Ruckus and encryption keys

[cookie_monster]

What is the best way to setup domain laptops to use our wireless is there an easy way to automatically tell the laptops what SSID and key to use, group policy, RADIUS server etc, how are you all doing this?

 

Thanks.

[mrmontymick]

We use GPO settings to distribute this information.

 

Have a look under: Computer Configuration -> Windows Settings -> Security Settings -> Wireless Network (IEEE 802.11) Policies and you might find what you're looking for. You can create a new wireless policy including the ability to use Single Sign On, works significantly better with Vista/Win 7 than XP though.

[SYNACK]

RADIUS + machine certificates + group policy seems to work alright it has better security than pre-shared key and you can't push those by GP anyway.

[cookie_monster]

RADIUS + machine certificates + group policy seems to work alright it has better security than pre-shared key and you can't push those by GP anyway.

 

 

No rush but can you give me a bullet point list of what I need to do to get that in place, I can read the material myself so don't go in depth it's just handy to know where to start and in what order things need doing.

 

Thanks.

[dirtydog]

I wouldn't mind some info on this too! We just get everyone to activate at the mo which is OK until the key runs out which then causes mass hysteria.

[SYNACK]

Here are some guides: Wireless Networking in Windows 2003

Deployment of Protected 802.11 Networks Using Microsoft Windows

These involve certificates on the client and server providing the best level of security

 

There is also a way to do it with a single self signed certificate but I beleive that this is probably less secure:

http://www.edugeek.net/forums/networks/13961-wireless-802-1x-radius-authentication-using-ias-server.html

Ultimate wireless security guide: Automatic PEAP deployment with Microsoft Active Directory GPO

[Edu-IT]

I wouldn't mind some info on this too! We just get everyone to activate at the mo which is OK until the key runs out which then causes mass hysteria.

Don't set an expiry on the keys?

[apeo]

Here all the wireless settings are configured manually on the laptop because (correct me if im wrong) to deploy the settings via gpo will require a network connection so you'd wire it in for the gpo to take. Its much easier and for the most part more reliable to configure it manually, which allows for some testing to make sure the config takes. 802.1x RADIUS config, I find, sometimes takes some fiddling to get it to work.

[cookie_monster]

Here all the wireless settings are configured manually on the laptop because (correct me if im wrong) to deploy the settings via gpo will require a network connection so you'd wire it in for the gpo to take. Its much easier and for the most part more reliable to configure it manually, which allows for some testing to make sure the config takes. 802.1x RADIUS config, I find, sometimes takes some fiddling to get it to work.

 

 

Currently we have 45 notebooks (managed by IT) with the key set manually soon we might have 100, what happens when we want to change the WPA key which at some point we will no doubt currently this will be allot of work.

[dirtydog]

Don't set an expiry on the keys?

 

good idea but we have students laptop keys too and its nice for them to renew each year so they expire when they leave. Unless we can set different expiry time period for different WLAN's on the ZoneDirector?

[apeo]

Currently we have 45 notebooks (managed by IT) with the key set manually soon we might have 100, what happens when we want to change the WPA key which at some point we will no doubt currently this will be allot of work.

 

Well we use RADUIS here so we dont use Keys. That being said we do have the laptops imaged once a year and we configure the laptops then.

 

Depending on your maintenance cycle you could manually configure it each time or i guess use gpo to deploy the changes.

[Edu-IT]

good idea but we have students laptop keys too and its nice for them to renew each year so they expire when they leave. Unless we can set different expiry time period for different WLAN's on the ZoneDirector?

Yes, that's possible on Ruckus I believe. You can create different SSID's with different keys and different expiry lengths. Failing that use guest passes for them.

[Kipling]

Never pinned it down but we used to use IAS etc and found random laptops would sporadically fall off the domain and we’d have to rejoin them – it was quite a strange fault.

We switched to using PSKs as a short term measure (a year ago ) and it works much better, at least in regards to falling off the domain.

[apeo]

Never pinned it down but we used to use IAS etc and found random laptops would sporadically fall off the domain and we’d have to rejoin them – it was quite a strange fault.

We switched to using PSKs as a short term measure (a year ago ) and it works much better, at least in regards to falling off the domain.

 

What exactly do you mean falling off the domain?

[cookie_monster]

Well we use RADUIS here so we dont use Keys. That being said we do have the laptops imaged once a year and we configure the laptops then.

 

Depending on your maintenance cycle you could manually configure it each time or i guess use gpo to deploy the changes.

 

 

Hey apeo, can you have one SSID that clients use RADIUS and another where users set their own key manually? I'd like one for our network clients and a public one that can't see our network with a static key.

 

Thanks.

[apeo]

Yeah you can configure each WLAN with as much or little security/authorisation as you wish. Officially we have 2 WLANs here, 1 is the RADIUS one that the school is on and the other is a Guest one.

[Kipling]

What exactly do you mean falling off the domain?

