radius setup issue

[mrbios]

So I've FINALLY got round to attempting to bring our wireless into the 21st century.....

 

I've got a working RADIUS server, a test SSID that's setup to connect to that radius server, and as a logged in user i can connect fine. I've deployed a wireless profile via GP to a test machine and removed any other SSIDs from it.

 

Now GP deployed, i've restarted and i get no machine authentication, so at that point i think to myself i've missed something. BUT in actual fact, if I'm too quick to press ctrl+alt+del after a restart i don't get the "Windows will try to connect to Test-Network" under the password box...it seems i have to let it sit on the ctrl+alt+del screen for 5-10 seconds before trying to login will have that text there.

 

Trying to login even repeatedly without returning to the ctrl+alt+del screen for 5 minutes won't allow it, once i let it go back to the ctrl+alt+del screen and go back in, it'll use the wireless profile and login fine. Is this a typical issue others have seen? Obviously i guess i don't want to force it to wait for the network as, if a device leaves the network and wants to login with offline files or a local login, it'd be waiting forever?

 

EDIT: I think i get it, it's because i have single sign on turned on, what i really need is machine authentication........not sure how to configure that yet.

Edited September 25, 2014 by mrbios

[mrbios]

For some reason on NPS (Server 2012 R2) whenever i add domain computers to a network policy it fails to connect. Can't work out what I'm doing wrong.

 

If i change it back to just domain users it works fine. How does one configure radius so that it authenticates a PC based on it being a domain connected device without an AD login?

[plexer]

When I set this up I had 2 security groups wireless_users and wireless_machines and as long as the user or computer was a member of those groups they could log on, those groups were linked to the policy configured in nps.

 

Ben

[mrbios]

Seems the issue wasn't my NPS server, it was a combination of settings within my aruba controller. Found a nice document that walked me through everything here: 802.1x

 

Now got machine authentication using one set of rules, followed by user authentication using a different set of rules also depending on the type of user all working nicely now Been a successful day.

[mrbios]

I've got some more radius questions...

 

I've now worked out how to setup my SSIDs with corrosponding profiles correctly, and i know how to split people in to differing groups such as a students SSID with more restrictive firewall rules etc. but I think i need an idea as to how some others do their wireless overall with RADIUS....

We've got some iPads, we've got some learnpads, we've got some surfaces (RT). Obviously all of those on different platforms, and i'd like them to connect to an enterprise wireless. I don't mind getting the kids to put in their usernames to connect to the wireless on the surfaces but on the iPads and learnpads i need the wifi to be ever present regardless of who's using it. Do i need to just connect them all using a basic student account and have them save the settings in the same essence as a PSK would?

 

How many SSIDs do other schools have?

 

I'm currently considering the following:

Staff

Students

Guests

Mobile devices - the ipads, learnpads, surfaces that belong to the school. Though these will likely have exactly the same restrictions as the studetns one.... (The only thing i was thinking i'd do with this one is making it hidden)

 

Suggestions please? I can't organise my thoughts properly at the moment, so many things going on at once at the same time as trying to sort this out and it's starting to stress me out

Edited October 8, 2014 by mrbios

[ADMaster]

Hello @mrbios

I used to have only two ssids schoolname and guest. I have now added chrome for radius accounting to web filter. That's another story though.

 

For devices such as the ipad I have created a generic AD account and push the credentials with meraki profile.

 

 

You can use dynamic vlan assignment to have the staff / students / mobile devices all go to their own vlan with different settings.

 

This will consolidate all the authenticating users into one ssid and then have a guest ssid.

 

 

Here is an article on dynamic vlans with nps

Wifi Nigel: Microsoft NPS as a RADIUS Server for WiFi Networks: Dynamic VLAN Assignment

 

Cheers,

[mrbios]

Cheers ADMaster, will take a look at dynamic vlan assignment

 

I changed things a little since my last post, at the moment i have:

1 x SSID using radius for domain connected devices

1 x SSID using radius called BYOD for everything and anything staff and students bring in which isn't domain connect, restricted access to everything bar the internet and one specific host address for foldr (set to need user authentication prior to allowing it) i was going to set a fair bit of vlan security on this one too like the guest one.

