RADIUS - Hybrid mschap AND certificates?

[ITGuyNW]

Hi all

 

I'm still getting my head around RADIUS/NPS fully.

 

Everyone in school is still on MSCHAPv2/password based authentication for RADIUS, but I now have some Windows 11 only devices that demand certificate authentication and this is the way I want it to go.

 

I'm trying to set this up in a way so that when a device is authenticating with NPS, if its Windows 11 it will do certificate based authentication and everything else can be the usual MSCHAPv2.

 

Is this possible? Is it a case of having the processing order set up in a way so that it looks at Windows 11 devices first and if they aren't part of that group, they move onto the next policy which is MSCHAPv2?

 

Any help or guides would be nice please, I think I'm just over thinking it!

[Davit2005]

Could you not add the Windows 11 machines to an AD group and use that in the NPS rule rather than relying on the OS as a condition?

[ITGuyNW]

Yeah I've added them to their own security group and I've created a network policy where anyone in this group would need to use a certificate instead of MSCHAP however that currently sits in a lower processing order than the normal MSCHAP policy.

 

If I put that policy above the MSCHAP policy, would devices not in that group simply skip over it? or would it cause 99% of the wireless devices to stop connecting to wireless?

[mrbios]

Domain owned or BYOD devices?

 

The former is easy:

Do you have a CA issuing certificates to your devices already? If so you want to setup an NPS rule that has "certificate or smart card" as the authentication type, with a server certificate assigned, and deploy a wireless profile to match. Just make sure you use "Key Storage Provider" as the cryptography type rather than legacy for Win10/11 devices. Lots of guides for all that.

EAP-TLS is what you're going for basically.

 

The latter:

No idea, services like clearpass can be used to onboard certificates as far as I'm aware but i've not looked into moving people off MSCHAP for BYOD yet personally.