Modern Wi-Fi authentication?

[supportman]

Good morning,

 

How does everyone authenticate on their main school Wi-fi?

 

We've always used a WPA2 Enterprise key as well as MAC address filtering, But with the rise of private Wi-Fi addresses on various devices it sounds like that is a no go for the future.

 

I'm just installing a new Unify Wi-Fi 7 setup, so looking at the best way to distribute and setup a new Wifi SSID. Ideally it would come from Active Directory or be able to be silently rolled out.

 

How do you do it?

[mavhc]

mac address filtering isn't worth anything, easy to get around

 

1. Assume that a bad guy is already on your network, because a) anyone can plug a computer into a wired socket, b) if you get hacked you're already prepared, c) children.

2. Given 1, make sure everything is encrypted and needs auth, zero trust. Make sure multiple attempts to brute force passwords are blocked and alert you

3. Use GVM to scan the network every day and find flaws and default passwords

4. Use pingcastle to secure AD

5. Use lithnet and specops password scanner to find and block terrible passwords

 

If you want to, also use RADIUS

 

In addition, guest wifi can now be encrypted with OWE (Doesn't work on non ARM Macs though)

[FN-GM]

a) anyone can plug a computer into a wired socket,

 

 

802.1x will stop them from getting anywhere.

[Davit2005]

802.1x is still the most secure option for wired and wireless.

 

MAC addresses can be cloned

PSK is too easily shared on WiFi

 

MPSK is better for WiFi if 802.1x is not an option but if you are still relying on the MAC address you are in the same boat regarding MAC randomization and cloning.

[CHiLL]

For domain joined devices, we utilise NPS/RADIUS and Dot1x. Our domain machines accounts are members of either a group called "Dot1xStaff" or "Dot1xStudents". NPS is configured certificates and the clients receive the config via GPO. Assuming all the conditions are met, NPS will drop the machine into a specific VLAN.

For other devices such as iPads, personal/BYOD devices, etc, we have other WPA2 SSIDs for those, depending on requirements.

 

On a somewhat related but not directly note, back in 2015 when our network was redesigned, we had 802.1x implemented on both the Wi-Fi and wired networks. We had issues with Impero, mainly with WoL and broadcasting and turned 802.1x off for the wired network as a quick fix and all the network switch ports that devices were connected to were configured to an "UNAUTH" port, which dropped them into a large VLAN pool. It's now been like this for almost a decade and I would like to test 802.1x again by reenabling it on the wired network, but unsure how to go about it, because I've forgotten how to do this sort of network configuration. Is it simply a case of tagging the necessary VLAN ports on the switch or do any have to be left as untagged?

[Davit2005]

On a somewhat related but not directly note, back in 2015 when our network was redesigned, we had 802.1x implemented on both the Wi-Fi and wired networks. We had issues with Impero, mainly with WoL and broadcasting and turned 802.1x off for the wired network as a quick fix and all the network switch ports that devices were connected to were configured to an "UNAUTH" port, which dropped them into a large VLAN pool. It's now been like this for almost a decade and I would like to test 802.1x again by reenabling it on the wired network, but unsure how to go about it, because I've forgotten how to do this sort of network configuration. Is it simply a case of tagging the necessary VLAN ports on the switch or do any have to be left as untagged?

 

What switches do you use?

 

It is prob a matter of re-enabling AAA on the required ports if the rest of the config is there then setting the unauth/auth vlan.

Edited October 15, 2024 by Davit2005

[CHiLL]

What switches do you use?

 

It is prob a matter of re-enabling AAA on the required ports if the rest of the config is there then setting the unauth/auth vlan.

That rings a bell, I a long time ago having issues configuring ports to different VLANs because AAA was enabled and there were issues with GVRP too. We are using HP ProCurve 2530 switches with a 5406zl core. If I reenable AAA on a specific port, do I set all the VLANs on that port to auto? If this becomes too much back and forth from this thread, I'll split it out into it's own.

[Davit2005]

That rings a bell, I a long time ago having issues configuring ports to different VLANs because AAA was enabled and there were issues with GVRP too. We are using HP ProCurve 2530 switches with a 5406zl core. If I reenable AAA on a specific port, do I set all the VLANs on that port to auto? If this becomes too much back and forth from this thread, I'll split it out into it's own.

 

Yep if Radius giving out vlans then prob no need to set at switch level. Been 6-7 years since I played with this too, lol. Although we do use NAC auth BYOD ports they are only MAC based at the moment but the networks are seperated from our prod networks.

[mavhc]

802.1x will stop them from getting anywhere.

 

Yeah, but how many people have that set up? Either way, assume you're already hacked

[supportman]

Has anyone got some instructions on setting up modern authentication on Unify Wi-fi then?

 

We already have a radius server for our BYOD network but I am looking for a device based soluition rather than user based.

 

Seems a lot of people have different opinions on this!

 

Was just wondering how you all did it

[dmj]

Has anyone got some instructions on setting up modern authentication on Unify Wi-fi then?

 

Purely out of interest, why do you keep referring to 802.1x as 'Modern' authentication? It's been around for 20yrs, I'm sure Windows XP allowed this and we certainly had it setup on Win7.

[supportman]

Purely out of interest, why do you keep referring to 802.1x as 'Modern' authentication? It's been around for 20yrs, I'm sure Windows XP allowed this and we certainly had it setup on Win7.

Well I was hoping someone would have setup a wireless recently using the latest technologies that have reduced the need for old style certificates or keys.

 

Was hoping for something distributed via Active directory to our domain machines.

 

We've used a NPS radius server for years but it seems a rather traditional way of doing things.

 

Clearly the tech hasn't moved on as much as I hoped

 

I see WPA3 has been released and is available on the unify backend, but it doesn't seem to work with Wi-Fi 7 6ghz band and still doesn't really solve the problem of keys leaking from devices.

[dmj]

Well I was hoping someone would have setup a wireless recently using the latest technologies that have reduced the need for old style certificates or keys.

 

Was hoping for something distributed via Active directory to our domain machines.

 

We've used a NPS radius server for years but it seems a rather traditional way of doing things.

 

Clearly the tech hasn't moved on as much as I hoped

 

I see WPA3 has been released and is available on the unify backend, but it doesn't seem to work with Wi-Fi 7 6ghz band and still doesn't really solve the problem of keys leaking from devices.

 

Yeah it's mostly the same as it's always been in 'enterprise' Just be sure to use uptodate encryption.

AD should distribute everything you need.