Chapters. Prerequisites: Eduroam in a Microsoft Windows 2008r2 environment.

Transcription

1 Eduroam in a Microsoft Windows 2008r2 environment. This guide will help with the deployment of eduroam in a Microsoft Windows 2008r2 only environment. We will briefly note the prerequisites for a successful deployment. It is required to have basic knowledge of Active Directory, Radius and 802.1X technologies. In April 2013 we deployed eduroam at Onderwijsgroep Noord. Onderwijsgroep Noord is an umbrella organization which consists of AOC Terra, Dollard College and rsg de Borgen. We provide education to scholars at 24 locations. Chapters Eduroam in a Microsoft Windows 2008r2 environment Prerequisites:... 1 Active Directory... 2 Radius configuration... 2 Connection Request Policy... 3 Network Policy... 5 Sources... 7 Prerequisites: Working Active Directory environment at 2008r2 functional level. Check this with Active Directory Domains and Trusts DNS resolvable User Principal Name suffix. This is required prerequisite for a successful and manageable deployment. In the next chapter I will explain how this can be achieved without renaming your Active Directory Domain. Working Radius server. Radius is part of the Network Policy and Access Services server role. Wireless network with support for multiple SSIDs and VLANs per radio. This way you can support separated wireless networks for example eduroam, guest, voice, students and employees. The network at Onderwijsgroep Noord consists of Hewlett Packard MSM422 access points and Hewlett Packard MSM765 controllers. It is required that the access points or the controller put the SSID in the Radius Request so the Radius server can differentiate between the SSIDs. I will come to this later Firewall rules for inbound and outbound traffic between your local radius server and your national upstream radius server. You only need to allow traffic on UDP port 1812 between these two servers. SSL certificate for signing the PEAP sessions. This certificate should be installed on all Radius Servers en should contain the Fully Qualified Domain Names of the Radius Servers. This

2 certificate needs to be selected in all policy s which define a PEAP authentication method. Self-Signed certificate could be used but is not recommended. Active Directory For authenticating of users for eduroam the radius servers which are part of the eduroam network need to know where to send the Access Request Packets. Part of this system are special NAPRT records. These records are added to your external DNS zones as hints for the radius servers. Ask your national eduroam provider for the exact syntax. For these NAPTR records to work you have to make sure that login names consist of a username part and a domain part. This can be achieved by using the User Principal Name (UPN) in your Active Directory Domain. By default the UPN suffix is the same as your Active Directory Domain Name. If this name is resolvable on the internet you are ready to go to the next chapter. If you use a non-resolvable Active Directory Domain Name then it is possible to add additional UPN Suffixes to your domain. This way you don t have to rename your domain for eduroam to work. For easy adoption by users I have chosen to make the User Principal Name the same as the address. How do you do this? Open Active Directory Domains and Trusts Right click Active Directory Domains and Trusts en open Properties Here you can add additional UPN Suffixes. At the account information of a user you can change the User Principal Name. Please note that a user can have only one UPN. So if you already use the current UPN you are in for some extra work. Radius configuration I presume that you have a working configuration and your current Access Points are already using Radius for authenticating clients. We need to make some extra policy s for eduroam. If you have multiple Radius servers, which is advised, you need to make the following settings on all radius server.

3 Create a shared secret template so it can be referred to by the other policy s. This way you have one place where to put and eventually update the shared secret. Create Radius Clients for the national eduroam servers with whom you are about to connect. Use the previously created shared secret template as shared secret. Create a Remote Radius Server Group. Add the national eduroam servers to this group. As shared secret you can use the previously created shared secret template again. The other options can be left alone. Connection Request Policy Create four Connection Request Policy s 1. The first policy is for authentication requests from your national eduroam provider. Put your national eduroam providers ip addresses as a condition. Below you can see the condition and settings I have made in this policy. Examples for regular expressions used in conditions can be found here: 2. The second policy authenticates your own users when they are using eduroam at your site. This way you don t send unnecessary requests to your national eduroam provider. To keep the requests local you need to add a User Name Condition. You have to escape the dots en separate different domain with a pipe symbol. Also you have to add conditions to make sure this policy only applies to request for access to the eduroam SSID. Most Access Points can put the SSID in the Called Station ID field. At last you need to set the authentication method. For eduroam this is set to PEAP with MSCHAPv2 inside. Check if the right certificate is selected at the authentication method.

4 3. The third connection request policy forwards requests for access to your wireless network from external users to your national eduroam provider. As authentication provider you select Forward request to the following Remote Radius Server Group. Select the group you created earlier. The User Name condition makes sure that only usernames with a realm are forwarded to the national eduroam provider. Some eduroam Identity Providers return VLAN information in their radius Accept Messages. This information can collide with your own VLAN settings. If you have a fixed VLAN configuration you should erase this information in these Radius Accept messages. As Radius from Microsoft can t erase this information, we reset it to values our equipment can understand. These are settings like Tunnel-Medium-Type, Tunnel-Pvt-group-ID and Tunnel-Type.

5 4. The last policy takes care of users who have forgotten to supply an UPN-Suffix. These users are denied access. Network Policy Finally you need to create two Network policies. In these policies you define which of your local users may use eduroam. 1. The first Network Policy defines which local users can use eduroam at external locations. As condition you define your national eduroam provider, using Client IPv4 Address and group or groups with users who may use eduroam remotely. In most cases you use the same user groups for both policies.

6 2. The second Network Policy to create, is a policy to define which local users can use eduroam at your location. As condition you define the SSID and User Group for which this policy counts. 3. The last Network Policy deny access to all users who did not meet the previous Network Policy s. This should be your last Policy concerning Wireless access.

7 Sources Configuring Microsoft NPS for eduroam-us By Derek O'Flynn at LSUHSC Configuring Microsoft NPS for eduroam-us by James Macdonell at CSU San Bernardino With the help of Robert Klein at Kennisnet I have deployed eduroam at our educational institute