Peap Wireless Access For Mac
This Howto is specifically written for OSX Leopard (10.5) and Snow Leopard (10.6) and may vary for versions prior. To join eduroam on OSX simply select the eduroam SSID from the Airport menubar icon. When asked for your credentials provide credentials based on the following. If you are from example.edu (your 'realm') and your username (sometimes called NetID) is traveler then your login name is traveler at example.edu. Your password is your normal password at your home institution. Security Information If you have not already added the SSL/TLS certificate from your home institution to your keyring you will be asked to do so now.
Extending access control, especially to the wireless world, means a more finely grained authorization; for example, you can allow access to the network and its resources for internal employees and allow Internet access for guests.
You should then be connected to eduroam and be able to surf as normal. Hint: To view your home institution's RADIUS certificate and allow the Keychain to verify the certificate of your home institution before providing your username and password you can use a two-step verification process: First provide the username anonymous at example.edu (where example.edu is your home institution as above), and an empty password. If you have not stored the certificate in your keyring you will be presented your home institution's RADIUS server certificate. If it is correct you can store then it to your Keychain (you will be asked for the computer's administrator password if you are not running as administrator).
It is recommended you do this the first time while at your home institution, and if possible verify the certificate's fingerprint with your IT staff. This simple check is the foundation of all security within the eduroam network. If you have previously verified and stored the certificate for your home institution this step allows the Keychain to verify the certificate before you provide your real credentials mitigating the damage from a rogue man-in-the-middle attack. Once the certificate has been verified (and possibly stored) you will be asked for your credentials a second time. This time provide your real credentials as above and you will be connected to the network. Storing your credentials in an eduroam profile To create a permanent eduroam profile for connecting to the network with the correct settings, including 'inner' and 'outer' identities follow the following instructions: In Network Preferences (the bottom menu item in the Airport menu), with the Airport card selected, click 'Advanced.' In the lower right-hand corner.
In the advanced settings select the 802.1X tab. As seen below please create a new 802.1x 'User Profile' and fill in your username and password as shown in the second image. If you would prefer to be prompted for your password each time you connect to eduroam leave the password field blank. Select the appropriate authentication methods (TTLS or PEAP generally), and select the eduroam network in the 'Wireless Network' drop-down list. To configure your 'outer-identity', which is what the institution you are visiting and the other eduroam servers between the visited institution and your home institution, will see do the following. Select the PEAP or TTLS authentication method, whichever is used by your home institution (both may be allowed so follow the instructions for both in that case).
Click on 'Configure.' Just below the Authentication methods list.
In the dialog box that pops up entire anonymous@ (i.e. Anonymous at example.edu in the case described at the top of this document). If you are using TTLS then make sure to configure your 'TTLS Inner Authentication' as appropriate for your home institution as well. When you are done you should have filled out the appropriate forms similarly to the images below. The next step is to configure your home institution's RADIUS server certificate.
For help with this please contact your home-institution helpdesk as they will have the information on your certificate. If you have previously joined the eduroam network, preferably from home the first time, and accepted the certificate provided then it should be in your Keychain. If not you may need to add it from a file per the instructions from your home institution. Assuming the certificate is in your Keychain we will allow that certificate to be used by default for eduroam: Click the 'Configure Trust' button (bellow the Authentication Methods list). Click the '+' in the lower-left corner of the dialog and select either 'Select Certificate File' (if you have downloaded the certificate file to your hard drive previously) or 'Select Certificate from Keychain' if you've previously accepted it (see the first image below).
In the prior case, navigate your hard drive to find the file, select it, and click 'Ok'. In the latter case (the second image below) find your home institution's certificate in the list, select it, and click 'Ok'. Your home RADIUS server should now be listed in the 'Certificates' tab of the dialog (the third image below). You may optionally list RADIUS servers to trust (the fourth image below). If you wish to do so select the 'Servers' tab, click the '+' and provide the DNS name or IP address of the RADIUS servers you wish to trust. Please consult your home institution for help with this step. Once you have selected certificates and/or servers click 'Ok' to return to the 802.1X configuration tab.
