{"id":189,"date":"2015-06-29T11:19:44","date_gmt":"2015-06-29T11:19:44","guid":{"rendered":"http:\/\/www.balajibandi.com\/blog\/?p=189"},"modified":"2017-09-12T07:48:32","modified_gmt":"2017-09-12T06:48:32","slug":"peap-and-eap-tls-on-server-2008-and-cisco-wlc","status":"publish","type":"post","link":"https:\/\/www.balajibandi.com\/?p=189","title":{"rendered":"PEAP and EAP-TLS on Server 2008 and Cisco WLC"},"content":{"rendered":"<h2>Content Table<\/h2>\n<p>Introduction<br \/>\nBasic Network Configuration<br \/>\nInstalling Active Directory<br \/>\nInstalling Certificate Server<br \/>\nInstalling Network Policy Server<br \/>\nCreate RADIUS Computer Certificate<br \/>\nConfigure Network Policy for EAP Authentication<br \/>\nAdd Wireless User to Active Directory<br \/>\nConfigure Cisco WLC to use RADIUS Authentication<br \/>\nConfigure Wireless Client (Windows 7)<br \/>\nTroubleshooting<br \/>\nConclusion<\/p>\n<h2>Introduction<\/h2>\n<p>To make wireless networks <em>really secure<\/em> you should use a RADIUS server to authenticate your users instead of using a pre-shared key. The RADIUS server will handle the authentication requests and uses EAP (Extensible Authentication Protocol) to communicate with users. There are many EAP types and the most popular ones are:<\/p>\n<ul>\n<li>PEAP (Protected EAP)<\/li>\n<li>EAP-TLS<\/li>\n<\/ul>\n<p>PEAP is normally used to authenticate users by using a <strong>username and password<\/strong>. The RADIUS server will show a certificate to the users so that they can verify that they are talking to the correct RADIUS server. EAP-TLS is the <strong>most secure form<\/strong> of wireless authentication because it replaces the client username\/password with a <strong>client certificate<\/strong>.<\/p>\n<p>This tutorial will walk you through the installation and configuration of Windows Server 2008 using NPS (Network Policy Server) as the RADIUS server for a Cisco wireless LAN controller. We will configure the server so that it supports PEAP using MS-CHAPv2 for password authentication but we\u2019ll also look at EAP-TLS which can be used to authenticate clients using certificates that we will generate on the server. In this tutorial we will configure the following components on the server:<\/p>\n<ul>\n<li>Active Directory<\/li>\n<li>DNS<\/li>\n<li>Certificate Services<\/li>\n<li>IIS<\/li>\n<li>NPS<\/li>\n<\/ul>\n<p>Active Directory (AD) is where we store all the user accounts, it\u2019s the central database that we use for authentication. Whenever you install an AD you also require a DNS server. Certificate services will be used to install the server as a root CA so that we can generate a computer certificate that will be presented to wireless clients and to generate the client certificates for EAP-TLS.<\/p>\n<p>IIS is the web server and we will use it so that EAP-TLS clients can easily request a certificate with their web browser for their wireless connection. Last but not least, NPS is the RADIUS server and that\u2019s where we will configure some wireless policies.<\/p>\n<p>I realized that many network engineers are comfortable configuring switches and wireless equipment but might be new to Windows Server 2008. This \u201chow to\u201d was written so anyone without \u201cWindows Server\u201d experience should be able to get the job done.<\/p>\n<p>This is the topology that I will use for this example:<\/p>\n<p><a class=\"cboxElement\" title=\"Server 2008 EAP Demo Topology\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/server-2008-eap-demo-topology.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3038\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/server-2008-eap-demo-topology.png\" alt=\"Server 2008 EAP Demo Topology\" width=\"795\" height=\"404\" \/><\/a><\/p>\n<p>A fairly simple topology with a single switch that connects the server, WLC and access point together. I\u2019m using a Cisco wireless LAN controller to demonstrate this but the configuration will be the same for any other wireless LAN controller or access point. The configuration for Windows Server 2008 will be the same. There\u2019s plenty of work so let\u2019s get started!<\/p>\n<h2>&gt;Basic Network Configuration<\/h2>\n<p>Before we start with the installation of Active Directory we\u2019ll fix some basics like setting the correct computer name and IP address.<\/p>\n<h3>Computer Name<\/h3>\n<p>Click <strong>Start<\/strong> &gt; <strong>Computer<\/strong> (right mouse click) &gt; <strong>Properties<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows server 2008 computer properties\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-computer-properties.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2884\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-computer-properties.png\" alt=\"windows server 2008 computer properties\" width=\"482\" height=\"461\" \/><\/a><\/p>\n<p>Click on <strong>Change Settings<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"Windows Server 2008 System\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-system.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2885\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-system.png\" alt=\"Windows Server 2008 System\" width=\"799\" height=\"600\" \/><\/a><\/p>\n<p>Click the <strong>Change<\/strong> button.<\/p>\n<p><a class=\"cboxElement\" title=\"Windows Server 2008 System Properties\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-system-properties.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2886\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-system-properties.png\" alt=\"Windows Server 2008 System Properties\" width=\"410\" height=\"461\" \/><\/a><\/p>\n<p>Here\u2019s where you will enter the computer name. I\u2019ll use \u201cAD\u201d (Active Directory). You don\u2019t have to change the workgroup name as we\u2019ll turn this computer into a domain controller in a minute. Make your changes and click on <strong>OK<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"Windows Server 2008 Computer Name\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-computer-name.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2887\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-computer-name.png\" alt=\"Windows Server 2008 Computer Name\" width=\"327\" height=\"384\" \/><\/a><\/p>\n<p>Once you change the computer name you will have to <strong>reboot<\/strong> before the changes will occur. Once your server is rebooted you\u2019ll have to change the IP address.