Help with Enterprise WiFi

Posted by _TheKnightMan_@reddit | sysadmin | View on Reddit | 13 comments

I need assistance configuring an Enterprise Wi-Fi setup for a client of mine. This is a scenario I’ve done a few years ago in the past, though it seems newer security settings on Windows don’t make the exact method I used possible, and I’m not even sure if the configuration I’m attempting is possible in a secure manner anymore. I have access to NPS on Windows Server Unfi Access Points Active Directory ADCS is set up, computers & users are set to auto enroll certificates. User certificates should be unique and are stored in AD so they will roam from computer to computer. Is there a way to have enterprise Wi-Fi set up so that when a domain joined computer boots, it authenticates to the Wi-Fi networking using the machine account (via certificates or any other manner), then when the user logs in, the Wi-Fi then authenticates as the user. I’ve been able to get one or the other working, but not both – client needs both because there are computers that do not have a ethernet connection that need to be managed even when users aren’t sitting at them. Ideally this will all be transparent to the user and use their credentials/certificates in the background. This needs to work for a user that has never signed on to the machine as well – and ideally I’ll be able to filter the users that are able to access the network (eg WORKSTATION1 always on at the logon screen – Bob can log in to WiFi, but Alex cannot as part of their AD Group Membership)

Reply to Post

13 Comments

[-]

ArsenalITTwo@reddit

Doesn't work. Read near the bottom. https://www.wiresandwi.fi/blog/windows-network-authentication-sequence

[-]

_TheKnightMan_@reddit (OP)

I see, I was hoping there was a way to force the user certificate to download on first logon, before the network access is cut when switching from Machine to User, but it looks like that isn't possible at this time. Guess we'll be sticking with Machine Logon.

[-]

ArsenalITTwo@reddit

Yeah that's the rub. I didn't want to confuse you so I edited my post. The trick is getting them access if they haven't logged in before. Now I will let you know some NACs can throw a user into an isolation until they enroll the certificate to the user with SCEP.

[-]

kheywen@reddit

First time stumbling PacketFence. Does it support Azure AD?

[-]

ArsenalITTwo@reddit

For what. Authing users? Yes. But I use on prem AD. But they added Azure a while back.

[-]

kheywen@reddit

Nice. Thanks.

[-]

Cooleb09@reddit

TBH if I was green-fields deploying dot1x today I would 100% buy a NAC product, traditional AD CS + NPS has some issus in todays environent, particularly: Changse to strong cert binding in AD CS will mean that device or user certs issued via scep or similar to Intune devices (or other mem devices) will stop working. This was meant to ahve alreayd happened but was pushed back to later this year. If you are using Intune/Autopilot and Azure Join, device certs will never work as the device has no matching AD object for NPS to authenticate as even if the cert is valid.

[-]

ArsenalITTwo@reddit

Wait what now. I use NDES/SCEP to enroll certificates to new users with Packetfence. What's the issue about the certs? I'm aware of the changes and I haven't seen any users or machines show up lately in that audit log and I issue thousands of certs.

[-]

Cooleb09@reddit

If you are using non MS PKI/not doing 'cert auth with AD' you are unlikely to run into issues. The changes to strong cert binding introduced in KB5014754 that were meant to be enforced early this year, now pushed back to november, will require certs to have a specific OID on them, that cannot be applied when using offline templates (PKCS or SCEP issued templates). If you run third party NAC (packetfene) this is *unliekly* to be a problem. if you are using NPS it liekly *will* be a problem.

[-]

_TheKnightMan_@reddit (OP)

Reading the KB seems to indicate this won't affect on-prem certificates (issued after May 2022 updates were installed). Just confirming this seems to be the case

[-]

Cooleb09@reddit

Correct, if the certs are issued after the template was update and via an online template (i.e not SCEP, PKCS etc) then they shoudl still work.

[-]

ArsenalITTwo@reddit

Ok thanks. I was about go to pull my hair out if there was an issue.

[-]

kheywen@reddit

Two things, authentication and authorisation. You need to complete authentication before authorisation. Windows NPS is very limited, you may need to look at better radius like Aruba Clearpass or Cisco ISE. You can use machine certificate to authenticate with dot1x and present authorisation as user to determine the vlan and acl etc.