Windows Server

Newbie · Guest

Hi,

I'm not sure if this is the right group to ask but I have SBS 2003 Premium
and I'd like to try to tighten the security for the wireless LAN. I have
one Cisco AP1200 as well as a Linksys WAP. They both support RADIUS
authentication.

Even though I'm using the term "RADIUS", but I really don't know what it is
and how to set it up! I suppose if I had RADIUS authentication set up, the
communication between the client (i.e. laptop user) and the server will be
encrypted on top of the regular WAP or WPA encryption?

But if this is the case, why do I need to set up the access point to use
RADIUS authentication between the server and the access point? If the
server and the client (i.e. laptop) is set up for RADIUS authentication,
wouldn't that be good enough?

Any help is much appreciated.

Simon

Owen Williams · Guest

Simon:

I have a couple of step-by-step documents for this. Send me an e-mail
and I'll forward to you. (Would refer you to the server they are posted
on, but that's been offline for a few days.)

-- Owen Williams
ClearView Technology Consulting, LLC

In article <eyfE4813FHA.4080@tk2msftngp13.phx.gbl>, newbie@hotmail.com
says...

David L. West · Guest

RADIUS doesn't do any encryption of traffic after it authenticates the
user. It's just another way of doing authentication.

You can use WEP (or WPA, if your hardware supports it) to encrypt the
wireless traffic, or if you were really ambitious you could look into
IPSEC.

--
David L. West
http://www.deskoptional.com

Newbie · Guest

Owen,

I appreciate your offer and sent you an email about the documentation.

David,

It's good to know RADIUS is only for authenticating user logins. From the
Linksys WAP page, if I select RADIUS instead of WEP for "wireless security",
I have to enter a Shared Key. I suppose the Shared Key is what it uses to
authenticate against server? Does it mean at this point, I'm sort of
authenticating the WAP on the network? But it really has nothing to do with
securing the radio in the air?

Being that said, having RADIUS set up can keep un-authorized network nodes
out the LAN?

Thanks guys for the information,

Simon

"Owen Williams" <Owen@NoSpam_CVTCLLC.com> wrote in message
news:MPG.1dd2077fbd28dba9896b8@news.microsoft.com...

Andrew H · Guest

Hi Owen

I'd also like to get hold of these docs, if that's OK. Will you post a URL
when the server comes up again, or is email the best option?

Regards

Andrew
"Owen Williams" <Owen@NoSpam_CVTCLLC.com> wrote in message
news:MPG.1dd2077fbd28dba9896b8@news.microsoft.com...

Owen Williams · Guest

Simon:

The documents I attached to the e-mail you sent me will answer all of
your questions.

-- Owen

In article <uOh3Yg23FHA.2432@TK2MSFTNGP10.phx.gbl>, newbie@hotmail.com
says...

Owen Williams · Guest

Andrew:

Right now, e-mail is the best option. I don't have control of the
server so I don't know when it might be back up. But I do have control
of my own e-mail!

-- Owen

In article <OCpX1O53FHA.2532@TK2MSFTNGP09.phx.gbl>, ajhpms@hotmail.com
says...

David L. West · Guest

That's the way I read it. I've used RADIUS for other things, but not for
wifi. From what I can tell by googling around you can use RADIUS in a wifi
network to force users to authenticate to get onto the network. I can't
find anything that says the traffic after the authentication is encrypted,
but maybe the way it works is that w/o the authentication it won't even
send you packets. There's probably another newsgroup out there where the
people who specialize in this stuff congregate, you might try looking
around a little more.

PS: The Windows "Internet Authentication Service" is their implementation
of RADIUS, in case you hadn't already found that.

--
David L. West
http://www.deskoptional.com

Andrew H · Guest

Hi Owen

Thanks - I've been battling a bit getting IAS to talk to my RADIUS client
and vice versa, which is outside the firewall, and I'm hoping your docs will
help.

