802.1x with UniFi and AAD

[DalekSec]

Morning All,

 

I'm looking to improve our WiFi secuirty as currently our main network is wpa2/wpa3 with PSK, i'm used to using 802.1x with RADIUS, NPS etc.

 

The issue i have is we are fully cloud based, with onsite UniFi controller and AAD. I did find an online solution called SecureW2 but found out it costs $5000 for just 100 devices!

 

Does anyone know of a way to implement this? We could get servers up and running to do this but having looked into it will require us to go hybrid and reimage all the devices

[LewRichAIM]

Not sure if you ever got anywhere with this, I am in the same boat, I too looked at paid for solutions and as you say they are crazy money.  I have a test system setup which is FreeRADIUS with Dalo on top which is a GUI for it.  Then the community edition of SCEPman.  All hosted in azure.  All working so far, one "secure" WiFi SSID with certificate authentication for Windows devices.  Chromebooks will use a username and password as SCEPman CE doesn't work with them, only the paid version.  All with dynamic VLAN assignment.  My slight concern is how stable this will all be at scale. We are going to try it at one site and see how it goes.  We also have a separate guest/byod network, which is Art of WiFi works a treat with unifi and it's cheap.  You can host it with them, but we just run it on a Linux box in house.

[DalekSec]

I never got as far as you, we don't have any internal servers to run certain parts on plus its on too many systems that i don't know well and not that i don't trust them but i'd rather pay for a SaaS that just works, but doesnt cost a bomb! 

[RobFuller]

Thanks for the update @LewRichAIM this is very interesting. I've been considering this on and off for sometime now and wondered how FreeRADIUS could interactive with Microsoft Cloud PKI to achieve this as you have been testing. Be interesting in seeing how you have device authentication via Entra ID and FreeRADIUS setup.

For reference closes SaaS I got at a reasonable price was Foxpass, Advanced Radius with Certificate + Extended Logs 1000-2499 users around £3500 depending on currency/exchange rate etc. (There are UK resellers).

[LewRichAIM]

Sorry for the delay, so far it's working well, SCEPman CE is the certificate authority, then FreeRADIUS as the gateway.  Intune policies pushed out are:

 

SCEPman root certificate (10 year)

FreeRADIUS certificate (10 year)

SCEPman issued student device certificate 

SCEPman issued staff device certificate 

Secure WiFi profile for staff

Secure WiFi profile for students 

 

SCEPman automatically issues the certificates to staff and student devices via the Intune policy, you point it at SCEPman.  These have a validity period and are auto renewed when they get close to expiring.  The CN for the cert either has STUDENT then the entra device ID or just the device ID.

 

FreeRADIUS has some config which says if the CN on the certificate has STUDENT in front of it then drop it on the student VLAN.  If not drop it on staff.

 

Chromebooks are done via a username and password configuration in Dalo/FreeRADIUS, the users have reply attributes set which put the device on the student VLAN. The reason for this is the community edition of SCEPman only supports talking to Intune, the full paid for version does but that's very expensive.

 

From some rough calculations this will cost around £80 a month in hosting costs, you could reduce this if you host FreeRADIUS on prem, but we have multiple sites so was easier to host in Azure.

 

Today was the day we moved into production so the policies have been pushed out via Intune, we will give it a few weeks for everything to pick them up, then turn off out old WiFi networks.  Chromebooks are already running on this as of Monday this week.

[RobFuller]

Excellent work! Think this needs to be added to my development plan 😄

 

[DalekSec]

Damn good work, will look into this method for our new site!