WLAN using IAS

[Davix]

Task:

I was asked to roll out a wireless solution that will only allow specified computers and/or users access to network.

Example: Laptop A is allowed on WLAN, Laptop B is not; Jill is allowed on WLAN but Bill is not. Jill can get on WLAN only on Laptop A, Bill cannot get onto WLAN on either Laptop A or B. (simple enough?)


Solution 1: (prefered)

After some research I like the solution offered by Microsoft; "Securing Wireless LANs with PEAP and Passwords". It uses IAS and certificate servers, certificate is assigned to IAS but not to individual machines and users. Simple easy to manage but not having issues with getting results I want (see Problem below).

Solution 2do able but I no likey...)

I am familiar with the other option; "Securing Wireless LANs with Certificate Services" but prefer the previous one. Have tested this and it works but individual computer and user cert's seem like overkill.


Problem:

Everything is working as expected using the first solution (sooo pretty...ooohhhh!) but I cannot lock out individual machines. Using the IAS access policies I setup a policy (listed 1st) to deny all computers in a particular security group. In the System Event Viewer I see the access denail entry when the laptop is sitting on the login prompt (the entry in the log is Event ID: 2, Access Denied....cool that is what I want). I then enter a username and password that has permission to login (i.e. Jill from above) and miraculously it logs in (Event ID: 1, Access Granted to user...blah, blah, blah).

I understand why this happens;"Microsoft Windows® XP authenticates both the user and the
computer independently. When computer first starts up, it uses its domain account and password to authenticate to the WLAN.....
"When a user logs on to the computer, the same authentication and authorization process is repeated, but this time with the user's name and password. The user’s session replaces the computer WLAN session; this means that the two are not active simultaneously. It also means that an unauthorized user cannot use an authorized computer to access the WLAN."


Question (finally):

Not the last line (....unauthorized user cannot use an authorized computer...), does anyone know how to stop an authorized user from using an unauthorized computer?


Stop bitching about Microsoft, they keep us employed!!

 

[ADB100]

I don't think you can do what you want with IAS. You can enforce Machine-Only authentication via Group Policy (or the regstry), you would then need to make an IAS policy that ONLY authenticated Machines (put all the machines in a group and make IAS check for group membership).

The problem I see with this though is the logic you require for user Bill. The User Authentication in this scenario is not Wireless Authentication (802.1x), it is just Windows Domain authentication. So if you want Bill to be able to login on a Wired machine then you are stuck.

Cisco Secure ACS 4.x has some additional logic that tracks the state of Machine & User authentication so will only allow a user to Authenticate if the Machine has (it does this via tracking the Clients Calling-Station-Identifier - the MAC address). I think you could achive what you require with that.

I can't quite understand why you want this though? Machine-Only authentication pretty much locks down what machines can access the Wireless Network so users can't bring in their own laptops etc. I don't understand why a valid User (Bill) should be allowed to login via a wired machine but not a Wireless one since both machines are under your control anyway? (unless you leave Wired ports open?)

I may have misunderstood your requirements, but I hope this helps anyway?

Andy

 

[Davix]

I thought as much, guess we are going to have use CA's

Stop bitching about Microsoft, they keep us employed!!