<\/p>\n<h3>IP address<\/h3>\n<p>Make sure <strong>you don\u2019t configure any DNS servers<\/strong> as this server will become a DNS server. You don\u2019t have to configure a default gateway but if you have a router that leads to the outside world you can enter it here:<\/p>\n<p><a class=\"cboxElement\" title=\"Windows Server 2008 Change IP Address\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-change-ip-address.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2882\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-change-ip-address.png\" alt=\"Windows Server 2008 Change IP Address\" width=\"404\" height=\"448\" \/><\/a><\/p>\n<p>Once you have configured your computer name and IP address we can continue with the installation of Active Directory.<\/p>\n<h2>Installing Active Directory<\/h2>\n<p>Active Directory is where we store all the usernames in a central database. To install it we need to add a new role to the server.<\/p>\n<p>Click on <strong>Start<\/strong> &gt; <strong>Administrative Tools<\/strong> &gt; <strong>Server Manager<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"Windows Server 2008 Start Menu Server Manager\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-start-menu-server-manager.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2883\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-start-menu-server-manager.png\" alt=\"Windows Server 2008 Start Menu Server Manager\" width=\"405\" height=\"464\" \/><\/a><\/p>\n<p>Click on <strong>Roles<\/strong> &gt; <strong>Add Roles<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"Windows Server 2008 Server Manager Roles\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-server-manager-roles.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2889\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-server-manager-roles.png\" alt=\"Windows Server 2008 Server Manager Roles\" width=\"800\" height=\"556\" \/><\/a><\/p>\n<p>You will be presented with the following wizard. Click on <strong>Next<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"Windows Server 2008 Add Roles Wizard\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-add-roles-wizard.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2890\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-add-roles-wizard.png\" alt=\"Windows Server 2008 Add Roles Wizard\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>Select <strong>Active Directory Domain Services<\/strong> and click on <strong>Next<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"Windows Server 2008 Add Roles Wizard\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-add-roles-wizard-overview.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2891\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-add-roles-wizard-overview.png\" alt=\"Windows Server 2008 Add Roles Wizard\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>You will get a notification about adding the .NET Framework feature. Click on <strong>Add Requires Features<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"Windows Server 2008 AD Features Requested\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-features-requested.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2892\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-features-requested.png\" alt=\"Windows Server 2008 AD Features Requested\" width=\"625\" height=\"300\" \/><\/a><\/p>\n<p>Click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"Windows Server 2008 Add Roles Wizard AD Selected\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-add-roles-wizard-ad-selected.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2893\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-add-roles-wizard-ad-selected.png\" alt=\"Windows Server 2008 Add Roles Wizard AD Selected\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>You will see an introduction about Active Directory Domain Services. Click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-active-directory-install\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-active-directory-install.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2894\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-active-directory-install.png\" alt=\"windows-server-2008-active-directory-install\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>Click <strong>Next<\/strong> to confirm the installation options.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-active-directory-install-confirm\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-active-directory-install-confirm.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2895\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-active-directory-install-confirm.png\" alt=\"windows-server-2008-active-directory-install-confirm\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>You will see the following screen that indicates the installation progress:<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-active-directory-installation-progress\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-active-directory-installation-progress.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2896\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-active-directory-installation-progress.png\" alt=\"windows-server-2008-active-directory-installation-progress\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>Once the installation is done you might receive a warning about Windows automatic updating. If this is a production server, make a mental note to enable windows updates in the future. Click on <strong>Close<\/strong>to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-active-directory-installation-results\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-active-directory-installation-results.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2897\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-active-directory-installation-results.png\" alt=\"windows-server-2008-active-directory-installation-results\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>Once Active Directory Domain Services is installed we can create a new domain. Click on the <strong>start<\/strong>button and type \u201c<strong>dcpromo<\/strong>\u201d (without the quotes):<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-dcpromo\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-dcpromo.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2898\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-dcpromo.png\" alt=\"windows-server-2008-dcpromo\" width=\"405\" height=\"80\" \/><\/a><\/p>\n<p>You will see a welcome screen, leave \u201cuse advanced mode installation\u201d unchecked and click on <strong>Next<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ad-domain-services-installation-wizard\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-installation-wizard.