Wireless Setup

[Netwacky87]

Ritey Oh!...First off and I must apolagies about this, going over the same old topic of Wireless Setups, i have gone over previous threads but nothing that can answer me for sure,

 

Ive been playing around with MS IAS for our RADIUS server, which is fine and no problems setting up at all,

 

Now what i do have a problem is how the stupid thing works lol, I can get the wireless to connect right, but only after its joined to our network and its automatically downloaded the certificate it needs (which is via GPO),

 

Now to me this isnt ideal...Why would you physically connect the laptop and then go off and use it wirelessly?...is that not backward?

 

Is there any sort of Guest setting? or how to setup a guest client?, Im sorry if im going over the same questions/topics!

 

Only other way i can get a client to connect is by manually telling the client NOT to check server certificates.

 

Many MANY thanks in advance!

 

Mart

[sted]

if i remember correctly if you point a client an http:\\servername\certserv (you will have to check iis for exact web address as i only have it in 1 school and it was set up by the "prefered" internet provider so im not exacly an expert in it) then users can get their own certificate

 

p.s. how do you get clients to automaticcaly download a certificate ive been having to do it via mmc console

[powdarrmonkey]

Now to me this isnt ideal...Why would you physically connect the laptop and then go off and use it wirelessly?...is that not backward?

 

So that you can be confident that you transferred the cryptographic certificate to the machine in a trustworthy manner (i.e. you can be sure you didn't get some imposter's certificate, which would let them read your secrets).

 

Is there any sort of Guest setting? or how to setup a guest client?, Im sorry if im going over the same questions/topics!

 

Not in RADIUS; guest access is a feature of your authentication provider, which in your case is IAS and doesn't have such a thing.

 

Only other way i can get a client to connect is by manually telling the client NOT to check server certificates.

 

This is BAD; you want certificate checking so you can be sure your clients aren't leaking authentication details to a rogue access point. For the same reason, it is vital to ensure your certificate key is kept properly secured.

 

if i remember correctly if you point a client an http:\\servername\certserv (you will have to check iis for exact web address as i only have it in 1 school and it was set up by the "prefered" internet provider so im not exacly an expert in it) then users can get their own certificate

 

That would be http://yourserver/certsrv, where yourserver is the name of your certification authority server.

 

p.s. how do you get clients to automaticcaly download a certificate ive been having to do it via mmc console

 

You need to push the certification authority root certificate to the clients through group policy (computer configuration -> windows settings -> security settings). For non-domain members, you need to import the root certificate by hand (checking the certificate fingerprint, expiry date and so on as you go, of course).

 

Paranoia is a good thing with cryptographic material.