Configuring the NPS for IEEE 802.1X Wireless Connections

Complete the following steps to configure your Network Policy Server (NPS) with a set of default RADIUS policies to authenticate wireless clients based on AD groups membership that can be modified later:

  1. Configure RADIUS services for IEEE 802.1X for wireless connections. In the NPS console, in the left navigation pane, click NPS (Local). On the right pane, select RADIUS server for 802.1X Wireless or Wired Connections and click Configure 802.1X to configure 802.1X authentication settings.
    The Configure 802.1X wizard is displayed.

    Configuring the Network Policy Server

    Attention: The Network Policy (NP) configured in this task uses AD User Groups as a condition. Make sure you have an existing AD User Group before starting your NP configuration. For instructions to create AD User Groups and users, refer to Active Directory Configurations.
  2. In Select 802.1X Connections Type, choose the connection type as Secure Wireless Connections and type the name of the policy. Click Next.

    The Configure 802.1X wizard appears and steps you through the configuration process.

    Configuring 802.1X for Wireless Connections

    Note: By default, a Connection Request Policy (CRP) and a Network Policy (NP) will be created with the same name provided in this wizard.
  3. In Specify 802.1X Switches, create a RADIUS Client.
    Note: The term RADIUS Client corresponds to the authenticator device; it could be the controller in proxy authentication mode, or it can be every access point in the network (in the case of non-proxy authentication).
    1. Click Add... to create a new RADIUS Client.
      The New RADIUS Client window is displayed.
    2. Type a friendly name, the IP address, and type a shared secret.
      Attention: Keep the shared secret handy. This is the same shared secret that you will provide when configuring the authentication server options in the controller.
    3. Click OK.

      Creating a New RADIUS Client

      The RADIUS Client is created and populated in the RADIUS Clients list in the Configure 802.1X window. Click Next.

      Note: Alternatively, when adding the IP address of the RADIUS Client, you can use the domain name instead, and click Verify ... to make sure the server is able to resolve the DNS.
  4. In Configure an Authentication Method select Microsoft Protected EAP (PEAP) from the list. Click Next.
  5. In Specify User Groups click Add… to add an existing Active Directory (AD) group as a condition.
    1. In the Select Group window, type the name or part of the name of an existing AD user group. Use the Check Names button to make sure the name is entered correctly. If the name is correct, click OK.
      The Select Group window closes and the group or groups selected are populated in the Groups list.

      Selecting an AD Group for the Condition

  6. In Configure Traffic Controls keep the default settings, and click Next.
  7. Review the configuration summary and click Finish.

    The NPS is configured and the RADIUS Client, along with a default CRP and NP, are created.

    Note: You can review the RADIUS Clients in the left navigation pane by selecting RADIUS Clients and Servers > RADIUS Clients. To Edit the client, double-click on the client row. The client properties window opens for you to edit it accordingly.

    Reviewing the RADIUS Clients

    You have successfully configured the NPS for 802.1X wireless connections and it is ready to authenticate any connection requests coming from the controller.
Parent topic: Configuring a WLAN with IEEE 802.1X Authentication using NPS and Controller

Modifying the Network Policy Conditions

The default NP created (as per the Configuring the NPS for 802.1X Wireless Connections ) has a condition to only grant access to users that belong to the specified user groups. Complete the following steps to modify that condition:

  1. Open the NP properties. In the left navigation pane of the NPS console, expand the NPS (Local) folder, locate and click the Network Policies folder. On the right pane, locate the network policy you created and double-click it to access its properties.
    The NP Properties window opens.

    Network Policies

  2. In the Conditions tab, select the existing User Groups condition, and click Edit … . The User Groups window is displayed for you to add new groups to this condition or remove the existing ones.
    1. In the User Groups window, click Add Groups to add an existing Active Directory (AD) group.
      The Select Group window is displayed.
    2. In the Select Group window, enter the name or part of the name of an existing user group. Use the Check Names button to ensure the name is entered correctly. Click OK.
      The Select Group window closes and the group or groups selected are populated in the Groups list.
    3. Click OK.
      The User Groups window closes and the condition is added to the Condition list.
  3. Optionally, in the Conditions tab, click Add … to create a new condition. The Select condition window is displayed for you to choose an additional condition for the NP.

    Adding Conditions to the NP

    You have successfully modified the NP conditions.

NPS Certificate for EAP Services

Extensible Authentication Protocol (EAP) is a secure connection protocol that requires a Secure Sockets Layer (SSL) certificate to ensure the security of communications. Complete the following steps to corroborate whether there is an existing and valid SSL certificate for the Network Policy:

  1. Open the NP properties. In the left navigation pane of the NPS console, expand the NPS (Local) folder, locate and click the Network Policies folder. On the right pane, locate the network policy you created and double-click it to access its properties.
    The NP Properties window opens.
  2. In the Constraints tab, select Authentication Methods, then select Microsoft: Protected EAP (PEAP) in the list and click Edit ... .
    The Edit Protected EAP Properties window opens for you to corroborate the certificate is valid. If the certificate is not present, a warning will pop up as A certificate could not be found that can be used with this Extensible Authentication Protocol. In case the certificate is not found, refer to Deploying the AD Certification Authority section in the topic Active Directory Configurations for instructions on how to assign a certificate to this NPS.

    Edit Protected EAP Properties Window

The SmartZone AAA Test Tool

The controller AAA test tool is a handy troubleshooting tool to verify the NPS communication with SmartZone, but it relies on the Password Authentication Protocol (PAP), which is an unsecure authentication method. When using the SmartZone AAA test tool, ensure that PAP is enabled in the NP constraints. Additionally, because the controller creates a virtual authentication port for the AAA test, you need to remove the NAS Port Type Wireless - IEEE 802.11 condition from the NP conditions to allow the AAA test tool to function correctly.

Attention: It is crucial to note that this configuration is not recommended for production environments. For production use, disable PAP authentication to enhance security.

Complete the following steps to prepare the existing Network Policy for a AAA test from the controller.

Attention: Return to the secure authentication methods after your testing is completed.
  1. Open the NP properties. In the left navigation pane of the NPS console, expand the NPS (Local) folder, locate and click the Network Policies folder. On the right pane, locate the network policy you created and double-click it to access its properties.
    The NP Properties window is displayed.
  2. In the Conditions tab, select the NAS Port Type condition and click Remove.

    Removing the NAS Port Type Condition for the SZ AAA Test Tool

  3. In the Constraints tab, select Authentication Methods, then enable the Unencrypted authentication (PAP, SPAP) option.

    Enabling PAP for the SmartZone AAA Test Tool

  4. Click OK to apply the changes.

    A confirmation pop-up will warn you from enabling this unsecure authentication method. Click No to ignore the suggestion and keep with the intended configuration for the test.

    Unsecure Authentication Warning

  5. Perform the testing from the SmartZone GUI, then revert and manually return these changes when done.

    Note: To learn the steps to configure and test the RADIUS AAA server in controller, refer to the section Configuring the Authentication Services and Creating a WLAN in the topic Working with SmartZone.

    Attention: Return to the secure authentication methods after your testing is completed.