How to Configure Microsoft Network Policy Server (NPS) for Zyxel Firewalls Using Windows Server 2025 Active Directory

Microsoft Network Policy Server (NPS) is Microsoft's implementation of a RADIUS server. It enables Zyxel Firewalls to authenticate VPN users against Active Directory using the RADIUS protocol.

In this example, Windows Server 2025 is used as the RADIUS server, allowing remote users to authenticate with their Active Directory credentials when connecting to the Zyxel Firewall.

This article explains how to install and configure Microsoft Network Policy Server (NPS) and integrate it with a Zyxel Firewall for Remote Access VPN authentication.

Note: Previous ZLD-based firewalls included a built-in RADIUS Authentication Server. This feature is not available on current uOS-based firewalls because uOS is designed to integrate with dedicated external identity providers, such as Microsoft NPS, FreeRADIUS, Active Directory, LDAP, OIDC, and cloud-based authentication services. There are currently no plans to reintroduce a built-in RADIUS Authentication

Prerequisites

• Zyxel Firewall running uOS 1.39 or later 
• Windows Server 2025 with Active Directory Domain Services (AD DS) installed 
• The server is joined to an Active Directory domain 
• DNS is correctly configured for domain name resolution 
• Administrator access to both the Windows Server and the Zyxel Firewall

Network Topology

Step 1 - Install Active Directory Certificate Services (AD CS)

Before configuring LDAPS, the Domain Controller must have a valid certificate that supports Server Authentication. This certificate is issued by Active Directory Certificate Services (AD CS).

In this example, the Domain Controller also hosts the Certification Authority.

Open the Add Roles and Features Wizard

1. Open Server Manager.
2. Click Manage.
3. Select Add Roles and Features.

Step 2 - Configure Active Directory Certificate Services

After the installation finishes, click:

Configure Active Directory Certificate Services on the destination server

Enterprise CA integrates with Active Directory and is recommended for domain environments. It supports automatic certificate enrollment and is required for most Active Directory certificate deployments, including LDAPS.

Standalone CA is intended for isolated or offline deployments and does not integrate with Active Directory.

Note: This example uses an Enterprise Root CA with a new private key to simplify the deployment. These settings are recommended for a new CA installation and are sufficient for LDAPS authentication in most lab and SMB environments.

Cryptography

Leave the default settings:

• Cryptographic Provider: RSA#Microsoft Software Key Storage Provider
• Key Length: 2048 bits
• Hash Algorithm: SHA256

CA Name

Specify a descriptive name for the Certification Authority or keep the automatically generated value.

Example:

ZY-Root-CA

Note: The default cryptographic settings are recommended for most deployments. The CA name identifies the Certification Authority and will appear in all certificates issued by this CA.

Step 3- Verify the Certification Authority

After completing the AD CS configuration, verify that the Certification Authority has been successfully installed and is operational.

1. Open Server Manager.
2. Click Tools.
3. Select Certification Authority.
4. Verify that the Certification Authority is listed and its status is displayed without errors.

Note: A green status icon next to the Certification Authority indicates that the service is running correctly and is ready to issue certificates.

Verify the Domain Controller Certificate 

1. Open Run, type certlm.msc, and press Enter.
2. Navigate to Certificates (Local Computer) → Personal → Certificates.
3. Verify that the Domain Controller certificate is present and includes the Server Authentication enhanced key usage.

Note: The Domain Controller must have a valid Server Authentication certificate to accept LDAPS connections over TCP port 636.

Verify LDAPS Connectivity

Verify that the Domain Controller is accepting secure LDAP connections on TCP port 636.

Run the following command in PowerShell:

Test-NetConnection localhost -Port 636

Verify that TcpTestSucceeded is True.

Note: If the test fails, verify that the Domain Controller has a valid Server Authentication certificate and that the Active Directory Domain Services service has been restarted after the certificate was issued.

Step 4 - Export the Root CA Certificate

1. Open Certification Authority.
2. Right-click the Certification Authority and select Properties.
3. On the General tab, click View Certificate.
4. Go to the Details tab and click Copy to File....

Note: Export only the Root CA certificate. Do not export the private key.

1. Select Base-64 encoded X.509 (.CER) and click Next.
2. Specify a file name and click Finish.

Step 5 - Import the Root CA Certificate into the Firewall

• Log in to the USG FLEX H web interface. 
• Navigate to System → Certificate → Trusted Certificates. 
• Click Import. Enter a Name (for example, ZY-Root-CA). 
• Select the exported ZY-Root-CA.cer file. 
• Click OK to import the certificate.

