Sam_Brown Posted October 2, 2014 Posted October 2, 2014 We have RADIUS set up and our WiFi uses it to authenticate devices onto the network. We have three rules set up. 1) School Computers WiFi - If Computer is member of Domain Computers allow it to connect. 2) Student BYOD - Asks for User and Pass. If user is member of Student Group allow it to connect. 3) Staff BYOD - As above but if Staff allow to connect. Recently opened up the Student BYOD scheme to more students and for phones and iPads it works fine. The issue is with Windows Devices. If it's Windows 7 it will ask for User and Pass but will give a generic error message stating it was unable to connect. Looking on the logs on the NPS server we have an entry which states: "Certificate user or computer provided as proof of identity chains to an enterprise root certificate authority that is not trusted by the NPS server" However Windows 8 laptops can connect with no issues as all! Seems to be an issue with both Staff and Student BYOD. Any ideas?
win Posted October 2, 2014 Posted October 2, 2014 You need to go into the wireless properties of that network and untick the requirement for a certificate
Sam_Brown Posted October 2, 2014 Author Posted October 2, 2014 On the Wireless Controller I'm guessing?
plexer Posted October 2, 2014 Posted October 2, 2014 You need to go into the wireless properties of that network and untick the requirement for a certificate Well that's one bypass you could try or if that was indeed the problem you could publish the certificate for enrolment it really would be best practice to use certificates to prove authenticity of the radius server. Ben
Sam_Brown Posted October 2, 2014 Author Posted October 2, 2014 Well that's one bypass you could try or if that was indeed the problem you could publish the certificate for enrolment it really would be best practice to use certificates to prove authenticity of the radius server. Ben I'm all for best practice. I admit this is all new for me so any advice would be massively appreciated. How would I publish the certificate seeing as it's BYOD and not a domain joined device? Do I set this up on the NSP server or WiFi controller? Also I don't know exactly what certificate it's referring to!
win Posted October 2, 2014 Posted October 2, 2014 For the client on Windows 7. Not ideal of course but it will work.
plexer Posted October 2, 2014 Posted October 2, 2014 We need a bit more info on your setup, what wireless controller? what is doing the radius auth is it the controller or a server? Ben
plexer Posted October 2, 2014 Posted October 2, 2014 It's the certificate for the NPS server: http://social.technet.microsoft.com/forums/windowsserver/en-US/d51b56b1-6d1d-4e4f-9888-9cb3a2ad27dc/nondomain-computer-certificate-authentication-in-nps Is what you need to do. Ben
Sam_Brown Posted October 2, 2014 Author Posted October 2, 2014 It's the certificate for the NPS server: http://social.technet.microsoft.com/forums/windowsserver/en-US/d51b56b1-6d1d-4e4f-9888-9cb3a2ad27dc/nondomain-computer-certificate-authentication-in-nps Is what you need to do. Ben Unfortunately not that (i think). This is purely for BYOD so manually putting certificates on the end user devices isn't viable. We've had this set up for a while now and only recently has it started playing up. It's been working fine authenticating based on which groups the computer \ user are a member of in AD. Also doesn't answer why windows 8 is fine but not 7? I'm wondering if Rule 1 is conflicting with the others but doubt it. When signing in on iPad or other device you do get a certificate error (which you can bypass - obviously why non windows machines still connect) but it's not for the user or the device but the one it's received from the actual server and I'm unsure why as all certificates on the server are valid and haven't expired.
plexer Posted October 2, 2014 Posted October 2, 2014 True as it's for BYOD using radius like that is probably not the ideal solution a captive portal would be better, I'm assuming things are different between 7 & 8 but don't have any documentation at this moment to back up that assumption. https://community.merunetworks.com/merunetworks/topics/how_do_i_setup_captive_portal_splash_screen It will still use radius to auth the username is correct but you won't have the issue with the certificate. Ben
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now