Best practices for securing corporate wifi w/ Radius/EAP-TLS/802.1x ?

[doncacciatoconsuting]

Here's my take on a basic best practices for securing corp wifi... Any feedback would be much appreciated.

Client = 802.1x supplicant and certs installed on the machine
Authenticator = Wifi Controller
Authentication Server = RADIUS server
Domain controller for user authentication

Use a Machine cert to allow computer to be authenticated in order to connect to a corporate wifi for initially connectivity. Then the username / password would be used to authenticate the user against Domain Controller and grant permissions.

Q1: Would there ever be a need to use the client cert in this case ?

Q2: You can use any Radius server, but how could a NAC product supplement this deployment ?

Thanks, Don

[AEK]

R1: Certificate is a good second authentication factor. It will prevent someone who knows your password to connect with your credentials.

R2: NAC is more secure and powerful than RADIUS:

• NAC already includes a RADIUS server
• With NAC agent you can identify corp hosts and compliance (AV, OS, patches, ...) and create rules according to compliance status
• Visibility of your entire network, equipment by equipment, port by port, and which user/host/equipment connected to each port
• Incident response. E.g.: when your SIEM detects an attack your NAC isolates the host
• And much much more ...

[doncacciatoconsuting]

Thanks AEK, definitely see how NAC provides the control once auth is complete.

Regarding the Wifi RADIUS EAP-TLS, I have a follow up.

What is the best practice - to use Machine Cert or User Cert for authentication in a Windows AD environment ?

I would think that a machine cert would allow the computer itself to connect to the WPA2-Enterprise SSID as a starting point so it has access to the Domain Controller. Then the user would login to the machine with the AD credentials, get authenticated, and have access to internal resources. Doesn't seem like a user cert is required at all....

[ebilcari]

There are two different widely used protocols: EAP-TLS (only certificates for both: the server and the host) and EAP-PEAP-MSCHAPv2 (certificate from the server side and credentials from the end host).

If the hosts have already a unique valid certificate deployed, you can use EAP-TLS, there is no need to use the AD credentials. Certificate can be revoked in case the user is not valid any longer, for this OCSP is used.

In FNAC deployments using user authentication is preferred in order to auto register hosts to users or apply different enforcement based on the authenticated user.

The user login on the PC will be possible through its cached credentials.