After completing all of the steps above your preferences screen should look similar to the image below. If so please click 'Ok' to return to the Network Preferences pane.
Upon returning to the main Network Preferences pane click 'Apply' in the lower-right corner of the dialog. Then select the eduroam network from the 'Network Name' drop-down list. After connecting you should see your 802.1X authentication status below the network name.
If all went well in your configuration you should now be connected to the eduroam SSID and able to surf as usual! For further information please see the Apple Knowledge Base article on.
Introduction This document provides a sample configuration for the Protected Extensible Authentication Protocol (PEAP) with Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) version 2 authentication in a Cisco Unified Wireless network with the Microsoft Network Policy Server (NPS) as the RADIUS server. Prerequisites Requirements Ensure that you are familiar with these procedures before you attempt this configuration:. Knowledge of basic Windows 2008 installation. Knowledge of Cisco controller installation Ensure that these requirements have been met before you attempt this configuration:. Install the Microsoft Windows Server 2008 operating system on each of the servers in the test lab.
Update all service packs. Install the controllers and lightweight access points (LAPs). Configure the latest software updates. For initial installation and configuration information for the Cisco 5508 Series Wireless Controllers, refer to the.
Note: This document is intended to give the readers an example on the configuration required on a Microsoft server for PEAP-MS-CHAP authentication. The Microsoft Windows server configuration presented in this document has been tested in the lab and found to work as expected. If you have trouble with the configuration, contact Microsoft for help. The Cisco Technical Assistance Center (TAC) does not support Microsoft Windows server configuration. Microsoft Windows 2008 installation and configuration guides can be found on Microsoft Tech Net.
Components Used The information in this document is based on these software and hardware versions:. Cisco 5508 Wireless Controller that runs firmware Version 7.4. Cisco Aironet 3602 Access Point (AP) with Lightweight Access Point Protocol (LWAPP). Windows 2008 Enterprise Server with NPS, Certificate Authority (CA), dynamic host control protocol (DHCP), and Domain Name System (DNS) services installed.
Microsoft Windows 7 client PC. Cisco Catalyst 3560 Series Switch The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
Conventions Refer to the for more information on document conventions. PEAP Overview PEAP uses Transport Level Security (TLS) to create an encrypted channel between an authenticating PEAP client, such as a wireless laptop, and a PEAP authenticator, such as Microsoft NPS or any RADIUS server. PEAP does not specify an authentication method, but provides additional security for other Extensible Authentication Protocols (EAPs), such as EAP-MS-CHAP v2, that can operate through the TLS-encrypted channel provided by PEAP.
The PEAP authentication process consists of two main phases. PEAP Phase One: TLS-Encrypted Channel The wireless client associates with the AP. An IEEE 802.11-based association provides an open system or shared key authentication before a secure association is created between the client and the access point. After the IEEE 802.11-based association is successfully established between the client and the access point, the TLS session is negotiated with the AP. After authentication is successfully completed between the wireless client and NPS, the TLS session is negotiated between the client and NPS.
The key that is derived within this negotiation is used to encrypt all subsequent communication. PEAP Phase Two: EAP-Authenticated Communication EAP communication, which includes EAP negotiation, occurs inside the TLS channel created by PEAP within the first stage of the PEAP authentication process. The NPS authenticates the wireless client with EAP-MS-CHAP v2. The LAP and the controller only forward messages between the wireless client and RADIUS server. The Wireless LAN Controller (WLC) and the LAP cannot decrypt these messages because it is not the TLS end point. The RADIUS message sequence for a successful authentication attempt (where the user has supplied valid password-based credentials with PEAP-MS-CHAP v2) is:. The NPS sends an identity request message to the client: EAP-Request/Identity.