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2899\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-installation-wizard.png\" alt=\"windows-server-2008-ad-domain-services-installation-wizard\" width=\"503\" height=\"476\" \/><\/a><\/p>\n<p>You will be presented with some information about operating system compatibility. Click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ad-domain-services-compatibility\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-compatibility.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2900\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-compatibility.png\" alt=\"windows-server-2008-ad-domain-services-compatibility\" width=\"503\" height=\"476\" \/><\/a><\/p>\n<p>We will create a new forest with a new domain. Select the second option and click on <strong>Next<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ad-domain-services-new-domain\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-new-domain.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2901\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-new-domain.png\" alt=\"windows-server-2008-ad-domain-services-new-domain\" width=\"503\" height=\"476\" \/><\/a><\/p>\n<p>The FQDN (Fully Qualified Domain Name) of my forest root domain will be \u201cNETWORKLESSONS.LOCAL\u201d. Click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ad-domain-services-FQDN\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-FQDN.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2902\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-FQDN.png\" alt=\"windows-server-2008-ad-domain-services-FQDN\" width=\"503\" height=\"476\" \/><\/a><\/p>\n<p>We will have to select the Forest Functional Level. If you only use Server 2008 R2 or later versions then you can select the \u201cWindows Server 2008 R2\u2033 functional level. If you plan to use older versions of Windows Server then you should use a \u201clower\u201d functional level. I don\u2019t plan to add any other servers to this network so I\u2019ll select \u201cWindows Server 2008 R2\u2033 and click on <strong>Next<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-forest-functional-level-2008R2\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-forest-functional-level-2008R2.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2905\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-forest-functional-level-2008R2.png\" alt=\"windows-server-2008-forest-functional-level-2008R2\" width=\"503\" height=\"476\" \/><\/a><\/p>\n<p>Select \u201cDNS server\u201d and click on <strong>Next<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ad-domain-services-dns\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-dns.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2906\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-dns.png\" alt=\"windows-server-2008-ad-domain-services-dns\" width=\"503\" height=\"476\" \/><\/a><\/p>\n<p>You will receive a notification that the server is unable to create a DNS entry. This is OK because the DNS server isn\u2019t installed yet. Click on <strong>Yes<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ad-domain-services-dns-delegation\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-dns-delegation.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2907\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-dns-delegation.png\" alt=\"windows-server-2008-ad-domain-services-dns-delegation\" width=\"416\" height=\"230\" \/><\/a><\/p>\n<p>The default folder structure is fine, click on <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ad-domain-services-folders\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-folders.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2908\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-folders.png\" alt=\"windows-server-2008-ad-domain-services-folders\" width=\"503\" height=\"476\" \/><\/a><\/p>\n<p>A separate password is used in case you need to restore your Active Directory. I recommend to use a different password than the administrator password for this. Click on <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ad-domain-services-restore-password\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-restore-password.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2909\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-restore-password.png\" alt=\"windows-server-2008-ad-domain-services-restore-password\" width=\"503\" height=\"476\" \/><\/a><\/p>\n<p>You will receive a summary, click on <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ad-domain-services-summary\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-summary.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2910\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-summary.png\" alt=\"windows-server-2008-ad-domain-services-summary\" width=\"503\" height=\"476\" \/><\/a><\/p>\n<p>It will take a couple of minutes to install everything, you will see this progress screen:<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ad-domain-services-progress\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-progress.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2911\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-progress.png\" alt=\"windows-server-2008-ad-domain-services-progress\" width=\"437\" height=\"306\" \/><\/a><\/p>\n<p>Click on <strong>Finish<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ad-domain-services-completion\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-completion.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2912\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-completion.png\" alt=\"windows-server-2008-ad-domain-services-completion\" width=\"503\" height=\"476\" \/><\/a><\/p>\n<p>The server will ask you to restart, Click on <strong>Restart Now<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ad-domain-services-restart\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-restart.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2913\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-domain-services-restart.png\" alt=\"windows-server-2008-ad-domain-services-restart\" width=\"360\" height=\"140\" \/><\/a><\/p>\n<p>Once your server is restarted you will have a working Active Directory and DNS server. The next step will be to install the certificate server.<\/p>\n<h2>\u00a0Installing Certificate Server<\/h2>\n<p>When PEAP wireless clients try to connect to the network, the RADIUS server will present a computer certificate to the user to authenticate itself. It\u2019s up to the client to accept only valid certificates and this will help to prevent spoofing attacks where an attacker might run a fake RADIUS server. EAP-TLS will also use require the computer certificate from the RADIUS server but we\u2019ll also require a client certificate for each user that wants to connect to the wireless network.