Network Policy Server

Question

We use NPS as radius authentication for my cisco devices, so if we need to login to the cisco device then we need to enter the AD username and this is working fine. In the cisco device i also have local user and radius (NPS) was setup as 1st authentication method. So the device will authenticated use local account from device only if radius (NPS) is failed to respond or radius (NPS) is dead.

Now we have requirement that we can use local account also together with radius (NPS) user and to enable this then we need to change message reply from NPS from reject to drop if the entered user not in radius (NPS). How we can change the reply message from reject to drop on NPS?

Answer 1

Hello Handian,

NPS can’t be configured to “drop” requests instead of sending a reject by design, RADIUS servers must reply with either Access‑Accept or Access‑Reject. There’s no supported way to make NPS silently ignore invalid users. If you want Cisco to fall back to local accounts even when the username isn’t in AD, you’ll need to adjust the device’s AAA method list. Set RADIUS as the first method and local as the second, but allow reject responses to still trigger the local fallback. In Cisco IOS, this is done by configuring aaa authentication login default group radius local so that if RADIUS rejects or is unreachable, the device will check the local database. The change has to be on the Cisco side - NPS cannot be modified to “drop” instead of “reject.”

I really hope it's helpful to you!

Harry.

Answer 2

NPS cannot be configured to “drop” an Access-Request instead of replying with Access-Reject when a request does not match any policy or when credentials are invalid.

According to NPS connection request processing:

• RADIUS Access-Request messages are processed or forwarded only if they match at least one connection request policy.
• If the settings of an incoming Access-Request do not match any connection request policy, NPS sends an Access-Reject to the RADIUS client and the user is denied access.

This behavior is by design and is not changeable to a silent drop. NPS can:

• Process requests locally as a RADIUS server.
• Forward requests to another RADIUS server as a RADIUS proxy.
• Discard requests only when they do not match any policy, but in that case it still returns Access-Reject to the client.

To allow local accounts on the Cisco device to be used when AD/NPS users are not found, the behavior must be controlled on the Cisco side (for example, by changing AAA method lists or local/remote user matching), not by changing NPS’s response type.

---

References:

• Connection Request Policies
• Connection Request Processing
• Network Policy Server overview