1. Using RADIUS Within the Framework of the School Environment Charles Bolen Systems Engineer December 6, 2011

2. What is Our Goal? Protect our wireless networks  Security  Liability  Control Bandwidth usage

3. What is RADIUS? Remote Authentication Dial In User Service Developed in 1991 – Mature Protocol Client/Server protocol running at the Application Layer

4. The 3 Functions of RADIUS (AAA) Authentication of Users or Devices BEFORE they connect to the network Authorization of Users or Devices for Network Usage (Access Reject or Access Accept) Accounting for usage of services (AAA Transaction)

5. Who Are the Players? Laptops, iPhones, iPads, Android Devices, Workstations Access Point, Network Switch (RADIUS Client) Wireless Controller (RADIUS Client) Network Policy Server (NPS) (RADIUS Server) Domain Controller (Active Directory) Active Directory Certificate Services Group Policy DHCP DNS

6. Required Components Domain Controller (2008 R2 Enterprise) (Limited functionality with 2003) AD Certificate Services* 2003 Server this is simply called Certificate Services Network Policy Server* 2003 Server this is called IAS (Internet Authentication Server) DHCP and DNS Access Points that support 802.1x (All Cisco LWAP’s and AP’s on WVTFS contract sold by Pomeroy) (Additional antennas recommended for Cisco 1200 series not sold by Pomeroy if unit only has 1 2.5 GHz and/or 1 5.0 GHz antenna) Cisco Wireless LAN Controller (WLC) 4400 series & 5500 series 2100 series supported, but only for smaller scale implementations (100 MB interface is a limiting factor)

7. How Do Clients Get Certificates? Domain computers  Group policy will push the certificates to the client  May take up to 20 minutes (per Microsoft)  Can speed process with ‘gpupdate /force’  New domain members need connected to wired network when joined to domain

8. How Do Clients Get Certificates? Non-Domain members and non-MS devices  Enter username and password for machine authentication  Wireless LAN Controller relays authentication request to the RADIUS server  Access is granted based on Active Directory privileges

9. Basic Configuration Configure RADIUS  Client component on Cisco Wireless LAN Controller  Server component on Network Policy Server Install Certificate Services Install Network Policy Server(s) Certificate Group Policy is Configured  Push certificates to workstations  Push Wireless Policy to workstations Create Wireless Access group, add computers Configure Network Policies on NPS