<\/p>\n<p>In order to do this we will configure our server to become a <strong>root CA<\/strong> (Certificate Authority). This allows us to generate a computer certificate and also to generate client certificates.<\/p>\n<p>Click on <strong>Start<\/strong> &gt; <strong>Administrative Tools<\/strong> &gt; <strong>Server Manager<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"Windows Server 2008 Start Menu Server Manager\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-start-menu-server-manager.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2883\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-start-menu-server-manager.png\" alt=\"Windows Server 2008 Start Menu Server Manager\" width=\"405\" height=\"464\" \/><\/a><\/p>\n<p>Click on <strong>Roles<\/strong> &gt; <strong>Add Roles.<\/strong><\/p>\n<p><a class=\"cboxElement\" title=\"Windows Server 2008 Server Manager Roles\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-server-manager-roles.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2889\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-server-manager-roles.png\" alt=\"Windows Server 2008 Server Manager Roles\" width=\"800\" height=\"556\" \/><\/a><\/p>\n<p>Click on <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"Windows Server 2008 Add Roles Wizard\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-add-roles-wizard.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2890\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-add-roles-wizard.png\" alt=\"Windows Server 2008 Add Roles Wizard\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>Select <strong>Active Directory Certificate Services<\/strong> and click on <strong>Next<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-add-roles-ad-certificate-services\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-add-roles-ad-certificate-services.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2916\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-add-roles-ad-certificate-services.png\" alt=\"windows-server-2008-add-roles-ad-certificate-services\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>You will see an introduction to Active Directory Certificate Services. Click on <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-introduction-to-certificate-services\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-introduction-to-certificate-services.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2917\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-introduction-to-certificate-services.png\" alt=\"windows-server-2008-introduction-to-certificate-services\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>Select <strong>Certification Authority.\u00a0<\/strong>If you want to use <strong>EAP-TLS<\/strong> then you should also select <strong>Certification Authority Web Enrollment<\/strong>. This will allow us to request client certificates through the web browser which is very convenient.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-add-roles-certification-authority\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-add-roles-certification-authority.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2918\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-add-roles-certification-authority.png\" alt=\"windows-server-2008-add-roles-certification-authority\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>Once you select Certification Authority Web Enrollment you will receive a notification that we need to install IIS (Web Server). Click on <strong>Add Required Role Services<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-add-roles-ad-certificate-services-features\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-add-roles-ad-certificate-services-features.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2919\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-add-roles-ad-certificate-services-features.png\" alt=\"windows-server-2008-add-roles-ad-certificate-services-features\" width=\"625\" height=\"300\" \/><\/a><\/p>\n<p>Make sure both services are selected and click on <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-add-roles-ca-web-enrollment\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-add-roles-ca-web-enrollment.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2920\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-add-roles-ca-web-enrollment.png\" alt=\"windows-server-2008-add-roles-ca-web-enrollment\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>The certificate server can be part of the domain and use active directory or run as stand-alone. We want it to use the active directory so select <strong>Enterprise<\/strong> and click on <strong>Next<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ca-type\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ca-type.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2921\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ca-type.png\" alt=\"windows-server-2008-ca-type\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>You can specify if you want this server to be a new Root CA or if you want it to be a Subordinate CA. Select <strong>Root CA<\/strong> and click on <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-root-ca\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-root-ca.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2922\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-root-ca.png\" alt=\"windows-server-2008-root-ca\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>Select <strong>Create a new private key<\/strong> and click on <strong>Next<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-new-private-key\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-new-private-key.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2924\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-new-private-key.png\" alt=\"windows-server-2008-new-private-key\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>The default cryptography parameters are fine, click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ca-cryptography\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ca-cryptography.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2925\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ca-cryptography.png\" alt=\"windows-server-2008-ca-cryptography\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>The default CA name is also fine, it will use the computer name and domain name for this. Click on<strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ca-name\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ca-name.