Configuring a WLAN with IEEE 802.1X Authentication using NPS and Controller

Configuration Overview

Configuring the Network Policy Server (NPS) on your Windows Server allows you to control the access for clients connecting to your wireless network. Following is a high-level overview of the tasks necessary to deploy an NPS instance on Windows Server and integrate it with a controller to authenticate wireless clients:

  • Before deploying the NPS:
    1. Deploy the Active Directory Domain System (AD DS) service if not present, and configure Users and User Groups.
    2. Deploy the Active Directory Certification Authority (AD CS) if not present, to provide the NPS with the SSL certificate required for 802.1X authentication.
  • Deploying and Configuring the NPS Server:
    1. Deploy the NPS.
    2. Configure the RADIUS Server for IEEE 802.1X Wireless Connections.
  • Configuring the Controller:
    1. Create the Proxy Authentication Service.
    2. Create a Realm Based Proxy Profile.
    3. Apply IEEE 802.1X settings to the WLAN
  • Test the configuration

Configuration Prerequisites

The following are the prerequisites for implementing 802.1X authentication using NPS on Windows Server:

  • The Windows server must be deployed and accessible in the network.
  • The controller must be already deployed, and the APs onboarded.
  • The controller must be able to contact the NPS server through the network.
  • A client device must be able to connect to a testing AP to corroborate the configuration.

Configuration Requirements

The platforms and hardware models for all the configurations are as follows:

  • Windows Server 2012 (end of support), 2016, 2019, and 2022
  • RUCKUS SmartZone controllers: SZ-100 (end of support), SZ-144, SZ-300, vSZ-H, vSZ-E
  • RUCKUS Access Points compatible with the listed controllers
  • IEEE 802.1X-enabled wireless clients

Implementation Considerations

When implementing 802.1X authentication using NPS, ensure the following key considerations and limitations are looked into:

  • Plan for guest access. Determine how guests will authenticate and access the network without compromising security.
  • Assess the performance impact on your network and devices. Ensure that the authentication process does not significantly degrade network performance.
  • Older client devices may not support 802.1X authentication.
  • End-users may need to manually configure their devices, including entering credentials or installing certificates.
  • End-users need to update passwords or certificates periodically. Expired credentials will prevent network access until updated.

Best Practices

Best practices for implementing 802.1X authentication using NPS on a Windows Server include:

  • Implement NPS redundancy to ensure continuous authentication services.
  • Maintain backups of your NPS configurations and related network settings to quickly restore services in case of failure.
  • Regularly update all network devices, the NPS, and related software to the latest firmware and security patches.
  • Enforce strong security policies, such as complex passwords and certificate management, to enhance network security.
  • Provide training for end-users on how to configure their devices and understand the authentication process.
  • Test your 802.1X configurations in a controlled environment before deploying them to the live network.

In this section:

  1. Working with the NPS
  2. Configuring the NPS for IEEE 802.1X Wireless Connections
Parent topic: Appendix for Configuring NPS