up vote 0 down vote favorite
1
share [g+] share [fb]

I'm hoping to get some feedback and ideas about implementation. Recently in one of our facilities we deployed 4 wireless access points which are Cisco WAP4410N devices. We are looking to do authenticated wireless access. At this point if a laptop or PC comes to the facility we provide them with the WPA2 key. We are running Windows Server 2003 domain controllers primarily. Can someone give me some hints as to what the different options might be for doing a somthing authenticated access or somthing similar so we don't need to provide a key every single time a machine trys to get access to the network.

Thanks in advance.

link|improve this question
20% accept rate
feedback

1 Answer

up vote 1 down vote accepted

It can be a little tricky, but where you want to start looking is RADIUS which is the protocol, but IAS is the service you would install on your domain controller(s).

As long as the clients are on your domain, you can make some changes and push a group policy that basically says...

1.  Connect to this wifi access name "Company Wireless"
2.  Send over your username/pw or a certificate to the access point
3.  Our wifi access point has been configured to ask via the RADIUS protocol to an Active Directory running IAS to see if you are legit.
4.  User is authenticated and put on the network.

Since credentials are sent over by the XP or windows 7 machine - it already knows who's logged into the machine - so there is nothing the user needs to do except be on the domain, and receive that particular GPO.

This link should at least point you in the right direction.

http://allianceitpro.com/helpdesk/windows-server/setup-radius-on-windows-server-for-wifi-wireless-access/

If they aren't on your domain, then you'll be handing out keys...

link|improve this answer
thanks for the reply matt, I'm not sure that I completely follow your answer. There are a couple of things I'm confused about still. When you say "as long as the clients are on your domain" I'm not sure what you are referring to here, do you mean the machine is physically in our facility or do you mean the device has connected to the domain at some point in the past and is trying to re-connect? We have multiple facilities and so we envision a staff member from facility A being able to just bring a laptop and connect in the facility in question, their laptop has authenticated in A before... – Warren Bullock III Sep 10 '10 at 17:09
Lesse if I can make it a little more clear. On the domain meaning the laptop is a member of the Active Directory domain that would be receiving the group policy. The group policy is where you would configure the wifi settings, so the laptop knows what to connect to. In this regard you wouldn't need to be handing out keys. Then the wifi access points just need to know which Active Directory controllers to connect to via RADIUS so as to authenticate the user of the laptop. – Matt Sep 10 '10 at 17:20
So yep, let's say Staff member at facility A has a laptop joined to the mycompany.internal domain. He can take that laptop to facility B and as long as facility B's wifi access points are configured to authenticate against an IAS server in mycompany.internal domain, your user would be able to gain access. – Matt Sep 10 '10 at 17:22
ok, that makes more sense, but the other question I have related to the group policy is how do you recieve a group policy if cached credentials has expired? Would we need to hand out another key to that machine? – Warren Bullock III Sep 10 '10 at 18:04
Once they've gotten the group policy once, their system should be aware of the access ssid you are trying to connect to - and won't forget. Logging on with cached credentials (assuming the passwords still match) should still work... If you are worried about cached credentials, you can go the certificate approach, in which every user is given a certificate (group policy again) and the policy is configured for the machine to send the user's certificate to the wifi access point, and the WAP verifies the certificate is still valid. – Matt Sep 10 '10 at 19:51
show 2 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.