At 16:26 22/08/05, you wrote:
Hi, i sucessfully installed a Radius authentificated Network with EAP-TLS
Authentifikation. But I cant get logon to my Domain Controller when
themachines boot up.. Ok, I know this Problem is not new, but is there any
chance to solve this problem without additional software like AEGIS?? Or is
there an other Software for Windows XP and or 2000 which is free from
license? And is itpossible to set a default vlan group where the Domain
Controller exists and all Clients firstly get in and later change the
VLANID??? Would this be possible and how would it work?
Greetings Armin
I have managed to do this by three different routes.
1. Use the Microsoft built in wireless client. To do this you need to use
mmc and the certificate plug in to install a CA certificate & personal
certificate for the local machine. Create a wireless profile in XP which
connects to your network using the CA certificate you installed. Then add a
DWORD registry entry AuthType with a value of 2 to
HKLM\SOFTWARE\Microsoft\EAPOL\Parameters\General\Global. This causes XP to
use the machine account to authenticate to the network. This only uses the
machine account to authenticate against the network, at no time does it use
the users account. Other values to use are 0 - Use the default XP
authentication, 1 - Always perform user authentication when a user logs on,
2 - Perform computer authentication only.
2. As above, but don't add the registry entry. This time the machine will
authenticate itself to the network before logon which allows the computer
to see the network and the domain. Once the user logs on to the domain the
connection is lost and the user account is then used to authenticate
against the network. The problem here is that unless the user also has a
valid personal certificate the authentication fails. This means going round
to each user and installing a certificate, unless you can do it via Active
Directory, we are using a Samba PDC here so that is not possible. I decided
against this option with having 1500 potential users.
3. If you are using Intel wireless cards download the full version of the
ProSet drivers, mine were 2200BG. This allows for different profiles which
work as the machine before logon, or during logon to validate the user
against the network. It also adds TTLS as well as TLS. There is a problem
with this software if you are using roaming profiles. During logoff the
network connection is dropped and it is impossible to upload the profile to
the servers. According to Intel this is a know problem and at this time
they have not replied to say if there is going to be a fix for it. This
method worked very well upto the point of saving the profile, it is also
much easier to distribute the settings to other machine using the profile
import feature the ProSet drivers provide.
Steve Atkinson
Deputy Network Manager
Fallibroome High School
Priory Lane
Macclesfield
Cheshire
SK10 4AF
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