Note: The imported CA certificate will be used to verify the identity of the LDAPS server during the TLS handshake.

Step 6 – Install the Network Policy Server Role

Install the Network Policy Server (NPS) role on your Windows Server.

1. Open Server Manager.
2. Click Manage > Add Roles and Features.
3. Select Role-based or feature-based installation.
4. Select the destination server.
5. Under Server Roles, expand Network Policy and Access Services and select Network Policy Server.
6. Click Next, then Install.
7. Wait for the installation to complete, then click Close.

After the installation is complete, the Network Policy Server management console will be available under Tools in Server Manager.

Step 7 – Register the NPS Server in Active Directory

Before configuring RADIUS clients and network policies, register the NPS server in Active Directory. This allows the NPS server to read user account information and authenticate Active Directory users.

1. Open Server Manager.
2. Click Tools > Network Policy Server.
3. In the left pane, right-click NPS (Local).
4. Select Register server in Active Directory.
5. Click OK to authorize the server.

After the registration completes successfully, the NPS server is ready to authenticate Active Directory users.

Useful Commands for the NPS Server

Register the NPS server

netsh nps add registeredserver

Remove the registration

Remove-ADGroupMember "RAS and IAS Servers" -Members "$env:COMPUTERNAME`$" -Confirm:$false

Verify the registration

Get-ADGroupMember "RAS and IAS Servers"

Step 9 – Add the Zyxel Firewall as a RADIUS Client

To allow the Zyxel Firewall to send RADIUS authentication requests, add it as a RADIUS client on the Microsoft NPS server.

Open Network Policy Server, then navigate to RADIUS Clients and Servers → RADIUS Clients. Right-click RADIUS Clients and select New.

Configure the RADIUS client using the following settings, then click OK.

Setting	Value
Friendly name	USG FLEX H
Address (IP or DNS)	192.168.162.1
Vendor name	RADIUS Standard
Shared secret	Same shared secret configured on the Zyxel Firewall
Confirm shared secret	Re-enter the shared secret

Note: The Shared secret must exactly match the Key configured in the Zyxel Firewall RADIUS server profile. Otherwise, the NPS server will reject authentication requests.

Step 10 – Configure the Network Policy

1. Open Network Policy Server.
2. Go to Policies → Network Policies.
3. Right-click Network Policies and select New.
4. Click Add, select Windows Groups, then click Add.

Add the Active Directory group that will be allowed to authenticate (for example, VPN Users), 

then click Next.

Step 11 – Configure Authentication Methods

Configure the following authentication methods:

EAP Types

• Microsoft: Protected EAP (PEAP)
• Microsoft: Secured password (EAP-MSCHAP v2)

Less secure authentication methods

Enable:

• Microsoft Encrypted Authentication version 2 (MS-CHAP-v2)
• Unencrypted authentication (PAP, SPAP)

Click Next to continue.

Note: PAP is required for SSL VPN authentication with Microsoft NPS. Disabling PAP will cause SSL VPN authentication to fail.

Step 12 – Configure VPN Authentication

Verify VPN Authentication

Verify authentication using both supported VPN clients.

SecuExtender IKEv2	SecuExtender SSL VPN

Important:
After making any changes to the VPN configuration on the firewall, download the updated VPN configuration file again and re-import it into SecuExtender or OpenVPN Connect before testing. Using an outdated client configuration may result in connection failures or unexpected behavior.

Troubleshooting

• Verify RADIUS Configuration

show config aaa

Verify the RADIUS server IP address, authentication port (1812), shared secret, and NAS IP address.

• Verify IPSec Remote Access VPN

show config vrf main ike

Verify the authentication server and allowed users.

• Verify SSL VPN

show config vrf main sslvpn-server

Verify the authentication server and allowed users.

• Verify User Objects

show config object user-object

Verify the user type, authentication server, and Group Identifier.

• Verify Connectivity

ping <NPS_Server_IP>

• Verify Authentication Events

Check Event Viewer → Network Policy and Access Services for authentication results and other important events.

• Capture RADIUS Traffic

Capture traffic on the NPS server using Wireshark.

The following capture shows an SSL VPN authentication request. The presence of the User-Password attribute in the Access-Request packet indicates that PAP is used for RADIUS authentication.

The Microsoft NPS event log confirms the authentication method used (Authentication Type: PAP).