802.1x-Radius Wireless Authentication

[jayemm]

We have recently invested in a Cisco Wireless Lan Controller and 30 Cisco 1252b/g/n access points.

 

Currently we use a WPA(2)-PSK TKIP setup which is a bit of a pain with almost 300 laptops. So I am thinking that it would be wise to explore using 802.1x and Radius to make it easier and in theory more secure.

 

We have 2008 DC's and wondered if anyone had experience of doing this themselves or have a guide that they stumbled across? I have seen one relating to server 2003 on the forum so wondered if anyone has followed this in server 2008?

 

Any help or pointers greatly appreciated as this is all new territory to me.

[steve]

We use the WLC with the Cisco radius software. Works pretty well.

 

Should be similar on a windows radius box.

 

As you can set up multiple SSIDs on the Cisco kit, try creating one using radius as a test, can't hurt :-)

[ssiruuk2]

Ive done this using the autonomous Cisco APs rather than with a controller and Windows IAS / Radius on our domain controllers using certificates. Works well apart from when a laptops system clock goes miles off skew for some reason and invalidates the certificate!

 

I used the Microsoft documentation for Protected EAP but this was all written for Server 2003.

[powdarrmonkey]

Let me google that for you

[dawson]

I did some internal testing of this solution.

Testing setup was 2008 domain with Netgear AP. Clients was windows XP /Windows 7

 

Windows XP had a large limitation that the network can authenticate against the domain computer account, but if you want to have user authentication as well, the re-authentication from computer to user happens during the logon process. This breaks roaming user profiles + scripts as the network connection is lost then reconnected. I believe Vista has this same limitation. A Microsoft page said this was by design and not going to be resolved. (lost the link i'm afraid)

Windows 7 resolves this issue by re authenticating before the normal login process starts, and works well, however as we are not ready to roll out win7 my testing stopped at that point.

 

 

The IAS logs are a bit of a mare to follow, but goggling for ias log viewer brings up some shareware software that gives an reasonable hint to the issue in english. It crashes on exit of the program but doesn't seem to do any harm other than that.

[plexer]

Troubleshooting it with IAS was another reason why I use Elektron radius server.

 

Ben