Guest SSID using the captive portal on the aruba system, and heavily restricted to anything but the internet

1 x hidden SSID using an WPA2-PSK for the mobile devices.....i can't seem to get the learnpads to connect using RADIUS, I need to speak to them though, I'm sure learnpad will answer why for me.

 

I like the sound of having all the authenticating users in one vlan, but can i separate devices which are using machine auth only or both machine and user authentication from those using user authentication only? and how would i do that? If i could do that then i could combine my BYOD and domain connected devices SSIDs together.

[ADMaster]

Well, I use Cisco ACS so can't speak 100% for NPS. However I have set it up in a VM to check it out and this looks like the setting you need.

 

Instead of using a user group just use a computer group.

 

If you want to put all domain PC's in the same vlan to start just use the domain computers group. Otherwise you will need to create computer groups for the vlans you want them in.

 

You can get a powershell script to create AD groups based on OU, this would give you computer groups to work with based on a structure you already have.

 

[mrbios]

@zag just seen your post in another thread that you've been using aruba for a while, got a question...

 

Can you explain the part each of these play in authentication (like in what order they take place)

 

AAA profile:

initial role

802.1x default authentication role

 

802.1x authentication profile:

Machine Authentication: Default User Role

 

The "initial role" isn't mentioned in some documentation i have, it's confusing me as to what comes first....my thinking was that initial role should be restrictive to only allow dns dhcp, then when the user logs in they get the 802.1x default authentication role, but then what's the 802.1x authentication profile roles for? I've only started playing with my Aruba box these past few weeks (which is funny considering it's years old...it's an old 3200 controller on 6.1 firmware)

 

EDIT:

Playing around, am i right in thinking initial role is what happens pre-any authentication, and the two machine authentication sections only play a part when either machine or user auth have failed? If both user and machine auth complete then it uses the "802.1x default authentication role" from the AAA profile?

Edited October 13, 2014 by mrbios

[zag]

Sorry I'm not masively familiar with the inital roles. I just followed the guides to setup 2 simple SSID's.

 

We have our normal SSID set to "Trusted" and our BYOD SSID set to "guest logon" which automates the captive portal redirect I believe.

 

I played around with Radius at first but it was vastly complicated by our ipad and BYOD rollouts. I came to the conclusion it was not a good way to authenticate devices as we diversify more.

 

We now use MAC authentication and the firewall and vlan rules inside the aruba controller to seperate guest(student BYOD) traffic.

 

This allows us to have 2 SSID's when are completely separate without setting up any extra vlans on the switches. You can also use the firewall to deny any access to the servers.

[mrbios]

Ok I think I'm at the final hurdle, after a fair few hours of tweaking and adjusting firewall rules (found that enabling a deny all with logging ticked at the bottom of a rule then checking the process logs was VERY useful!) I've finally got the actual SSIDs and security how i like it.

 

Next step though is that i've got two RADIUS SSIDs, but currently anyone can connect to both, regardless of the device. I simply need to be able to restrict one of them so that only devices which are members of the domain can connect to it. I thought it would be as simple as adding windows groups > domain computers to a separate rule from users, but it seems you can't use two sets of groups in one NPS policy otherwise authentication fails. At the moment i've got windows groups > domain computers or domain users set in one rule. What i really need is domain computers and domain users.

 

So how can i restrict one SSID so that only domain computers and users can connect? Ideally i'd stop domain computers from being able to connect to the other one at all but im not bothered about leaving the other as domain users wholely if i can't do that.

 

EDIT: Nevermind, I've sorted it now, slightly different to how i planned but it works well. I just want to restrict domain computers from using my BYOD SSID now, it's a pity the NPS conditions can't be reversed....

EDIT2: actually, nevermind both sorted, that was surprisingly simple (typical, looking for a complicated way to solve a problem, i end up completely bypassing the simplest solution)

Edited October 15, 2014 by mrbios