802.1X Wireless Machine Certificate based RADIUS Authentication (using NPS) with FortiAP's

[FortiNet_Newb]

We have a few new FortiAP's (running FAP 7.4.5) and managed by our FortiGate (running FOS 7.4.8).  I would like to allow our laptops to automatically connect and authenticate to our Wi-Fi network using their machine  certificates.  We have an internal Windows CA and are using Windows NPS as a RADIUS server, is there a guide available to get this working properly on the FortiGate RADIUS and SSID configuration side?

I've been spinning my wheels on this for awhile now.  Do the FortiGates/AP's even support EAP-TLS (or EAP-TTLS) or do I have to stick with MS-CHAP-V2?  When adding the RADIUS server in the FortiGate, MS-CHAP-V2 seems like the limit.

Thanks!

[Markus_M · Accepted solution]

NPS and FortiAP support EAP-TLS. It is not available on the RADIUS server configuration, as EAP is irrespective of the RADIUS configuration and will be encapsulated inside RADIUS messages.
The RADIUS server needs to plainly be added on FortiGate with no specific auth method, or whichever you choose. On SSID side, FortiGate as wireless controller, you select WPA2/3 Enterprise and select the configured RADIUS server object. That is it.

Outside that, you will likely have to set up certificate trust between the Windows workstation and the NPS.
EAP-TLS will have the NPS send its certificate, the client needs to trust it. If so, the client will send its own certificate. NPS needs to trust it. NPS can then validate the content of the user certificate.

There is a guide that may be old, but is quite valid.

https://community.fortinet.com/t5/FortiAP/Technical-Note-EAP-TLS-wireless-LAN-deployment-on-Android-...
If you know (!) that the certificates are trusted, keep in mind that in later Windows versions, the client will display a message about you being sure to connect to that SSID.
That would be explained here, it is unrelated to the NPS or hotspot:

https://techcommunity.microsoft.com/discussions/windowsserver/windows-11-clients-cannot-authenticate...

[FortiNet_Newb]

Markus,

Thanks for the explanation and for providing those links.  I was able to get it all working using the instructions you provided in the first link (https://community.fortinet.com/t5/FortiAP/Technical-Note-EAP-TLS-wireless-LAN-deployment-on-Android-...).

Thanks!

[Markus_M]

Thanks for the feedback. May help others stumbling over this!