from my production network, VLAN25.
Since we are using VLAN 25 to access our management network, we need to assign it an IP Address. We do this by entering the VLAN as an interface. So, enter the command “interface vlan 25” and hit enter. You will now be in the interface config mode. Next, type the command “ip address 192.168.25.4 255.255.255.0” and hit enter. Be sure to use your IP addressing scheme for your management network. The 255.255.255.0 is a /24 subnet mask.
Saving the configuration
Now that we have configured our switch, it is time to save your running config. If you do not save the running configuration, all of the changes will be lost when you reboot the switch. To save the config, type “copy run start” and hit enter.
Some good reference reading can be found right from the manufacturer, in this case it is Cisco. You can check out this article regarding VLAN configuration on the Cisco 2960G switch.