---
title: Kron PAM GUI Configuration
slug: kronpam-reference-guide-3-4-0/kron-pam-gui-configuration
description: Learn how to configure the Kron PAM GUI for user and device management with this document. Follow the step-by-step instructions to create user groups, device groups, and device group realms. Ensure security by defining an authenticator secret key and conf
docTags: 
createdAt: 2022-08-01T11:54:22.000Z
---

Configurations in the Kron PAM GUI are required as well:

1. Create users and user groups. (See sections [Manual User Creation](docId\:NPupego5MOW_CIAIZbnHc) and [User Group Creation](docId\:L-fdAXhwREQ_NTmj6VUJE))
2. Create device groups and add new devices to device groups. (See sections [Creating User Groups](docId\:OIoF6fY7ax_QMcPw0qkYt) and [Adding Devices Manually](docId\:u3mFUFJ-8ma6OB8ntB9hl))
3. Create device group realms with the user groups and device groups defined in the previous steps (See section [Creating Device Group Realms](docId:-CDZPYr1Q99ecaHQkrFQm))

:::hint{type="info"}
The devices added in Step 2 must correspond to the last destination IP that sends an authentication request to Kron PAM. For example, Wireless LAN Controller, Firewall, etc.
:::

1. Define the authenticator secret key as **globalSecretKey **on the device group properties. (See section [Device Groups Properties](docId\:lvjco9nBk8MOFIUTXbvl2))
2. Navigate to **Administration**> **RADIUS 802.1x Config**.
3. Click on the **RADIUS 802.1x** button.
4. Choose an **EAP Typ**e (only PEAP is currently available)
5. Fill in the fields **Certificate Authority PEM**, **Certificate Private Key PEM** (which includes a certificate and private key), and **Certificate Private Key Password**.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/DouK0LFWqwHbjRkbjZNIP_image.png "802.1x Configuration")

- If Dynamic VLAN and MAC filtering are to be activated, the box(es) should be checked. (See section [MAC Filtering Configuration](docId:-Yn0b7O-tRWmkME3uGWjm))

:::hint{type="info"}
VLANs can be dynamically assigned by a RADIUS server to applicants requesting 802.1X authentication through that server. If dynamic VLAN is assigned to applicants, the following 2 settings must be set in Kron PAM:

1. Check the dynamic VLAN box in the 802.1x config screen
2. The RADIUS Attribute Policy should be defined on the related user group as VLAN interval. See section [Adding RADIUS/TACACS+ Attributes](docId\:kswRf-xTczryrd4r8elaI)
:::

- Check the **Add Kron PAM Server to Active Directory** box and fill in the required fields:

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/bFgVMCf0L2r9gWnAg5cuA_image.png" size="42" width="606" height="604" position="center" caption="802.1x Active Directory Configuration" showCaption="true"}