If you don't mind emailing those docs, I'll send an email from my "real"
address to your "real" address so you can reply with the attachments.

Regards

Andrew

"Owen Williams" <Owen@NoSpam_CVTCLLC.com> wrote in message
news:MPG.1dd2a1db8e1497419896b9@news.microsoft.com...

Andrew H · Guest

Hi Owen

Thanks for the emailed documents.

My compliments on a professional presentation, in both the Word and
PowerPoint formats. I hope you can make them available to the broader
community.

A few questions regarding your RADIUS setup:

How would you incorporate Windows Mobile and other non-PC devices into the
system? In particular, since the mobiles won't use the new Group Policy,
how would you get the new certificates installed in addition to the ones the
CEICW creates?

I know some people recommend installing wireless APs on the external segment
( i.e. attached to the external NIC in a two-NIC configuration, along with
the Internet router), so that wireless users may use the Internet without
going through the SBS, while requiring them to use a VPN to connect to the
SBS. Can your system incorporate a WAP on the external LAN? If ISA is
installed, what firewall rules are required for the RADIUS server (IAS) and
client (WAP) to exchange data? In ISA 2004, must VPN authentication be
configured to use the RADIUS server?

Regards

Andrew

"Andrew H" <ajhpms@hotmail.com> wrote in message
news:O3m3hmF4FHA.1184@TK2MSFTNGP12.phx.gbl...

Owen Williams · Guest

Andrew:

RE: My compliments on a professional presentation, in both the Word and
PowerPoint formats. I hope you can make them available to the broader
community.

Thanks for your kind words. The documents were posted on the
Washington, DC (USA) SBS Users' Group Sharepoint site in June and quite
a few people (>100) have gotten them from that site. Unfortunately, my
understanding is that the site has been experiencing technical problems
for a while, which is why I e-mailed the docs to you.

RE: How would you incorporate Windows Mobile and other non-PC devices
into the system? In particular, since the mobiles won't use the new
Group Policy, how would you get the new certificates installed in
addition to the ones the CEICW creates?

It is important to understand that this methodology will NOT solve ALL
RADIUS / wireless issues. My purpose was to document a prescriptive,
step-by-step technique targeted at a common scenario: (full) Windows
computers using wireless to connect to an SBS server. The methodology
may also serve as a starting point for other types of connectivity, such
as what you are asking about. I welcome improvements and additions to
what I have written!

With that understanding ...

[1] If the device does not support certificates, this method won't work.
You might want to try EAP-MSCHAPv2 instead of EAP-TLS as the former does
not require certificates. There are negatives to this approach, which
are documented in the Powerpoint deck.

This is one instance where using multiple SSIDs might make sense,
either via a single WAP that supports multiple SSIDs or by using two (or
more) WAPs. You would then set up two different Remote Access Policies,
one as shown requiring a certificate and the other using MSCHAPv2.
Devices which don't support certificates would use the latter SSID to
connect, and the wireless config for that SSID would have to be set up
on the device manually since, as you point out, it does not support
GPOs.

If you take this approach, keep in mind that your security is only as
good as the weakest link. An attacker could try to use the SSID
configured for MSCHAPv2 authentication, which, in my opinion, opens a
hole when compared with staying strictly with certificates.

[2] It is my [very limited] understanding that Windows Mobile 5 will
support certificates, although it may still not support GPOs. In this
case, a certificate could be manually deployed to the device, probably
using the device's version of Internet Explorer and browsing to http://
<sbsserver>/certsrv. The wireless configuration on the device could
also be setup manually. After that, it should work the same as a PC.
However, this is largely speculation on my part: I have not tried it, so
I don't know for sure.

RE: I know some people recommend installing wireless APs on the external
segment ( i.e. attached to the external NIC in a two-NIC configuration,
along with the Internet router), so that wireless users may use the
Internet without going through the SBS, while requiring them to use a
VPN to connect to the SBS. Can your system incorporate a WAP on the
external LAN? If ISA is installed, what firewall rules are required for
the RADIUS server (IAS) and client (WAP) to exchange data? In ISA
2004, must VPN authentication be configured to use the RADIUS server?

