---
title: Kron PAM GUI Configuration
slug: kronpam-legacy-ui-reference-guide-3-5-0/kron-pam-gui-configuration
description: Learn how to configure the Kron PAM GUI for user and device management with this document. Follow the step-by-step instructions to create user groups, device groups, and device group realms. Ensure security by defining an authenticator secret key and conf
docTags: 
createdAt: 2022-08-01T11:54:22.000Z
---

Configurations in the Kron PAM GUI are required as well:

1. Create users and user groups. (See sections [Manual User Creation](docId\:pfHVdXN_6LJl73oSascut) and [User Group Creation](docId:05DTjyQ4pGFvEV5IDaLOg))
2. Create device groups and add new devices to device groups. (See sections [Creating User Groups](docId\:HERw3UPZRBaOPLTAX3Faj) and [Adding Devices Manually](docId\:Z3_txAuO9otqIZ8j0R1GT))
3. Create device group realms with the user groups and device groups defined in the previous steps (See section [Creating Device Group Realms](docId\:W7ZY5pZbQLA8WnUAsCFzW))

:::hint{type="info"}
The devices added in Step 2 must correspond to the last destination IP that sends an authentication request to Kron PAM. For example, Wireless LAN Controller, Firewall, etc.
:::

1. Define the authenticator secret key as **globalSecretKey **on the device group properties. (See section [Device Groups Properties](docId\:sk53fcyfCDzX5kdAm8PKx))
2. Navigate to **Administration**> **RADIUS 802.1x Config**.
3. Choose an **EAP Typ**e (only PEAP is currently available)
4. Fill in the fields **Certificate Authority PEM**, **Certificate Private Key PEM** (which includes certificate and private key), and **Certificate Private Key Password**.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/AU-cShign4n4DG85-qR0d_image.png "802.1x Configuration")

- If Dynamic VLAN and MAC filtering are to be activated, the box(es) should be checked. (See section [MAC Filtering Configuration](docId\:snJC_WVZjLVYV5lz-wEDk))

:::hint{type="info"}
VLANs can be dynamically assigned by a RADIUS server to applicants requesting 802.1X authentication through that server. If dynamic VLAN is assigned to applicants, the following 2 settings must be set in Kron PAM:

1. Check the dynamic VLAN box in the 802.1x config screen
2. The RADIUS Attribute Policy should be defined on the related user group as VLAN interval. See section [Adding RADIUS/TACACS+ Attributes](docId\:XIr26yctLHu08ddSZNfx_)
:::

- Check the **Add Kron PAM Server to Active Directory** box and fill in the required fields:

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/hpljbAORnKJfmXaRupUKG_image.png "Add Kron PAM Server to Active Directory ")