The client responds with an identity response message: EAP-Response/Identity. The NPS sends an MS-CHAP v2 challenge message: EAP-Request/EAP-Type=EAP MS-CHAP-V2 (Challenge). The client responds with an MS-CHAP v2 challenge and response: EAP-Response/EAP-Type=EAP-MS-CHAP-V2 (Response). The NPS sends back an MS-CHAP v2 success packet when the server has successfully authenticated the client: EAP-Request/EAP-Type=EAP-MS-CHAP-V2 (Success). The client responds with an MS-CHAP v2 success packet when the client has successfully authenticated the server: EAP-Response/EAP-Type=EAP-MS-CHAP-V2 (Success).
The NPS sends an EAP-type-length-value (TLV) that indicates successful authentication. The client responds with an EAP-TLV status success message.
The server completes authentication and sends an EAP-Success message in plain text. If VLANs are deployed for client isolation, the VLAN attributes are included in this message. Configure In this section, you are presented with the information to configure PEAP-MS-CHAP v2.
Note: Use the ( customers only) to obtain more information on the commands used in this section. Network Diagram This configuration uses this network setup: In this setup, a Microsoft Windows 2008 server performs these roles:.
Domain controller for the domain wireless.com. DHCP/DNS server. CA server. NPS? To authenticate the wireless users. Active Directory?
To maintain the user database The server connects to the wired network through a Layer 2 switch as shown. The WLC and the registered LAP also connect to the network through the Layer 2 switch. The wireless clients use Wi-Fi Protected Access 2 (WPA2) - PEAP-MS-CHAP v2 authentication to connect to the wireless network. Configurations The objective of this example is to configure the Microsoft 2008 server, Wireless LAN Controller, and Light Weight AP to authenticate the wireless clients with PEAP-MS-CHAP v2 authentication. There are three major steps in this process:. Configure the Microsoft Windows 2008 Server. Configure the WLC and the Light Weight APs. Configure the wireless clients.
Configure the Microsoft Windows 2008 Server In this example, a complete configuration of the Microsoft Windows 2008 server includes these steps:. Configure the server as a domain controller. Install and configure DHCP services. install and configure the server as a CA server. Connect clients to the domain. Install the NPS. Install a certificate.
Configure the NPS for PEAP authentication. Add users to the Active Directory. Configure the Microsoft Windows 2008 Server as a Domain Controller Complete these steps in order to configure the Microsoft Windows 2008 server as a domain controller:. Click Start Server Manager. Click Roles Add Roles. Click Next.
Select the service Active Directory Domain Services, and click Next. Review the Introduction to Active Directory Domain Services, and click Next. Click Install to begin the installation process.
The installation proceeds and completes. Click Close this wizard and launch the Active Directory Domain Services Installation Wizard (dcpromo.exe) to continue installation and configuration of the Active Directory. Click Next to run the Active Directory Domain Services Installation Wizard. Review the information on Operating System Compatbilty, and click Next. Click Create a new domain in a new forest Next in order to create a new domain. Enter the full DNS name for the new domain (wireless.com in this example), and click Next.
Select the forest functional level for your domain, and click Next. Select the domain functional level for your domain, and click Next. Ensure DNS server is selected, and click Next. Click Yes for the installation wizard to create a new zone in DNS for the domain. Select the folders Active Directory should use for its files, and click Next. Enter the Administrator Password, and click Next.
Review your selections, and click Next. The installation proceeds. Click Finish to close the wizard. Restart the server for the changes to take effect. Install and Configure DHCP Services on the Microsoft Windows 2008 Server The DHCP service on the Microsoft 2008 server is used to provide IP addresses to the wireless clients. Complete these steps in order to install and configure DHCP services:.
Click Start Server Manager. Click Roles Add Roles. Click Next. Select the service DHCP Server, and click Next.
Review the Introduction to DHCP Server, and click Next. Select the interface that the DHCP server should monitor for requests, and click Next. Configure the default DNS settings the DHCP server should provide to clients, and click Next. Configure WINS if the network supports WINS. Click Add to use the wizard to create a DHCP Scope or click Next to create a DHCP scope later. Click Next to continue. Enable or disable DHCPv6 support on the server, and click Next.
Configure IPv6 DNS settings if DHCPv6 was enabled in the preceding step. Click Next to continue. Provide domain administrator credentials to authorize the DHCP server in Active Directory, and click Next.
