Microsoft NPS as RADIUS for WiFi

Note: The described things were practically tested on Windows Server 2019 and wireless networks built on Cisco Catalyst 9800 Wireless Controller (WLC). They should work generally.

Network Policy Server (NPS)

• Network Policy Server (NPS)

When users log in to a wireless network, authentication can be performed against Active Directory. For IEEE 802.1x authentication, we can use the RADIUS (Remote Authentication Dial-In User Service) protocol. Windows Server includes a component called Network Policy Server (NPS), which we can use as a RADIUS server.

RADIUS Authentication and Authorization

The Client (user or computer) logs into WiFi. It sends its authentication to the AP (Access Point) or WLC (Wireless LAN Controller), the general RADIUS term is Network Access Server (NAS). The WLC (or AP) is in the position of a RADIUS Client and sends a RADIUS: Access-Request to the RADIUS Server (NPS). The request contains (attributes) the client's credentials and other information about it (such as IP address), plus information about the NAS (WLC).

The RADIUS Server authenticates the client using authentication schemes. It may also check if it meets other defined conditions (Authorization attributes). Based on this, it responds with one of the messages RADIUS: Access-Accept, Access-Reject or Access-Challenge. The response may contain additional information (Reply-Message attribute).

NPS Configuration Parts

• RADIUS Clients and Servers - RADIUS Clients - we create a client (WLC) so it can connect to the server, we enter its name, IP address, Shared Secret
• Policies - Connection Request Policies - the default policy Use Windows authentication for all users may be sufficient for us
• Policies - Network Policies - the main part of the configuration that defines authentication and authorization parameters

Network Policy

We create a new policy. We can create multiple policies with different parameters. When a request comes in (Connection Request / Access Request), the list of policies is traversed in the given order and conditions are compared.

• Policies - Network Policies - New

During creation, a wizard is followed where we enter the main parameters. Subsequently, we can edit the policy and adjust or add additional settings. The areas (tabs) of the policy are:

• Overview - general settings and policy enablement
• Conditions - conditions, if the connection request meets them, this policy is applied, otherwise it continues to the next policy in line
• Constraints - constraints are additional parameters that the request must meet, if not met, the request is rejected (it doesn't continue to the next policy), primarily we set authentication methods (Authentication Methods) here
• Settings - we can define settings that NPS will apply to the connection request or pass to the client

Overview

• Policy Name - name of the policy
• Policy Enabled - policy activation
• Grant Access - policy allows access
• Ignore user account dial-in properties - we can use this if we don't want to deal with settings on the Dial-In tab of the user account
• Type of network access server: Unspecified - general type

Conditions

We can choose from a range of condition types. We must enter at least one, but we can use more. Then all must be met. In many conditions, we can use a regular expression (pattern) Use Regular Expressions in NPS.

If requests are already coming in, we can look at the log where we will see individual items and their values that we can use in the conditions.

• Event Viewer - Custom Views - Server Roles - Network Policy and Access Services

Some of the conditions that we will use for wireless networks:

• Client Friendly Name - name of the defined RADIUS Client, this limits the policy to a specific source (here WLC)
• NAS Port Type - determines the type of media used by the client, for example for logging into a wireless network it's Wireless - IEEE 802.11, we can thus distinguish whether it's a request from WLC to log into WLAN or perhaps SSH login to CLI (here Cisco sends type Virtual)
• Windows/Machine/User Groups - we can limit to certain groups (of users or computers) in AD DS, thereby restricting that only these verified accounts log in
• Called Station ID - RADIUS attribute which (at least for Cisco WiFi, but should work for other manufacturers too) contains MAC address of AP:SSID (interestingly, in the Calling Station ID attribute is the client's MAC address), we can use the regular expression SSID$ (dollar means that the end of the string is compared) and thus limit the policy to requests for a specific WLAN

Constraints

The main item we set here is Authentication Methods. We can also set Idle and Session Timeout, which should apply instead of the settings in WLAN on WLC.

As an authentication method, we should only use secure Extensible Authentication Protocol (EAP). We have two (usable) methods available:

• EAP-TLS - considered the most secure, server and client are authenticated by certificate, we select EAP Type: Microsoft: Smart card or other certificate and we must choose a server certificate
• Protected EAP (PEAP) - server is authenticated by certificate, client can use password or certificate (according to the chosen method), we select EAP Type: Microsoft: Protected EAP (PEAP) and we must choose a server certificate and add a method, commonly Secured password (EAP-MSCHAP v2) is used, where a password is used (referred to as PEAP-MSCHAP v2)

In both cases, the communication is encrypted using the server certificate. So we need to have a trustworthy (for clients) certificate on NPS. For EAP-TLS (or PEAP-TLS) we must have certificates deployed on clients, i.e., operate PKI. These can be user or computer certificates stored in the local store or on a smart card.

We can set multiple EAP methods in a certain order, which are negotiated with the client. For example, if we want clients with a certificate to log in using EAP-TLS and others using PEAP-MSCHAP v2, we can enter both methods in this order. If we entered them in reverse, PEAP-MSCHAP v2 would always be used.

When using PEAP-MSCHAP v2, Single Sign-On (SSO) can work and the user is logged into WLAN (e.g., with a computer account) without having to enter login credentials. In Windows 11 version 22H2, Credential Guard is enabled by default. This blocks the use of SSO with this protocol and forces the entry of login credentials. The recommended solution is to switch to EAP-TLS or PEAP-TLS.

Settings

On the settings tab, we can define RADIUS attributes that the RADIUS server sends to the client upon successful use of the policy. We can choose from a range of standard attributes and then specific ones for certain manufacturers. We should mandatorily set (automatically set when creating the policy):

• Framed-Protocol: PPP
• Service-Type: Framed

We can use these attributes to pass interesting information to the RADIUS client, which can apply it to the user's connection. For example, for WiFi, assignment to a certain VLAN should work (Tunnel-PVT-Group-ID), so clients can use the same SSID but end up in a different network. For VPN, we can pass the group name, so the user is assigned to a certain VPN. For logging into Cisco IOS CLI, pass authorization (privilege level). There are many possibilities.

Examples of Network Policy

A brief example of two policies for two different WLANs (SSIDs). Only the main parameters are listed.

Corporate laptops with computer certificate

The policy applies to login from WLC to WLAN with SSID wifi. Login with a computer certificate is required. The computer must be in the domain - Domain Computers group (we can restrict to a certain group of computers).

Overview

• Policy Name: wifi access
• Processing Order: 1

Conditions

• Client Friendly Name: WLC
• NAS Port Type: Wireless - IEEE 802.11
• Machine Groups: Domain Computers
• Called Station ID: wifi$

Constraints

• Authentication Methods: Microsoft: Smart card or other certificate

Mobile devices and others

The policy applies to login from WLC to WLAN with SSID wifi2. Login with a certificate or domain account (password) is required.

Overview

• Policy Name: wifi2 access
• Processing Order: 2

Conditions

• Client Friendly Name: WLC
• NAS Port Type: Wireless - IEEE 802.11
• Called Station ID: wifi2$

Constraints

• Authentication Methods:
  • Microsoft: Smart card or other certificate,
  • Microsoft: Protected EAP (PEAP) - Secured password (EAP-MSCHAP v2)