RADIUS and IAS

[Ric_]

@Ashok: There's also the WPA2 supplement available for download from MS to enhance your security - this is what I will be using with my Bluesocket setup.

[HodgeHi]

@ashok,

 

How far off is that guide mate? I have to implement some wireless stuff and am also looking at what you have set already set up.

 

I could do with the help that your guide will bring me

[spc-rocket]

@Hodgehi,

 

My collegue is still working on the guide at the moment, he's completed the PEAP setup on the client and server, he's documenting the certificate authentication at the moment.

 

The reason why we decided to document both is that the PEAP method is easily the flexible when it comes to deploying wireless but certificate based is more secure.

 

You may want to start off with using PEAP. I personally think its secure enough for schools.

 

I will post the guide here when he's completed it.

 

Ash.

[HodgeHi]

OK thanks. sorry if i sounded a little pushy

[sahmeepee]

We got this working properly at our place this week. Having never touched the certificate authority stuff in anger before it took a lot longer then it should, 90% of which was head-scratching time. I am in the middle of writing this up and I'll wikify it as soon as humanly possible.

 

Our setup:

WS2003 on a DC with IAS and Certificate Authority & a standalone Root Certificate Authority (CA) set up

XPSP2 on the laptops

Linksys WRT54GL with DD-WRT v23 SP1 firmware (I can't express how good these are for under £40 each)

 

We are using PEAP - the clients trust the server because of its secure certificate; the server trusts the clients because they are domain members (MSCHAPv2 auth). As mentioned earlier, you can limit which computers are allowed in by putting the allowed PCs into a security group.

 

We push out our Root CA's certificate to the laptops via group policy (connected over a wire) so when they connect they trust the server certificate we push out straight away.

 

Some comments on the rest of this thread:

 

It is recommended to do both user and machine authentication to restrict user access and also computer authentication so GPO and startup scripts runs during the bootup.

 

If you need to authenticate users as well then yes, but I'm assuming that anyone logging on to one of our laptops with a domain account should be allowed access. If a laptop gets nicked, I'll take it off the domain. The problem with doing the dual authentication is the timing:

 

It logs on as a computer at first

Applies computer GPOs

The user logs in

It starts applying user GPOs AND It disconnects and tries to reauthenticate as the user at roughly the same time!

 

I've read a few posts suggesting that this makes a balls up of GPO application. Long story short: if you don't need user auth as well, set the policy to computer auth only.

 

BECTA say WPA2 and RADIUS for wireless

 

Then they aren't recommending Windows Server 2003 SP1. You can set all this stuff up using WS2003 SP1, but the one thing you can't do is tell the clients to use WPA2 via your wireless group policy - WPA is the best you can do until SP2. There may be a reghack for this: I might phone BECTA to ask . WPA is "secure enough" for now though, and when WPA2 is added to Group Policy it's just a quick policy change to deploy it, assuming your router allows WPA and WPA2 at the same time.

 

EDIT: sorry for the long post!

[Ric_]

@sahmeepee: There is a WPA2 supplicant that you need to install on your clients. This appears to work OK. I have also noticed that the Intel Pro/Wireless tool for the 2200BG chipset includes this and seems to work better.

[sahmeepee]

@Ric_: we've installed the WPA2 patch from Microsoft. Are you saying there's a way of enforcing WPA2 via group policy?

 

We're using laptops with the 2200BG cards in and the Intel tools seemed quite good, but pure Windows seems to be working fine with computer authentication so I decided to remove a variable!

[DMcCoy]

WPA2 is not available as one of the options in group policy last time I looked, as the template wasn't updated at the time.

 

Edit: I should point out that WPA is an option though

[Ric_]

@sahmeepee: Sorry, I thought you meant that WPA2 wasn't available.

 

The Intel tool is the business though and you can enforce WPA2 at the AP level.

[spc-rocket]

@sahmeepee

 

Why would you need to roll out the certificate to the client if they use PEAP (MS-CHAP v2)? If all the clients are joined to the domain then the CA cert will be automatically be copied in the root authority of the client when they join the domain.

 

I do agree with you point about only doing machine authentication, if people require more granular support then i suppose people should do both machine and user authentication.

 

As for the Becta's WPA2 requirement, not all requirements can be fulfilled and i don't really see a reason for deploying WPA2 in school at the moment because WPA is good enough in my opinion.

 

Shame about good old Microsoft supporting on a max of 50 radius clients on standard edition. The enterprise edition doesn't have any limit.

 

Ashok.

[Geoff]

You can push out client certificates with GPO's in AD anyway.

[sahmeepee]

@sahmeepee

 

Why would you need to roll out the certificate to the client if they use PEAP (MS-CHAP v2)? If all the clients are joined to the domain then the CA cert will be automatically be copied in the root authority of the client when they join the domain.

 

That's interesting. When I tried it, the root CA I'd created wasn't copied down by default to the client, so I popped it into a GPO which seemed to work. Maybe it's something to do with my root CA being "standalone" rather than "enterprise"? Or not giving it enough reboots? I'll try it without the GPO again at some point.

 

Shame about good old Microsoft supporting on a max of 50 radius clients on standard edition. The enterprise edition doesn't have any limit.

 

Yes, you can only have 50 RADIUS clients with standard, but that means 50 access points per IAS server, because you set the server up to look at the AP not the (laptop) client. If I get to the point where I have over 50 APs I wouldn't be too phased by sticking IAS on my other DC as well. If we get over a hundred APs I'm changing jobs .

