Windows Server 2012 NPS, Radius SSO Accounting Messages

Hi,

First of all i'll try to give you some more detailed information about my setup:

I use Radius Enterprise Authentication for my Wireless Clients:

Here are my Radius Settings:

The Server IP is pointing to my Windows Active Directory Server. On that Server i've setup Network Policy and Access Services Role as descripted in the link above.

My wireless users can now successfully authenticate them selfs with their Active Directory Username + Password if they connect the first time to the SSID. 

But if i enable "Match known users" in my firewall rule. The Wireless Clients can't connect to the internet and i don't want them to use the captive portal because - in theory - they are already authenticated via Radius / WPA2 Enterprise. 

In my understanding the checkbox "Enabled accounting" should work as a single sign on mechanism when somebody connects to the ssid?

I've also added the Radius Server as a Firewall authentication method. 

So my first question is:

How can i do such a single sign on for my wireless clients, so that i can use "Match known users" in my firewall without a captive protal?

Second question:

Under "Services" i find "SSO using Radius accounting request". Is there something i need to configure too?

My Access Points are Sophos AP100

Hi,

First of all i'll try to give you some more detailed information about my setup:

I use Radius Enterprise Authentication for my Wireless Clients:

Here are my Radius Settings:

The Server IP is pointing to my Windows Active Directory Server. On that Server i've setup Network Policy and Access Services Role as descripted in the link above.

My wireless users can now successfully authenticate them selfs with their Active Directory Username + Password if they connect the first time to the SSID. 

But if i enable "Match known users" in my firewall rule. The Wireless Clients can't connect to the internet and i don't want them to use the captive portal because - in theory - they are already authenticated via Radius / WPA2 Enterprise. 

In my understanding the checkbox "Enabled accounting" should work as a single sign on mechanism when somebody connects to the ssid?

I've also added the Radius Server as a Firewall authentication method. 

So my first question is:

How can i do such a single sign on for my wireless clients, so that i can use "Match known users" in my firewall without a captive protal?

Second question:

Under "Services" i find "SSO using Radius accounting request". Is there something i need to configure too?

My Access Points are Sophos AP100

The point is, we currently do not support Accounting with our Sophos APs.

You can open a Sophos Support Case to get the current Status of this limitation.

With other Access Points accouting would be possible?

I think so. 

Depends if the AP will send the correct Radius Information via Framed packet to XG or not. 

So:

Using 3rd party components delivers more functionalaty than sophos own products? That's a little bit disappointing, don't you think?

Thank you anyway for the clarification, i'll open a support case.

FYI : I've successfully used both Meraki and Ruckus AP's in conjunction with the XG Radius accounting feature. As mentioned the only requirement that I'm aware of is the framed address information is sent in the accounting packet - I don't think something like a Unfi AP will provide that information so it's not a given.

 Regards