Configuring Cisco Secure ACS for Windows PEAP-MS-CHAPv2 - [Part 2]

Configure the Wireless Network Connection

Complete these steps:

1. Log off and then log on by using the WirelessUser account in the wirelessdemo.local domain.
2. Choose Start > Control Panel, double-click Network Connections, and then right-click Wireless Network Connection.
3. Click Properties, go to the Wireless Networks tab, and ensure that the Use Windows to configure my wireless network settingsis checked.
   
4. Click Add.
5. Under the Association tab, type Employee in the Network name (SSID) field.
6. Select WPA for the Network Authentication and ensure that Data Encryption is set to TKIP.
   
   
   
7. Go to the Authentication tab.
8. Validate that EAP type is configured to use Protected EAP (PEAP). If it is not, select it from the drop-down menu.
9. If you want the machine to be authenticated prior to login (which allows login scripts or group policy pushes to be applied) checkAuthenticate as computer when computer information is available.
   
10. Click Properties.
11. As PEAP involves authentication of Server by the client ensure that Validate server certificate is checked. Also, make sure the CA that issued the ACS certificate is checked under the Trusted Root Certification Authorities menu.
12. Choose Secured password (EAP-MSCHAP v2) under Authentication Method as it is used for inner authentication.
    
13. Make sure the Enable Fast Reconnect check box is checked. Then, click OK three times.
    Step - x : Select the option Configure and uncheck the option present there if you want to enter the user and password manually, and ignore the Step - x if you are already logged in with the correct user and password.
14. Right-click the wireless network connection icon in systray and then click View Available Wireless Networks.
15. Click the Employee wireless network and click Connect.
    
    These screen shots indicate if the connection completes successfully.
    
    
    
    
16. After authentication is successful, check the TCP/IP configuration for the wireless adapter by using Network Connections. It should have an address range from the DHCP scope or the scope created for the wireless clients.
    
    
    We have also configured the Cellphones (tested on Nokia N79 and Windows Mobile) to connect to the wireless router by adding the certificates on them, and now they are also able to authenticate through RADIUS Server. I'll post all the steps involved in it soon.
    
    
    Related Articles:
    Configuring Cisco Secure ACS for Windows PEAP-MS-CHAPv2 - [Part 1]
    
    

Read More

Configuring Cisco Secure ACS for Windows PEAP-MS-CHAPv2 - [Part 1]

Introduction

 I was working on improving and managing (logging) the security of my wireless network and for this purpose I was searching for steelbelted RADIUS which used to be a freeware, but recently I found that Juniper bought it and its no more freeware now. Therefore I started looking for an alternative and I found one that is Cisco ACS. My plan was to place RADIUS behind the wireless routers placed in my office and authenticate the users trying to connect to Wifi through RADIUS server preventing the unauthorized users access and also generate their logs. Below article helped me in the process I have also specified the changes done by me to make things work. The procedure mentioned below is for the workgroup environment not for the Domain environment.

Do let me know if you face any problem I'll be posting more on this soon keep following @ahsantasneem

[Contd..]

Background Theory

Both PEAP and EAP-TLS build and use a TLS/Secure Socket Layer (SSL) tunnel. PEAP uses only server-side authentication; only the server has a certificate and proves its identity to the client. EAP-TLS, however, uses mutual authentication in which both the ACS (authentication, authorization, and accounting [AAA]) server and clients have certificates and prove their identities to each other.

PEAP is convenient because clients do not require certificates. EAP-TLS is useful for authenticating headless devices, because certificates require no user interaction.

Network Diagram

I have used Linksys Wireless Router N-Series instead of Aironet AP1200.

Cisco ACS is installed on a Vmware on Windows Server 2003 (nothing much has to be done just click next-next and access it after installation http://127.0.0.1:2002)

This document uses the network setup shown in the diagram below.

Obtain a Certificate for the ACS Server (Self-Signed Certificate)

The Self signed certificate will be valid for 1 year.

Go to -> System Configuration -> ACS Certificate Setup -> Generate Self-Signed Certificate

Replace xxxx with the name of the certificate.

Install the Generated Certificate

1. Click System Configuration.
   
2. Click ACS Certificate Setup.
   
3. Click Install ACS Certificate.
   
4. Choose Read certificate file and type the location of the cert in my case it was c:\xxxx.cer
   
   
5. Click Submit.
   
6. Click System Configuration.
7. Click Service Control and then click Restart.
   
8. Click System Configuration.
9. Click Global Authentication Setup.
10. Check Allow EAP-MSCHAPV2 and Allow EAP-GTC.
    
11. Click Submit + Restart.
12. Click System Configuration.

Restart the Service and Configure PEAP Settings on the ACS

Follow these steps to restart the service and configure PEAP settings.

1. Click System Configuration, and then click Service Control.
2. Click Restart to restart the service.
3. To configure PEAP settings, click System Configuration, and then click Global Authentication Setup.
4. Check the two settings shown below, and leave all other settings as default. If you wish, you can specify additional settings, such as Enable Fast Reconnect. When you are finished, click Submit.
   
   • Allow EAP-MSCHAPv2
   • Allow MS-CHAP Version 2 Authentication
   Note: For more information on Fast Connect, refer to "Authentication Configuration Options" in System Configuration: Authentication and Certificates.
   

Specify and Configure the Access Point as an AAA Client

Follow these steps to configure the access point (AP) as an AAA client.

1. Click Network Configuration. Under AAA Clients, click Add Entry.
   
2. Enter the AP's hostname in the AAA Client Hostname field and its IP address in the AAA Client IP Address field. Enter a shared secret key for the ACS and the AP in the Key field. Select RADIUS (Cisco Aironet) as the authentication method. When you are finished, click Submit.
   

Configure the Linksys Wireless Router

Add the IP address of your Cisco ACS server next to RADIUS Server and the Shared Key must match the key specified in Cisco ACS key.

And thats it, your Linksys wireless router is configured now with you Cisco ACS RADIUS server.

Related Articles

Configuring Cisco Secure ACS for Windows PEAP-MS-CHAPv2 - [Part 2]

Read More