802.1x Radius Setup Guide Working AirLive AP with Win X Radius Server

Transcription

1 OvisLink 8000VPN VPN Guide 802.1x Radius Setup Guide Working AirLive AP with Win X Radius Server

2 Table of Content Secured Enterprise Wireless Environment Configuration Guide... 3 WHAT IS THIS GUIDE FOR?... 3 HOW TO CONFIGURE A SECURED WIRELESS ENVIRONMENT? WHAT DOES IT NEED?... 3 TESTED ENVIRONMENT:... 3 Part 1: Installation and Configuration for Windows 2003 Server environment... 4 Part 2: Configuration for AirLive WL-5460AP secured wireless AP environment Part 3: Set up wireless WPA connection for Windows XP Part 4: Add and set up a secured wireless AP for RADIUS in Windows Part 5: Adding a new user to access the secured wireless AP Verify the Secured wireless environment Disclaimer: OvisLink Corp has made the best effort to ensure the accuracy of the information. However, we are not liable for the error in this guide. This guide is for your reference only OvisLink Corporation, All Rights Reserved 2

3 Secured Enterprise Wireless Environment Configuration Guide What is this guide for? This guide provides a step-by-step example for AirLive wireless AP (Access Point) products in a secured enterprise corporate environment. How to configure a secured wireless environment? What does it need? To configure a secured wireless environment includes three parts. They are 1. AS (Authentication Server): Windows 2003 Server 2. AP (Authenticator, or access Point): AirLive WL-5460AP 3. Client (802.1x client, WPA client, or Supplicant): Windows XP Pro At the end of this document, we will set up a wireless user account and add an AP for Windows 2003 RADIUS. After the environment set up, to add one more AP, use Part 4 step 1 to step 5; to add one more user, go through Part 5 again. The components may vary if desired. For example, the client may not be Windows XP Pro, but the administrator needs to have related knowledge to perform the jobs. In this guide, the administrator will perform the least required configuration to make a secured enterprise wireless environment using standard Windows without any extra devices. Estimated Configuration Time Needed: 2 Hours (including installation of a new Windows 2003 Sever) Tested environment: Intel Celeron based PC 2.8GHz with Windows 2003 Enterprise Server AirLive WL-5460AP Intel mobile Pentium 750 (1.8GHz) with Windows XP Pro 3

4 Part 1: Installation and Configuration for Windows 2003 Server environment Microsoft Windows 2003 has four versions. We will use Windows 2003 Enterprise Server for this example. Windows 2003 Standard Server works for this environment, but instead of IP address, it can only use a computer name in configuration. This limitation is removed in Enterprise Server. Other versions of Windows 2003 Server may not work. They need more effort to do the job. The environments need the services from Windows 2003 including DNS, IAS, IIS, Active Directory, and CA. These service components will be described in detail from step Install Windows 2003 Enterprise Server in a PC. Customize whatever needed. Check if the server can be up and running correctly including the NIC set in Control Panel - Network Connections. Note that the PC needs to be a Domain Controller with Active Directory. So the PC must be created with an NTFS file system in hard drive. 2. Go to Start - All Programs - Administrative Tools and run "Administrative Tools". 3. Click (use mouse left button and click) on Next> button. 4

5 4. Click on Next>. 5. Click on Domain Controller (Active Directory) and then Next> button. 5

6 6. Click on Next> button 7. Active Directory Installation Wizard pops up. Click on Next> button. 8. Click on Next> button. 6

7 9. Set up a new domain controller. Click on Next> button. 10. Set up a domain in a new forest. Click on Next> button. 11. Enter any name you like in Full DNS name for new domain field. Click on Next> button. If a warning message pops up, there are two options to continue. Ignore it if this is not a real FQDN DNS server, which means it is not to server the Internet user as a DNS server. Or, change for a name until the warning not showing up. 7

8 12. Enter a name for this domain NetBIOS name. 13. Click on Next> button. 14. Click on Next> button. 8

9 15. To select the second option, click on Install and configure DNS server on this computer. Click on Next> button. 16. Click on Next> button. 17. Click on Next> button. 9

10 18. Click on Next> button. 19. Wait a few moments. 20. Windows setup wizard pops up, wait still

11 22. If the computer is using a dynamic IP address, a warning pops up. Click on OK button. If no this message, proceed to step Click to highlight Internet Protocol (TCP/IP). Then click on Properties button. 24. Change the IP address for this PC. Assuming this PC will be , subnet mask Click on OK button. 25. Click on OK button if this message pops up. Click on Close button. 11

12 26. Wait a few moments for Active Directory Installation Wizard. 27. Click on Finish button. 28. Click on Restart Now button. 29. After restart, the following message pops up. Click on Finish button. 12

13 30. On screen, go to Start Control Panel Add or Remove Programs. 31. Click on "Add/Remove Windows Components" 32. Click on "Application Server" and then "Details..." 33. Click on "Internet Information Services (IIS) and then "Details..." 13

14 34. Use right side scrollbar and scroll down to the bottom. Click on "World Wide Web Service" and then "Details..." 35. Click and check on "Active Server Pages" and "World Wide Web Service". Click on OK button. The small window is closed. Click on OK button again to close Internet Information Services (IIS). 36. Click on "Message Queuing" and then "Details..." 14

15 37. Click and check on "Active Directory Integration". The required components are automatically checked. Click on "OK" to close "Message Queuing". Click on "OK" again to close "Application Server". 38. Click and check on Certificate Services. 15

16 39. A warning message pops up for Certificate Services. Click on Yes button. 40. Use right scrollbar and scroll down to see "Network Services". Click on Network Services" and then "Details..." button. 41. Click and check on Internet Authentication Services. Then click on OK button to close Network Services. 42. Choose a CA type. Click to select Enterprise root CA. Then Click on Next> button. 16

