Radius, NPS and Certificates

[NGFireball]

Hi All,

 

Hoping someone can help me i am getting a little bit confused.

 

I am trying to move over to Radius for wireless for school devices, and eventually for BYOD as well.

 

What i would like to is to set up school devices to be authenticated on a device level (certificate for machines) and then once i get this up and running i want to do BYOD with user authentication.

 

From what i have managed to read i will need to setup CA to allow me to do certificates for the machines, but all the documentation keeps talking about user level stuff, which is not how i want the school devices to authenticate.

 

Can anyone share some good guides on this please?

[Guest obsidianpillar]

Sure, basically you need to configure NPS on a Server (you can do it on a DC, although personally I split as many roles across different servers as possible).

 

You didn't specify what Server OS you are running, so I will assume (although most probably incorrectly!) that you are running Server 2008 R2.

 

Follow through the guides that are within Windows in regards to installation of the role and then launch NPS.

 

Expand "RADIUS Clients and Servers", and right click on "RADIUS Clients" and create an entry for your AP. If you do not have a DNS entry for your APs, I'd suggest on creating one as you can see within the window it gives you an option for DNS. You can either generate a Shared Secret here, or use a custom one. Ensure that you have this configured on your AP's themselves/controller software as it will fail to authenticate.

 

Within NPS, under "Standard Configuration" select under the drop down option "RADIUS Server for 802.1X Wireless or Wired Connections". Follow through the options, adding in your APs to the "Wireless Clients" option that we configured previously.

 

For your authentication, under the drop down option, select whichever is supported. I personally go for PEAP, so select this one.

 

In your User Groups, add "Domain Computers" if you only want computers authenticating at the minute. Progress without configuring any other options and press finish.

 

In regards to CAs, your environment would depend on how to accomplish this. If you have no other CAs on your Domain, I will go over covering one quickly.

 

Install Certificate Services from Server Manager, within setup select "Enterprise" and then "Root CA" respectively, then creating a new private key. Accept all defaults on the next page and you are then offered a chance to configure the name of your CA. In my case, I always name mine "DOMAIN-CA" however, you may wish to adapt yours to your corporate environment. You will be offered a chance to pick an expiration date. I set mine for as long as possible, just as it's all internal so there's no massive security risks in doing this.

 

Proceed to click next on all other possible options, accepting all defaults.

 

Once this has finished installing, launch a blank MMC choosing to add the "Certificates" snap-in after the window has opened. Expand the tree to "Personal" and then "Certificates". You should see the CA you created earlier. Right click within an empty space within the MMC, selecting "All Tasks" and then "Request New Certificate", follow through the steps accepting defaults and click "Finish".

 

You clients should be able to connect now.

 

Additionally, you could register the NPS Server in AD (which I would recommend), and then create a Group Policy to deploy the CA we created to Trusted Root etc but if your after a proof of concept then the above should suffice!

 

Any other questions, feel free to reply.

 

Tom

 

EDIT: I see this was posted in the Server 2012 forum, whoops. - I run 2012 R2 internally. Fortunately, the steps are virtually the same.

Edited November 1, 2016 by obsidianpillar
See EDIT.

[NGFireball]

Thanks TomMagee, will take a look at getting this working tomorrow. and yes its server 2012 r2 i am running it all on.

[Guest obsidianpillar]

Thanks TomMagee, will take a look at getting this working tomorrow. and yes its server 2012 r2 i am running it all on.

 

No worries. If you have any problems in setup then report back here.

 

Tom

[NGFireball]

Ok so i have not managed to get it working yet, I have set up the NPS which was easy and specified the Wireless Controller.

 

On the wireless controller i have specified radius and pointed it to the server with NPS on and told both the shared secret that was generated.

 

On the wireless controller i have stated that i am using WPA2 (AES/CCMP with a dynamic key to enable 802.1x authentication, and selected the profile i created for the Radius.

 

I have exported the certificate from the CA, not sure what active directory enrollment policy i am suppose to select.

 

I have tried a few different Certificates and i can see in my log for wireless it authenticates but then just disconnects and wont reconnect.

 

I am using a HP MSM775 so maybe i am missing a step?

[Guest obsidianpillar]

Ok so i have not managed to get it working yet, I have set up the NPS which was easy and specified the Wireless Controller.

 

On the wireless controller i have specified radius and pointed it to the server with NPS on and told both the shared secret that was generated.

 

On the wireless controller i have stated that i am using WPA2 (AES/CCMP with a dynamic key to enable 802.1x authentication, and selected the profile i created for the Radius.

 

I have exported the certificate from the CA, not sure what active directory enrollment policy i am suppose to select.

 

I have tried a few different Certificates and i can see in my log for wireless it authenticates but then just disconnects and wont reconnect.

 

I am using a HP MSM775 so maybe i am missing a step?

 

Hi, sorry I haven't replied sooner. I have only just got back onto the forum.

 

I can't offer any specific advice regarding the HP MSM755 as I haven't used their products.

 

Have you launched MMC and seen what certs are there? Could you possibly post some screenshots of the configuration you've got running? Is this a new configuration or are there possibly some legacy settings somewhere that may impact on this running on your controller?

 

Thanks.

 

Tom

[NGFireball]

Hi TomMagee,

 

I have narrowed it down to a certificate issue, it will not accept it unless its the main CA cert, so i am currently looking into this issue.

 

Thanks for your guide though help me with some issues i had.

[Guest obsidianpillar]

Hi TomMagee,

 

I have narrowed it down to a certificate issue, it will not accept it unless its the main CA cert, so i am currently looking into this issue.

 

Thanks for your guide though help me with some issues i had.

 

No worries. Glad I could help!

 

Tom

[Duke5A]

Hi TomMagee,

 

I have narrowed it down to a certificate issue, it will not accept it unless its the main CA cert, so i am currently looking into this issue.

 

Thanks for your guide though help me with some issues i had.

 

So if you uncheck the validate server certificate option on the client it connects? Make sure the certificate you're using on your Radius server is in fact issued by the CA (not a self generated one) and the subject field contains the host name of the Radius server. Without the subject field filled in properly it won't work. When I did it I used the NPS Server template and setup the Radius servers for auto enrollment. It's been a couple of years, but I can help out if you need. Let me know.