Windows 7 won't connect to WiFi using Radius. Windows 8 will.

[Sam_Brown]

We have RADIUS set up and our WiFi uses it to authenticate devices onto the network.

 

We have three rules set up.

 

1) School Computers WiFi - If Computer is member of Domain Computers allow it to connect.

2) Student BYOD - Asks for User and Pass. If user is member of Student Group allow it to connect.

3) Staff BYOD - As above but if Staff allow to connect.

 

Recently opened up the Student BYOD scheme to more students and for phones and iPads it works fine. The issue is with Windows Devices. If it's Windows 7 it will ask for User and Pass but will give a generic error message stating it was unable to connect. Looking on the logs on the NPS server we have an entry which states:

 

"Certificate user or computer provided as proof of identity chains to an enterprise root certificate authority that is not trusted by the NPS server"

 

However Windows 8 laptops can connect with no issues as all!

 

Seems to be an issue with both Staff and Student BYOD.

 

Any ideas?

[win]

You need to go into the wireless properties of that network and untick the requirement for a certificate

[Sam_Brown]

On the Wireless Controller I'm guessing?

[plexer]

You need to go into the wireless properties of that network and untick the requirement for a certificate

 

Well that's one bypass you could try or if that was indeed the problem you could publish the certificate for enrolment it really would be best practice to use certificates to prove authenticity of the radius server.

 

Ben

[Sam_Brown]

Well that's one bypass you could try or if that was indeed the problem you could publish the certificate for enrolment it really would be best practice to use certificates to prove authenticity of the radius server.

 

Ben

 

I'm all for best practice. I admit this is all new for me so any advice would be massively appreciated. How would I publish the certificate seeing as it's BYOD and not a domain joined device? Do I set this up on the NSP server or WiFi controller? Also I don't know exactly what certificate it's referring to!

[win]

For the client on Windows 7. Not ideal of course but it will work.

[plexer]

We need a bit more info on your setup, what wireless controller? what is doing the radius auth is it the controller or a server?

 

Ben

[Sam_Brown]

* Meru

* Server 2k8 NAP server

[plexer]

It's the certificate for the NPS server:

 

http://social.technet.microsoft.com/forums/windowsserver/en-US/d51b56b1-6d1d-4e4f-9888-9cb3a2ad27dc/nondomain-computer-certificate-authentication-in-nps

 

Is what you need to do.

 

Ben

[Sam_Brown]

It's the certificate for the NPS server:

 

http://social.technet.microsoft.com/forums/windowsserver/en-US/d51b56b1-6d1d-4e4f-9888-9cb3a2ad27dc/nondomain-computer-certificate-authentication-in-nps

 

Is what you need to do.

 

Ben

 

Unfortunately not that (i think). This is purely for BYOD so manually putting certificates on the end user devices isn't viable. We've had this set up for a while now and only recently has it started playing up. It's been working fine authenticating based on which groups the computer \ user are a member of in AD. Also doesn't answer why windows 8 is fine but not 7? I'm wondering if Rule 1 is conflicting with the others but doubt it.

 

When signing in on iPad or other device you do get a certificate error (which you can bypass - obviously why non windows machines still connect) but it's not for the user or the device but the one it's received from the actual server and I'm unsure why as all certificates on the server are valid and haven't expired.

[plexer]

True as it's for BYOD using radius like that is probably not the ideal solution a captive portal would be better, I'm assuming things are different between 7 & 8 but don't have any documentation at this moment to back up that assumption.

 

https://community.merunetworks.com/merunetworks/topics/how_do_i_setup_captive_portal_splash_screen

 

It will still use radius to auth the username is correct but you won't have the issue with the certificate.

 

Ben