[spc-rocket]

Hi,

 

Yeah i know the clients are actually APs. At our place we are trying to do both the APs and also the switches for (using 802.1x for wired connections) and we already have about 45 switches! and i know we will be drawn into the wireless bandwagon sooner than later i guess.

 

You're right about installing more ias servers, this will solve the problem or alternativily use the enterprise edition - maybe an overkill.

 

Regarding the certificate we tested it using the enterprise CA, so you may be right that if you use the stand-alone CA then it may not copy.

 

 

Ashok.

[Geoff]

A Linux server running FreeRadius will also overcome the limitation.

[sahmeepee]

Ashok,

 

Maybe stacking your switches where possible would reduce the number that the RADIUS server sees. With our 3com kit i think we can stack upto 8 switches into 1. I guess it depends on your switching kit and the layout of your cabinets though.

 

Well done for tackling 802.1x for your wired connections by the way. It's definitely a project I'd be interested in doing at some point. At the moment I'm a bit put off by the complexity of making port-by-port exclusions for "dumb" devices like printers/photocopiers/EPOS.

[spc-rocket]

@sahmeepee

 

Yeah we got few students who likes to plug in their own laptops on the network and also we're trying to tie down the ports from a security point of view. We use all cisco kit here and i'm trying to phase out older switches i.e. 2900xl and 3500xl which sadly don't support 802.1x.

 

enabling the 802.1x on cisco siwtches is not hard, cisco also supports the stacking but i'd like to have them seperate because of the vlan logging and also managing them via AAA authentication.

 

Ashok.

[ITWombat]

Dumb question but do all swiches have to be 802.1x aware before it can be implemented? If most switches in the network support it, especially the ones connecting the servers, can the older switches just pass along the extra information without processing it?

[spc-rocket]

Here's the completed step-by-step guide for configuring 802.1x wireless authentication using IAS and PEAP.

 

Please feel free to provide feedback and suggestions for improvements.

 

Thanks.

 

Ash.

ias_for_ashby_school_v1.1_200.pdf

[ranj]

BECTA say WPA2 and RADIUS for wireless

 

is that in a whitepaper on the BECTA site, I am trying to look for it. If you could let me know where that information is, it would be much appreciated.

 

thanks

[contink]

Linksys WRT54GL with DD-WRT v23 SP1 firmware (I can't express how good these are for under £40 each)

Would you still recommend these as good AP's to play with?

 

I'm currently considering more expensive units but if these will do the job as well as anything else out there I'd like to have a play with a couple of these first.

[mikep97]

Hello,

 

Let me first say, your document is amazing. Thank you so much for granularity of details you presented.

 

I am currently setting up IAS-2003, DD-WRTv24, WPA-Enterprise on my network and I have a couple questions. I am stuck at the wireless clients saying "validating identity" when they are trying to join the network. I think its because I dont have the certificates copied to the clients.

 

1) How is the wireless client validating the CA? Is it doing it through the DD-WRTv24 AP? I thought it just passes the username/password. But does it really pass the information for the CA look up?

 

2)Is there away to do the IAS-Radius authentication without the certificates? I would rather not have to copy the certs to all the wireless clients that are not in the domain.

 

thanks so much for the help, michael

[plexer]

Just change the wireless settings on your clients to not require the server certificate.

 

Ben

[contink]

Just to add my thanks for that document which got me through todays nightmare relatively intact.

 

For anyone else in the "fun" zone a couple of quick pointers:

1. Make sure if you're using a different VLAN on a WFS709TP that is actually has access to a port that can forward to the Radius server

2. Make sure you don't just set the rules to allow specific PC's you need to allow the actual users on them too! (That's the last 2 hours I wasted!)

3. If your Radius server is on a DC it'll already have a security cert issued to it (which might sound obvious but it had me puzzled for a little bit)

 

Otherwise excellent and I'll be wiki'ing some of the finer points about the netgear WLAN controller soon.. I think it's needed.

[dezt]

Just want to thanks for the document that was posted a while ago, i've now managed to configure my laptop trolley with WPA and radius authentication using a certificate as well. I'm well impressed at how easy it was to follow.

 

Thanks again

[jsnetman]

I have been asked by the LEA to tighten our wireless security as we are using WEP. Followed Asok's excellent howto and everything seems to be in place. However I am receiving an authentication failed when trying to connect manually from a wireless client laptop. Below is the entry in the logs:

 

User JSCHS\ajones_laptop was denied access.

Fully-Qualified-User-Name = JSCHS\ajones_laptop

NAS-IP-Address = 172.16.64.11

NAS-Identifier =

Called-Station-Identifier = 00-1A-70-A6-19-72:linksys-n

Calling-Station-Identifier = 00-14-A5-0E-8A-38

Client-Friendly-Name = LinkSys WAP4400N T6

Client-IP-Address = 172.16.64.11

NAS-Port-Type = Wireless - IEEE 802.11

NAS-Port = 0

Proxy-Policy-Name = Use Windows authentication for all users

Authentication-Provider = Windows

Authentication-Server =

Policy-Name =

Authentication-Type = EAP

EAP-Type =

Reason-Code = 48

Reason = The connection attempt did not match any remote access policy.

 

Can anyone help please.