Setting up XP+IAS+Auto-enrollment wireless LAN?

From: Al Blake (al_at_removethistext.blakes.net)
Date: 09/29/04 

Date: Wed, 29 Sep 2004 16:12:05 +1000

Environment: Windows 2003 Native AD LAN
12 Windows 2003 servers, inclduing IAS running on W2k3 Enterprise
600 Windows XP SP2 laptops/desktops.

Proposal: Provide seamless, secure wireless connectivity for 250+ XP SP2
Laptops through Cisco 1200 APs.

I have searched around for as much information as I can on technet/MSDN
regarding setting up wireless LANs and securing them using auto-enrolled
certificates from a certificate server....but I am getting confused with
terminalogy and where I need to go next. Most of the white paers and
examples seem to relate to smartcard setup - which we ar enot doing.

So far I have configured a test OU in my AD and placed a single laptop in
there. I have rebooted the laptop and it gets issued with a certificate
automatically which is exactly what I want to happen. Questions:

a) The example I had told me to use a 'User certificate' template to
autoenrol the machine. Is this correct or should I have created a copy of a
'computer' certificate and used that on the machine OU (is there any
difference between a computer certificate and a user certificate in Windows
Certificate services).

b) If we are going to use the autoenrolled certificates as the basis for
security in our WLAN setup do we need to auto-enrol certificates for users
AND computers? (ie should the user OU and the computer OU be setup to issue
certs?)

c) What next? Once I have got certificates automatically issued for the user
and/or the computer how do I setup the whole thing so that the Access points
use them? I have configured the access points to use my IAS server as radius
for authentication and know that is working form the point of view of
authenticating my telnet login to the AP....but what do I need to tell them
to use the certs?

d) Can someone confirm whether we still need WEP if we are using EAP?

e) What do we need to setup on the IAS server to support EAP?

I am sorry this is so vague but I thought I had it sorted for a while and
then just got more confused with all the terminalogy and options.
If anyone can point me at a white paper 'setting up IAS to support EAP and
autoenrolled certificates' I would really appreciate it!

Regards
Al Blake, Canberra, Australia

Relevant Pages

  • 802.1x log off?
    ... I'am working on a project with 3com superstack 4400, AD, IAS and certificate ... I presumed that windows would send an EAP-logoff message to the IAS server ...
    (microsoft.public.internet.radius)
  • Re: SBS Wireless policy
    ... You don't need ISA, and as far as I know, ISA 2004 settings would be the ... only thing that would block certificate enrollment. ... the laptop will make it show correctly. ... If just having the cert installed and verifying that setting in IAS don't do ...
    (microsoft.public.windows.server.sbs)
  • Re: 802.1x PEAP with VeriSign WLAN certificate
    ... to use that we have a RADIUS server (Windows 2003 IAS), ... I have followed the "Obtaining and Installing a VeriSign WLAN Server ... Certificate for PEAP-MS-CHAP v2 Wireless Authentication" guide from ...
    (microsoft.public.internet.radius)
  • Uniblue.....RegisterBooster 2
    ... I have the windows vista Ultimate.. ... I installed it on my Laptop, ... missing files and no need to format my windows.. ... Is this program has a certificate from the Microsot?? ...
    (microsoft.public.windowsupdate)
  • Re: EAP-TLS design criteria for certificates
    ... Certificate requirements are listed in online help for Windows 2003 IAS. ... The Windows 2003 IAS help files are also available online at ...
    (microsoft.public.internet.radius)