Peap Authentication Wifi Not Connecting
Review the configuration on the confirmation page, and click Install to complete the install. The installation proceeds. Click Close to close the wizard. The DHCP Server is now installed.
Click Start Administrative Tools DHCP to configure DHCP service. Expand the DHCP server (win-mvz9z2umms.wireless.com in this example), right-click IPv4, and choose New Scope. To create a DHCP Scope.
Click Next to configure the new scope via the New Scope Wizard. Provide a name for the new scope (Wireless Clients in this example), and click Next.
Enter the range of available IP addresses that can be used for DHCP leases. Click Next to continue. Create an optional list of excluded addresses. Click Next to continue. Configure the lease time, and click Next.
Click Yes, I want to configure these options now, and click Next. Enter the IP address of the default gateway for this scope, click Add Next. Configure the DNS domain name and DNS server to be used by the clients. Click Next to continue. Enter WINS information for this scope if the network supports WINS.
Click Next to continue. To activate this scope, click Yes, I want to activate this scope now Next. Click Finish to complete and close the wizard. Install and Configure the Microsoft Windows 2008 Server as a CA Server PEAP with EAP-MS-CHAP v2 validates the RADIUS server based on the certificate present on the server.
Additionally, the server certificate must be issued by a public CA that is trusted by the client computer (that is, the public CA certificate already exists in the Trusted Root Certification Authority folder on the client computer certificate store). Complete these steps in order to configure the Microsoft Windows 2008 server as a CA server that issues the certificate to the NPS:.
Click Start Server Manager. Click Roles Add Roles. Click Next. Select the service Active Directory Certificate Services, and click Next. Review the Introduction to Active Directory Certificate Services, and click Next.
Select the Certificate Authority, and click Next. Select Enterprise, and click Next. Select Root CA, and click Next. Select Create a new private key, and click Next. Click Next on Configuring Cryptography for CA.
Click Next to accept the default Common name for this CA. Select the length of time this CA certificate is valid, and click Next. Click Next to accept the default Certificate database location. Review the configuration, and click Install to start the Active Directory Certificate Services. After the install is completed, click Close. Connect Clients to the Domain Complete these steps in order to connect the clients to the wired network and to download the domain specific information from the new domain:. Connect the clients to the wired network with a straight through Ethernet cable.
Boot up the client, and log in with the client username and password. Click Start Run, enter cmd, and click OK. At the command prompt, enter ipconfig, and click Enter to verify that DHCP works correctly and that the client received an IP address from the DHCP server. In order to join the client to the domain, click Start, right-click Computer, choose Properties, and choose Change Settings at the bottom right.
Click Change. Click Domain, enter wireless.com, and click OK. Enter username administrator and the password specific to the domain to which the client joins. This is the administrator account in the Active Directory on the server. Click OK, and click OK again. Click Close Restart Now to restart the computer.
Once the computer restarts, log in with this information: Username = Administrator; Password =; Domain = wireless. Click Start, right-click Computer, choose Properties, and choose Change Settings at the bottom right to verify that you are on the wireless.com domain. The next step is to verify that the client received the CA certificate (trust) from the server. Click Start, enter mmc, and press Enter. Click File, and click Add/Remove snap-in. Choose Certificates, and click Add.
Click Computer account, and click Next. Click Local computer, and click Next. Expand the Certificates (Local Computer) and Trusted Root Certification Authorities folders, and click Certificates. Find wireless domain CA cert in the list. In this example, the CA cert is called wireless-WIN-MVZ9Z2UMNMS-CA. Repeat this procedure to add more clients to the domain. Install the Network Policy Server on the Microsoft Windows 2008 Server In this setup, the NPS is used as a RADIUS server to authenticate wireless clients with PEAP authentication. Complete these steps in order to install and configure NPS on the Microsoft WIndows 2008 server:.
Click Start Server Manager. Click Roles Add Roles. Click Next. Select the service Network Policy and Access Services, and click Next. Review the Introduction to Network Policy and Access Services, and click Next. Select Network Policy Server, and click Next. Review the confirmation, and click Install.
