Windows domain authentication (PEAP) for wifi

[#1]

Is there a way to set up PEAP authentication against Windows AD? For example, the goal we are trying to achieve is for a user who is in wifi range to be automatically connected to the wifi network using WPA encryption and Windows domain credentials. In other solutions the AP talks to the Windows IAS server, which is set up to allow access based on Windows domain groups. Is anything like this possible using the wifi 60a?

[BBoysza · Accepted solution]

(I realize this post is old, but this needs to be written.) Yes, using Windows RADIUS (aka IAS). ------Windows IAS-------- Install IAS. Create a RADIUS Client entry for your FortiWifi (and assign password) Create a Windows group in AD to which you will assign your Wifi-enabled users to (or use existing group) Create a Remote Access Policy. Add a Policy Condition that says " Windows-Group matches " DOMAIN\Group" . IF You have multiple clients (a RADIUS client is NOT a Wireless user/client, but a FortiGate or several, instead) that will access the RADIUS server, add a Policy Condition that says " NAS-IP-Address" . Hint, you can have multiple instances of the SAME IAS RADIUS server on a FortiGate WHEN you use the option of NAS-IP-Address (available on older versions through CLI). We don' t use a real IP, just a number that will match the policy we want to use. This way you can use the same RADIUS server that will give DOMAIN ADMINS access to login to the firewall, while at the same time using another group for WPA. Check Grant remote access. Click Edit Profile. Click Advanced tab. Add Service-Type of Framed. Add Framed-MTU to usually no larger than 1435. Click Authentication tab. Uncheck all options except MS-CHAP v2. Click EAP Methods. Edit Protected EAP. Pray that you have an appropriate Security Cert already installed. Add EAP Type of " Secured password (EAP-MSCHAP v2)" . Turn on Fast Reconnect if you like. Click Ok. Click Ok again. Click the IP Tab. Set ' Client may request an IP address' . Click ok. You may add other constraints, but this will get WPA up and running. ------End Windows IAS-------- ---------User Objects---------- Edit each user and enable Remote Access from the Dial-in tab. ------End User Object--------- ------FortiWifi------------------- Under User, choose RADIUS. Add your RADIUS server with IP and secret you chose when creating the RADIUS client on IAS. Add NAS IP/Called Station ID IF you choose to use the same RADIUS. This doesn' t have to be a real IP, as it' s never used for communication. It acts as an ID, but in the format of an IP. I use 1.1.1.1, then 1.1.1.2 etc. Again, this will allow you to use the same RADIUS server for multiple purposes on the FortiGates. Ultimately, this equates a Windows group to a RADIUS server entry - so you can name your RADIUS entry to match the Windows Group to which it is " associated" . Click Ok. Under the System menu, choose Wireless. Choose existing Wireless interface or create a new one. Under Wireless settings, set Security Mode to WPA or WPA2 (AKA WPA-Enterprise). Set Data Encryption to TKIP or AES - whatever combination your CLIENTS will support. For Authentication, set RADIUS server to the entry you' ve just create in the User section. Click Ok. ------End of FortiWifi------------------- --Windows XP Client w/ WZC & SP2-- View properties of your Wireless adapter. Add a Preferred network for your WPA SSID. Set network authentication to WPA (or WPA2 if supported) to match settings on FortiGate. (No, not PSK) Set Data Encryption to TKIP or AES, again to match FortiGate. Click Authentication Tab, set EAP type to Protected EAP. Uncheck Authenticate as computer when computer information is available. (You could in this case use machine objects to authenticate - but if that machine gets ripped off, they have access to your network - so it' s a bad idea). Click Properties. Uncheck Valid server cert. Set ' Select Authentication Method' to Secured password (EAP-MSCHAP v2). Enable Fast Reconnect. Click configure. If you set the option to " Automatically use my Windows logon name and password (and domain if any)" - IT WILL ALWAYS USE " DOMAIN\USER" or " COMPUTER\USER" . If you uncheck this option, you WILL be prompted when that SSID is in range! If these are domain users on domain member laptops, then leave it checked. Click ok. Click ok. Click ok. Click ok. --End Windows XP Client w/ WZC & SP2-- Other clients. Good luck. Realize that not all WiFi adapters support WPA/WPA2. Not all Wireless client suite software supports WPA. This also works with Windows 2000 IAS. Vista client works as well ' out of the box' with Vista' s WZC. Also tested with Mac Mini and MacBook Pro. WPA is the best and most secure way to deploy Wireless in a Windows (or RADIUS-enabled) environment.