17 43. Enter a name for the CA. Then Click on Next> button. 44. Enter the path to store certificates and the logs. Then click on Next> button. 17

18 45. Click on Yes button to confirm if new directory names to be created. 46. Wait a moment. 47. When the next message pops up, click on Yes button to continue. 48. Click on Finish button. All services needed in Windows by secured wireless environment are installed. 18

19 Part 2: Configuration for AirLive WL-5460AP secured wireless AP environment Assuming this AP has been correctly configured and work for wireless client. We are going to set up a secured wireless client and AP with WPA. 1. Login to AP. If the AP has not been changed for its IP address, enter in a browser URL field. 2. Click on Wireless Security. 3. Click on Encryption field and select WPA. 4. Click on Enterprise (RADIUS) to select WPA Authentication Mode. 19

20 5. Enter RADIUS authentication information for IP address and password. Note 1: do not change the standard port number. Note 2: the password will be used later in Windows 2003 server 6. Enter RADIUS accounting information for IP address and password. Then click on Apply Changes button. Note: do not change the standard port number. 7. Click on OK button. 20

21 Part 3: Set up wireless WPA connection for Windows XP Assuming the wireless client was used to connect to a wireless AP. The Windows XP wireless client is the first time to connect to a secured enterprise wireless network. 1. Go to Start Control Panel. Double click on Network Connections. 2. Double click on Wireless Network Connection. 3. Click on airlive1. ( airlive1 is the secured wireless network). Click on Change advanced setting at left panel. Note 1: you may have a different name, depending on what you name your wireless NIC. Note 2: If you do not see the secured wireless AP, click on Refresh network list at left panel. 21

22 4. Click on tab Wireless Network on top. 5. Click on airlive1 (Automatic). Then click on Properties button. 22

23 6. Click on tab Authentication on top. 7. Click on and select EAP type of Protected EAP (PEAP). Then click on Properties button. 8. Click and uncheck Validate server certificate. Click and check Enable Fast Reconnect. Then Click on Configure button. 23

24 9. Click and uncheck the option. Then click on OK button. Click the OK buttons to close the rest of the windows opened on screen. 10. After close all the rest of the on-screen windows, the following pop-up message will show up at the bottom-right system tray. Click on the message. 11. Enter the user name and the password. Then click on OK button. Note: usually it is OK to leave Logon domain blank. 24

25 If you do not see any more error message, you are successfully authenticated by AS and login. You can start to use the wireless network connection. Part 4: Add and set up a secured wireless AP for RADIUS in Windows Go to Start Administrative Tools Internet Authentication Services 2. In left panel, right click (use mouse right button and click) on RADIUS clients. Note: The wireless AP is a RADIUS client. RADIUS server is in Windows User is neither a RADIUS client, nor a RADIUS server. 25

26 3. Right click (use mouse right button and click) in right panel white space. Select New RADIUS client and click. 4. Enter a name for the AP in Friendly name: field and its IP address or DNS name in Client address (IP or DNS): field. 5. Enter the Shared secret and re-enter it in Confirm shared secret. Click and check Request must contain the Message Authenticator attribute. Then click on Finish to close the New RADIUS client. 26

27 Note: Adding a new secured wireless AP is done. The following procedure is only needed for the first time configuration in Windows In left panel, click on Remote Access Logging. In right panel Logging Method, double click on Local File. 7. Click and check all three options. Then click Apply and OK buttons. 27

28 8. In left panel, click on Remote Access Policies. Secured Enterprise Wireless Setup Guide 9. Right click in right panel white space. Select New Remote Access Policy and click. 10. Click on Next> button. 28

29 Select and click on Use the wizard to set up Enter a name for this wireless connection policy. Then click on Next> button. 11. Select and click on Wireless. Then Click on Next> button. 29

30 12. Select and click on User. Then click on Next> button. 13. Select Protected EAP (PEAP) as the type of authentication method. Click on Configure button. 14. Click and check Enable Fast Reconnection. Click to select Secured Password (EAP-MS CHAPv2) EAP type. Click on Edit button. 30

31 15. Modify as needed and then click OK button to close EAP-MS CHAPv2 properties. Click OK to close Protected EAP properties. Click on Next> button. Click on Finish button to finish the RADIUS settings in Windows Part 5: Adding a new user to access the secured wireless AP 1. Go to Start All Programs Administrative Tools. Select and click on Active Directory Users and Computers. 31

32 2. Double click to expand security.sec (the name may be different, if you use other name.) In Left panel, right click on Users. Select New. Then select and click on User. 3. Enter the user information. Then click on Next> button. Note only User logon name is really needed here for the wireless client. 4. Enter user password twice. Check and uncheck options as needed. Click on Next> button. Note: in a high secured environment, Windows 2003 requires passwords to include capital, small letters, and numbers combination. 32

33 5. Click on Finish button. The user should have been added in the right panel. 6. Right click on the user ( test here) in the right panel. Select and click on Properties. 33

34 7. Click on tab Dial-in on top. 8. Select and click on Allow access. Click on tab Account on top. 34

35 9. Click and check on Store password using reversible encryption. Click on Apply and then OK buttons to close user properties. Now the secured wireless environment has been set up completely. 35

36 Verify the Secured wireless environment To verify the environment, try to connect a wireless Windows XP with AirLive WL-5460AP. If it connects successfully, take a look the Event Viewer. Go to Start Administrative tools Event Viewer. Click on System at the right panel. An IAS message should have been recorded as source from IAS. Double click on the item and see the next message showing granted access. If said access denied, scroll down the right scrollbar to see the access denied reason. 36