After the install is completed, a screen similar to this one is displayed. Click Close. Install a Certificate Complete these steps in order to install the computer certificate for the NPS:.
Click Start, enter mmc, and press Enter. Click File Add/Remove Snap-in. Choose Certificates, and click Add. Choose Computer account, and click Next. Select Local Computer, and click Finish. Click OK to return to the Microsoft Management Console (MMC).
Expand the Certificates (Local Computer) and Personal folders, and click Certificates. Right-click in the whitespace beneath the CA certificate, and choose All Tasks Request New Certificate. Click Next. Select Domain Controller, and click Enroll. Click Finish once the certificate is installed.
The NPS certificate is now installed. Ensure that the Intended Purpose of the certificate reads Client Authentication, Server Authentication.
Configure the Network Policy Server Service for PEAP-MS-CHAP v2 Authentication Complete these steps in order to configure the NPS for authentication:. Click Start Administrative Tools Network Policy Server. Right-click NPS (Local), and choose Register server in Active Directory. Add the Wireless LAN Controller as an authentication, authorization, and accounting (AAA) client on the NPS.
Expand RADIUS Clients and Servers. Right-click RADIUS Clients, and choose New RADIUS Client. Enter a Friendly name (WLC in this example), the management IP address of the WLC (192.168.162.248 in this example) and a shared secret. The same shared secret is used to configure the WLC. Click OK to return to the previous screen. Create a new Network Policy for wireless users.
Expand Policies, right-click Network Policies, and choose New. Enter a policy name for this rule (Wireless PEAP in this example), and click Next.
To have this policy allow only wireless domain users, add these three conditions, and click Next:. Windows Groups - Domain Users. NAS Port Type - Wireless - IEEE 802.11. Authentication Type - EAP. Click Access granted to grant connection attempts that match this policy, and click Next. Disable all the authentication methods under Less secure authentication methods.
Click Add, select PEAP, and click OK to enable PEAP. Select Microsoft: Protected EAP (PEAP), and click Edit.
Ensure the previously created domain controller certificate is selected in the Certificate issued drop-down list, and click Ok. Click Next. Click Next.
Click Next. Click Finish. Add Users to the Active Directory In this example, the user database is maintained on the Active Directory. Complete these steps in order to add users to the Active Directory database:. Open Active Directory Users and Computers. Click Start Administrative Tools Active Directory Users and Computers. In the Active Directory Users and Computers console tree, expand the domain, right-click Users New, and choose User.
In the New Object? User dialog box, enter the name of the wireless user. This example uses the name Client1 in the First name field and Client1 in the User logon name field. In the New Object? User dialog box, enter a password of your choice in the Password and Confirm password fields. Uncheck the User must change password at next logon check box, and click Next. In the New Object?
User dialog box, click Finish. Repeat steps 2 through 4 in order to create additional user accounts. Configure the Wireless LAN Controller and LAPs Configure the wireless devices (the Wireless LAN Controllers and LAPs) for this setup. Configure the WLC for RADIUS Authentication Configure the WLC to use the NPS as the authentication server. The WLC must be configured in order to forward the user credentials to an external RADIUS server.
The external RADIUS server then validates the user credentials and provides access to the wireless clients. Complete these steps in order to add the NPS as a RADIUS server in the Security RADIUS Authentication page:. Choose Security RADIUS Authentication from the controller interface to display the RADIUS Authentication Servers page.
Click New in order to define a RADIUS server. Define the RADIUS server parameters. These parameters include the RADIUS Server IP Address, Shared Secret, Port Number, and Server Status. The Network User and Management check boxes determine if RADIUS-based authentication applies to management and network (wireless) users.
This example uses the NPS as the RADIUS server with an IP address of 192.168.162.12. Configure a WLAN for the Clients Configure the service set identfier (SSID) (WLAN) to which the wireless clients connects. In this example, create the SSID, and name it PEAP. Define the Layer 2 Authentication as WPA2 so that the clients perform EAP-based authentication (PEAP-MS-CHAP v2 in this example) and use the advanced encryption standard (AES) as the encryption mechanism. Leave all other values at their defaults. Note: This document binds the WLAN with the management interfaces.
