We are implementing WiFi on Windows 7 machines in our corporate environment. Machines should be able to log into the domain by WiFi as the Machine (Pre-Logon), and as the User (Post-Logon). We have everything working correctly except for 2 things:

1) Sometimes the login scripts don't run 2) The user VLAN is sometimes different than the machine vlan, and no DHCP renew occurs after user logon.

I am clear that both these problems should be fixable by using the "Single Sign On" Option under the 802.1x Wireless Vista GPO, and setting the wireless to connect immediately before user logon and also by enabling "This network uses different VLAN for authentication with machine and user credentials"

If I enable these GPO settings in a lab, the computer does authenticate & gets WIFI before the user logs on, so when the login box is displayed, it says “Windows will try to connect to ”, even though it is already connected (which should be ok?). Enter the user credentials and it goes to a screen saying “Connecting to ”, hangs for 10 seconds, fails with “Unable to connect to , Logging on…”. Desktop fires up and then the user re-authenticates with no problem as himself instead of the machine, but by that point, we defeat the point of the WiFi SSO “before user logon”. Also by that point, no DHCP renew seems to occur, and the user is still stuck with the wrong IP address for the new VLAN.

When the “Connecting to ” screen comes up, there’s no indication on the AP or the Radius server that anything whatsoever is happening after credentials are entered until after the domain logon.

Also with this policy enabled, sometimes windows hangs on a black screen indefinitely until I disable the Wireless NIC, so something is knackered for sure.

What have I missed?

Suggestions are much appreciated... /P

  • Update: Things seem to work properly without "This network uses different VLAN for authentication with machine and user credentials". As soon as we enable that checkbox, we get "Unable to connect to <SSID>" and sometimes windows hangs after logon. – Phaedrus Oct 17 '12 at 16:00
  • Update 2: We are able to support dynamic VLANS with the following settings: Enable Fast Reconnect (Not Checked), Enable Single Sign on (Checked) , Immediately before login, and importantly, "This network uses different vlan for authentication.." - NOT checked, and most importantly, Authentication mode set to "User Authentication". So the trade off for now is not having machine authentication. – Phaedrus Oct 17 '12 at 18:11
  • Update 3: We decided we need to support computer authentication, so we have moved to a new model. The Cisco ACS no longer provides the VLAN ID. Instead, i configured multiple SSIDs mapped to different vlans on the Aironet Access Points. Then, we map users & machines to SSIDs in Group Policy. This works MUCH smoother within windows, since it's obvious which VLAN maps to which SSID. – Phaedrus Oct 31 '12 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.