Wireless Network Configuration

[ITGURU]

I will be setting up a new Wireless network over the summer, and will be changing all domain joined devices over to the new wireless.

 

Currently I use WPA2 AES for authentication with a key.

 

Is this still the most preferred method these days, or is it beneficial to use a NPS / RADIUS configuration for domain joined devices?

I have separate SSIDs for guests etc, so the main wireless would only be for domain devices.

 

I have NPS deployed for switches as radius clients for login, so have an existing setup.

 

However, am I right that clients need to have certificates for RADIUS authentication or can it be done by Computer authentication?

 

Does an NPS setup create more traffic than using a key, as want to keep wireless traffic to a minimum.

 

What are your thoughts/or how do you have your wireless set up?

 

Thanks.

[pantscat]

I'd say radius is preferred - more secure, and you'll have more granular levels of control.

If someone managed to get your WPA2 key then the whole thing is compromised - this is not the case with 802.11x.

 

You can use computer account authentication, NPS will happily do this.

 

Not really any more of an overhead compared with WPA2 in terms of authentication handshaking, with wireless traffic that's completely the thin end of the wedge anyway.

 

I'd strongly recommend using radius as your auth mechanism - further down the line you might want to segregate wireless devices, and radius would allow you to do clever things like dynamic VLAN assignment based on AD group membership... which is nice.

 

Ant

[ITGURU]

I'd say radius is preferred - more secure, and you'll have more granular levels of control.

If someone managed to get your WPA2 key then the whole thing is compromised - this is not the case with 802.11x.

 

You can use computer account authentication, NPS will happily do this.

 

Not really any more of an overhead compared with WPA2 in terms of authentication handshaking, with wireless traffic that's completely the thin end of the wedge anyway.

 

I'd strongly recommend using radius as your auth mechanism - further down the line you might want to segregate wireless devices, and radius would allow you to do clever things like dynamic VLAN assignment based on AD group membership... which is nice.

 

Ant

 

Thanks, do you know of any websites that would help me get this set up easily? I assume clients would still need a certificate issuing through GPO?

If the certificate services server were to change, is that an easy change to make, without affecting the end clients?

[pantscat]

I'm pretty sure I've got some fairly generic setup guides for using NPS. I'll see if I can find it!

 

Certificates are pretty straightforward - the NPS server needs to have a certificate issued to it by your internal cert authority, the clients don't need their own certs - and you should set the certificate server as a trusted authority in group policy.

 

If you were to change certificate servers, then make sure the new one is a trusted authority so the clients are aware of it, then you could issue a new cert to your NPS server. It *shouldn't* cause any issues if done correctly.

[pantscat]

Genericised - RADIUS setup.pdf

 

Have a look at this - it's some handover notes I prepared.

 

Hopefully this makes sense, if not - feel free to ask!

 

Ant

[ITGURU]

[ATTACH=CONFIG]37726[/ATTACH]

 

Have a look at this - it's some handover notes I prepared.

 

Hopefully this makes sense, if not - feel free to ask!

 

Ant

 

Thanks , I think i'm almost there! Taken an existing client and connected with the success showing in NPS server logs/event viewer.

However, I'm assuming that the client would already need to be a member of the domain, by adding through a hardwire connection?

 

Also, if I close the lid, and client goes to sleep, when it wakes up locked - it says there are no logon servers.

If I switch user, log on local as admin, the connection then re-connects.

 

Have I missed something? Fast re-connect is ticked.

[pantscat]

Yes, if you're using this method of authentication then you'd need to have already joined the devices to the domain.

 

Not entirely sure what could be causing that issue, do you have a group policy setting to wait for network at logon?

[ITGURU]

Yes, if you're using this method of authentication then you'd need to have already joined the devices to the domain.

 

Not entirely sure what could be causing that issue, do you have a group policy setting to wait for network at logon?

 

Think it was just that specific machine as tested with a couple of others and they re-initiate the connection.

For non domain devices (windows) it comes up asking for authentication but as as its computer authentication, entering a domain username and password fails the connection, is that right?