 

Oddly some laptops would, on occasion, appear as though they’d been deleted from the domain, that is to say as though they had had their computer accounts deleted in AD (but they were still there); the only cure was to physically connect the laptop and then genuinely remove it from the domain and rejoin it.

It didn’t happen a lot but enough for it to be annoying – we ran with 64 laptops for over a year before (temporarily) switching to using PSKs.

 

We even tried dropping back from NPS to IAS 2003 but it didn’t help. It could of course have been entirely unrelated to the IAS but time was short so didn’t look too much further into it (switching to PSKs made it a bit too easy to put it on the back burner )

[apeo]

Oddly some laptops would, on occasion, appear as though they’d been deleted from the domain, that is to say as though they had had their computer accounts deleted in AD (but they were still there); the only cure was to physically connect the laptop and then genuinely remove it from the domain and rejoin it.

It didn’t happen a lot but enough for it to be annoying – we ran with 64 laptops for over a year before (temporarily) switching to using PSKs.

 

We even tried dropping back from NPS to IAS 2003 but it didn’t help. It could of course have been entirely unrelated to the IAS but time was short so didn’t look too much further into it (switching to PSKs made it a bit too easy to put it on the back burner )

 

Hmmm slightly different from the problem here.. randomly some laptops on occasion will stop working i.e. wont connect to the network. Its still in AD but it just wont join the network saying authentication failed or something. At this point, after checking every setting, if we take that laptop off the domain and rejoin the domain... hey presto with a couple reboots, network connectivity is restored.

 

We are putting up with the issue for now.

[spc-rocket]

Oddly some laptops would, on occasion, appear as though they’d been deleted from the domain, that is to say as though they had had their computer accounts deleted in AD (but they were still there); the only cure was to physically connect the laptop and then genuinely remove it from the domain and rejoin it.

It didn’t happen a lot but enough for it to be annoying – we ran with 64 laptops for over a year before (temporarily) switching to using PSKs.

 

We even tried dropping back from NPS to IAS 2003 but it didn’t help. It could of course have been entirely unrelated to the IAS but time was short so didn’t look too much further into it (switching to PSKs made it a bit too easy to put it on the back burner )

 

Hi,

 

The issue you describe of wireless laptops dropping off the radius and ias is due to the expiration of the computer account's password. This password cannot be renewed on wireless connection and hence it does not allow the laptop to connect when performing authentication. When you connect to the wired network the computer accounts password is automatically updated and futher connection wired or wireless will work until the password expires again. There was someone who posted how changed the GPO so that computer's password does not expire so frequently, the default is around 30 days if i remember correctly.

 

Ash.

[apeo]

Hi,

 

The issue you describe of wireless laptops dropping off the radius and ias is due to the expiration of the computer account's password. This password cannot be renewed on wireless connection and hence it does not allow the laptop to connect when performing authentication. When you connect to the wired network the computer accounts password is automatically updated and futher connection wired or wireless will work until the password expires again. There was someone who posted how changed the GPO so that computer's password does not expire so frequently, the default is around 30 days if i remember correctly.

 

Ash.

 

Interesting, I think this is the problem we have here but its odd that the error doesnt happen more frequent. I did some reading around the subject and as you say connecting via wired will resync the password change so next time the problem happens I'll confirm that this is the case. If this is the issue (seems highly likely) then its one less issue with the wireless.

[mickeyh080]

Wow, we have been suffering with the same problem for over a year now and are slowly getting a custom to resyncing the laptops via cable. Normaly a quick GPupdate sorts the offending device out. We could never prove that it was happening at a set frquency i.e every 30 days. But the similarities to what is posted hear are so spot on it is something definately worth looking into. If anyone knows of how to extend the computer account password expiration then we would be most appreciative.

 

Hi,

 

The issue you describe of wireless laptops dropping off the radius and ias is due to the expiration of the computer account's password. This password cannot be renewed on wireless connection and hence it does not allow the laptop to connect when performing authentication. When you connect to the wired network the computer accounts password is automatically updated and futher connection wired or wireless will work until the password expires again. There was someone who posted how changed the GPO so that computer's password does not expire so frequently, the default is around 30 days if i remember correctly.

 

Ash.

[spc-rocket]

Wow, we have been suffering with the same problem for over a year now and are slowly getting a custom to resyncing the laptops via cable. Normaly a quick GPupdate sorts the offending device out. We could never prove that it was happening at a set frquency i.e every 30 days. But the similarities to what is posted hear are so spot on it is something definately worth looking into. If anyone knows of how to extend the computer account password expiration then we would be most appreciative.

 

Hi,

 

This link contains information about how to change the password expiry time etc - may be helpful.

 

Q: Can the password of a Windows machine

 

Ash.

[apeo]

I think theres is also another option, which is to script a forced password change using one of the xp (assuming its xp that is) support tool. This option does seem to be more problems then its worth and assumes all laptops will be turned on before the 30 days is up. However if for whatever reason you dont want to extend the password age of machines, then this could in theory work (untested).