When you have multiple VLANs in your network, you can create a separate VLAN and bind it to the SSID. For information on how to configure VLANs on WLCs, refer to. Complete these steps in order to configure a WLAN on the WLC:. Click WLANs from the controller interface in order to display the WLANs page.
This page lists the WLANs that exist on the controller. Choose New in order to create a new WLAN. Enter the WLAN ID and the WLAN SSID for the WLAN, and click Apply. To configure the SSID for 802.1x, complete these steps:. Click the General tab and enable the WLAN.
Click the Security Layer 2 tabs, set Layer 2 security to WPA + WPA2, check the WPA+WPA2 Parameters (for example, WPA2 AES) check boxesas needed, and click 802.1x as the Authentication Key Management. Click the Security AAA Servers tabs, choose the IP address of the NPS from the Server 1 drop-down list, and click Apply. Configure the Wireless Clients for PEAP-MS-CHAP v2 Authentication Complete these steps to configure the wireless client with the Windows Zero Config Tool to connect to the PEAP WLAN.
Click the Network icon in the task bar. Click the PEAP SSID, and click Connect.
The client should now be connected to the network. If the connection fails, try to reconnect to the WLAN. If the issue persists, refer to the Troubleshoot section.
Wireless Peap Authentication
Verify There is currently no verification procedure available for this configuration. Troubleshoot If your client did not connect to the WLAN, this section provides information you can use to troubleshoot the configuration. There are two tools that can be used to diagnose 802.1x authentication failures: the debug client command and the Event Viewer in Windows. Performing a client debug from the WLC is not resource intensive and does not imnpact service.
To start a debug session, open the command-line interface (CLI) of the WLC, and enter debug client mac address, where the mac address is the wireless mac address of the wireless client that is unable to connect. While this debug runs, try to connect the client; there should be output on the CLI of the WLC that looks similar to this example: This is an example of an issue that could occur with a misconfiguration. Here, the WLC debug shows the WLC has moved into the authenticating state, which means the WLC is waiting for a response from the NPS. This is usually due to an incorrect shared secret on either the WLC or the NPS. You can confirm this via the Windows Server Event Viewer.
If you do not find a log, the request never made it to the NPS. Another example that is found from the WLC debug is an access-reject. An access-reject shows that the NPS received and rejected the client credentials. This is an example of a client receiving an access-reject: When you see an access-reject, check the logs on the Windows Server Event logs to determine why the NPS responded to the client with an access-reject. A successful authentication has an access-accept in the client debug, as seen in this example: Troubleshooting access-rejects and response timeouts requires access to the RADIUS server. The WLC acts as an authenticator that passes EAP messages between the client and the RADIUS server. A RADIUS server responding with an access-reject or response timeout should be examined and diagnosed by the manufacturer of the RADIUS service.
Note: TAC does not provide technical support for third-party RADIUS servers; however, the logs on the RADIUS server generally explain why a client request was rejected or ignored. In order to troubleshoot access-rejects and response timeouts from the NPS, examine the NPS logs in the Windows Event Viewer on the server. Click Start Administrator Tools Event Viewer to start the Event Viewer and review the NPS logs. Expand Custom Views Server Roles Network Policy and Access.
In this section of the Event View, there are logs of passed and failed authentications. Examine these logs to troubleshoot why a client is not passing authentication. Both passed and failed authentications show up as Informational. Scroll through the logs to find the username that has failed authentication and received an access-reject according to the WLC debugs. This is an example of the NPS denying a user access: When reviewing a deny statement in the Event Viewer, examine the Authentication Details section.
In this example, you can see that the NPS denied the user access due to an incorrect username: The Event View on the NPS also assists with troubleshooting if the WLC does not receive a response back from the NPS. This is usually caused by an incorrect shared secret between the NPS and the WLC. In this example, the NPS discards the request from the WLC due to an incorrect shared secret: Related Information.