 

Also, when I connect to the network I just get a warning saying the certificate isn't trusted, but it still connects, so is this right, and prevents the need for having local certificates?

However I exported the local certificate from the NPS server and imported to the local machine but the message still came up./

[jamesfed]

A blog post series I did a while back that may well help out - Series: 4 SSIDs 1 Secondary Academy « my world of IT

 

Covers 4 different SSID setups each with separate purposes two of which use RADIUS/NPS.

[ITGURU]

A blog post series I did a while back that may well help out - Series: 4 SSIDs 1 Secondary Academy « my world of IT

 

Covers 4 different SSID setups each with separate purposes two of which use RADIUS/NPS.

 

Thanks, looks interesting reading - it did just occur to me as to whether ipads would support radius authentication, so guess they need to be a separate SSID and VLAN so that even if the PSK is retrieved they would only be able to connect to the apple vlan and not vlan 1 (main network) ?

[jamesfed]

Thanks, looks interesting reading - it did just occur to me as to whether ipads would support radius authentication, so guess they need to be a separate SSID and VLAN so that even if the PSK is retrieved they would only be able to connect to the apple vlan and not vlan 1 (main network) ?

 

Just one of many options - iPads do RADIUS very well indeed (even using Certs as the auth method)

[ITGURU]

Just one of many options - iPads do RADIUS very well indeed (even using Certs as the auth method)

 

Any help sites on setting up ipads for RADIUS authentication when using computer authentication? rather than user.

[pantscat]

Think it was just that specific machine as tested with a couple of others and they re-initiate the connection.

For non domain devices (windows) it comes up asking for authentication but as as its computer authentication, entering a domain username and password fails the connection, is that right?

 

Yep, exactly that.

 

Also, when I connect to the network I just get a warning saying the certificate isn't trusted, but it still connects, so is this right, and prevents the need for having local certificates?

However I exported the local certificate from the NPS server and imported to the local machine but the message still came up./

 

I think @jamesfed's excellent blog post illustrates the group policy setting you need - essentially you need to ensure that your cert server is a trusted root certification authority.

 

Any help sites on setting up ipads for RADIUS authentication when using computer authentication? rather than user.

 

That's a little different - as the iPads would be unknown to AD (e.g. they don't have computer accounts here) you could use mac address authentication with Radius... but there is a chance that the mac address could be spoofed, which is fairly easy to do.

I understand that you can do cert authentication with iPads, but haven't done it... but should be pretty simple.

[ITGURU]

Is it possible, and how would I duplicate the policies so that I could authenticate the ios devices with a username and password only, but still keep the windows devices as computer authentication. Essentially create an apple user account and use that account for the ipads?

[pantscat]

Yep, it's possible - create a new user account for authenticating the iPads, create a new security group, add the account to the group, then edit the NPS policy to also allow that group access.

 

That's the rough and ready way to do it.

[ITGURU]

Yep, it's possible - create a new user account for authenticating the iPads, create a new security group, add the account to the group, then edit the NPS policy to also allow that group access.

 

That's the rough and ready way to do it.

 

Need a bit of help with this - created a group, a user and added to the policy. However on the ipad it asks for username and password but doesn't accept it, as the policy is for computer authentication rather than user authentication?

 

The NPS log says Reason: The connection request did not match any configured network policy.

[pantscat]

Ah ok - check your NPS policy - under conditions does it specify "Windows groups" or "Machine groups"?

[ITGURU]

Need a bit of help with this - created a group, a user and added to the policy. However on the ipad it asks for username and password but doesn't accept it, as the policy is for computer authentication rather than user authentication?

 

The NPS log says Reason: The connection request did not match any configured network policy.

 

I added the user account to 'Domain Computers' then after entering the username and password, it worked. This also works on a workgroup computer if the certificate is install and can enter the user name and password.

 

However, when these credentials are used to login to the wireless on a ios device, there isn't any way to retrieve the username and password is there? So there isn't much of a security concern here for someone to find out the details??

[pantscat]

Not easily, as far as I am aware.