The key driver behind the configuration I document is to make it as
similar as possible to a secure wired LAN. It does not support
unauthenticated use of an Internet connection. (I have had some
discussions with several folks about providing Internet access to
wireless visitors / guests and needed to emphasize the problem the
configuration is intended to solve: wired equivalency). In this
context, adding a VPN requirement to connect to SBS is not equivalent:
it adds another "hoop" for the user to jump through. There is also the
issue that the external NIC / segment is not the same (from an SBS and
LAN perspective) as the internal segment. For example, the SBS DHCP
server does not hand out IP addresses to devices connected to the
external NIC. So, the configuration specifies the WAP be connected to
the internal NIC / segment.

One might also ask: If you are using a VPN connection which is
sufficiently secure to allow connection to the SBS from the external
segment, is there any incremental value of the configuration I document?
The VPN is already authenticated and encrypted, so even an open,
unencrypted wireless connection should not be a security risk.

Again, with that understanding ...

I am not an ISA expert and I have not talked to anyone who has actually
tried this on an external segment. I would GUESS that ISA needs to be
configured to pass (at minimum) port 1812, the RADIUS port. ISA
probably does not require a VPN configuration to support RADIUS /
wireless security, but as I said, I am not an expert here and I have not
tried it.

You might consider using two independent WAPS set to two different
SSIDs: one on the internal segment for secure SBS connectivity and one
on the external segment for unsecured Internet access.

I hope this helped. I am very interested in feedback which will expand
the applicability of the methodology I document.

Thanks,

-- Owen

Andrew H · Guest

Hi Owen

Thanks for taking the time to respond to my queries.

I'm still playing around with the wireless configuration, so I'll continue
to experiment with the issues I discussed. The PPC issue is of personal
interest, since I'd like to get the most out of my own device.

In the meantime, however, your article was extremely helpful, so thanks
again.

Regards

Andrew

"Owen Williams" <Owen@NoSpam_CVTCLLC.com> wrote in message
news:MPG.1dd4414e5e66c78e9896bb@news.microsoft.com...

Owen Williams · Guest

Andrew:

You are most welcome.

I am very interested in hearing about your experiences with PPC devices
as I have had some other inquiries about this but I don't personally use
a PPC (yet), so I can't test it. If you have the time, please post your
experiences here and send me a quick e-mail, just so I don't miss the
post.

Thanks!

-- Owen

In article <#6TxHj44FHA.472@TK2MSFTNGP15.phx.gbl>, ajhpms@hotmail.com
says...

Newbie · Guest

I have a Dell Axim 50 and it requires a certificate to authenticate. So far
I have RADIUS working authenticating against domain usernames. Don't know
how to get a certificate set up!

I have a Dell managed gigabit switch, I'm going to play with the RADIUS
authentication. Hopefully I don't lock myself out :)

I also would like to thank Owen for sending me the documentation. I
couldn't have done it without the documentation, much appreciated.

Simon

"Owen Williams" <Owen@NoSpam_CVTCLLC.com> wrote in message
news:MPG.1dd93183657dd3d09896bd@news.microsoft.com...

Andrew H · Guest

I believe on a PPC 2003 or PPC 2003SE device (like the Axim) you can export
the certificate from your workstation, use Activesync to copy the file to
the Axim, and then open it on the Axim to install the certificate. For PPC
2002 devices, there's a utility called AddRootCert on Microsoft Download
that will install the certificates.

"Newbie" <newbie@hotmail.com> wrote in message
news:u7Jq3HB5FHA.3292@tk2msftngp13.phx.gbl...

	Windows Server Forum Index -> Small Business Server 2003	All times are GMT Goto page 1, 2 Next
Page 1 of 2