First the set up. 15 workgroup users, and we have a Watchguard firewall with VPN. Currently using the Watchguard to authenticate users for VPN access, but the boss wants to use server 2008 as the authentication server. The watchguard allows a relay to authenticate via RADIUS or AD. My question is can we use RADIUS as the authentication server without AD services? (they want to maintain workgroup setup, with no domain controller)
Don't bother with a 2008 Server if you're just using it for RADIUS. It's a waste of money. If you don't want/need AD integration, just prop up a Linux/BSD box with FreeRADIUS or use Watchguard's built-in authentication mechanism (they have one, right?).
Adding a Windows Server just for VPN auth doesn't make a ton of sense.
If I'm understanding correctly that you have local users on the Server 2008 machine and you're wanting to authenticate using those accounts, I've never seen a good way to do that. Just out of curiosity, why not go with AD services?
Why not save yourself some $ and some headache and just use unix box and run a radius server on it. Create local unix accounts for everyone, and they can authenticate via radius for the VPN. It works and doesn't cost anything. It would more secure as you can block it from the net completely if you wanted. At least until you needed to upgrade.
Else, if the server 2008 will run IAS, you can use it as a radius server. We have this set up with 2003, but it is a DC. Probably would work though.