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2926\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ca-name.png\" alt=\"windows-server-2008-ca-name\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>The default validity period for the root CA certificate is 5 years. Click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ca-validity-period\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ca-validity-period.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2927\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ca-validity-period.png\" alt=\"windows-server-2008-ca-validity-period\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>Click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ca-database-location\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ca-database-location.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2928\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ca-database-location.png\" alt=\"windows-server-2008-ca-database-location\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>If you selected the web enrollment option you will see the installation wizard for IIS. You can read the introduction if you like or click on <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-IIS-installation\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-IIS-installation.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2929\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-IIS-installation.png\" alt=\"windows-server-2008-IIS-installation\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>The default role services are fine, click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-IIS-role-services\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-IIS-role-services.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2930\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-IIS-role-services.png\" alt=\"windows-server-2008-IIS-role-services\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>In the confirmation screen you will be warned that you can\u2019t make any changes to the computer name or domain name once you installed the certificate services. Click <strong>Install<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-CA-IIS-confirmation\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-CA-IIS-confirmation.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2931\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-CA-IIS-confirmation.png\" alt=\"windows-server-2008-CA-IIS-confirmation\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>You will see the following Installation Progress, grab a quick drink\u2026<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-CA-IIS-progress\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-CA-IIS-progress.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2932\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-CA-IIS-progress.png\" alt=\"windows-server-2008-CA-IIS-progress\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>Once the installation is done you will see another notification that you should enable Windows updates. Click on <strong>Close<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-CA-IIS-installation-results\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-CA-IIS-installation-results.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2933\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-CA-IIS-installation-results.png\" alt=\"windows-server-2008-CA-IIS-installation-results\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>Right now you have a working Certificate Authority and IIS is running to serve web requests. If you plan to use EAP-TLS we need to enable HTTPS support for IIS, by default it is disabled. If you only want to use PEAP then you can skip this step. Click on <strong>Start<\/strong> &gt; <strong>Administrative Tools<\/strong> &gt; <strong>Internet Information Services (IIS) Manager<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-iis-start-menu\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-iis-start-menu.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3021\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-iis-start-menu.png\" alt=\"windows-server-2008-iis-start-menu\" width=\"561\" height=\"461\" \/><\/a><\/p>\n<p>Click on <strong>AD<\/strong> (server name) &gt; <strong>Sites<\/strong> &gt; <strong>Default Web Site<\/strong> and select <strong>Bindings<\/strong> on the right side of the screen.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-iis-manager\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-iis-manager.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3022\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-iis-manager.png\" alt=\"windows-server-2008-iis-manager\" width=\"864\" height=\"597\" \/><\/a><\/p>\n<p>Click on <strong>Add<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-iis-site-bindings\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-iis-site-bindings.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3023\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-iis-site-bindings.png\" alt=\"windows-server-2008-iis-site-bindings\" width=\"488\" height=\"227\" \/><\/a><\/p>\n<p>Select <strong>https<\/strong> in the Type dropdown box and make sure the SSL certificate has been selected. Click on<strong>OK<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-iis-site-binding-https\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-iis-site-binding-https.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3024\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-iis-site-binding-https.png\" alt=\"windows-server-2008-iis-site-binding-https\" width=\"406\" height=\"220\" \/><\/a><\/p>\n<p>This concludes the installation of the certificate server and IIS. We can now move onto the configuration of the RADIUS server.<\/p>\n<h2>Installing Network Policy Server<\/h2>\n<p>Network Policy Server (NPS) is the RADIUS server that you can find on Windows Server 2008. It has a lot of features and is pretty easy to configure. First we will have to install it.<\/p>\n<p>Click on <strong>Start<\/strong> &gt; <strong>Administrative Tools<\/strong> &gt; <strong>Server Manager<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"Windows Server 2008 Start Menu Server Manager\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-start-menu-server-manager.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2883\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-start-menu-server-manager.png\" alt=\"Windows Server 2008 Start Menu Server Manager\" width=\"405\" height=\"464\" \/><\/a><\/p>\n<p>Click on <strong>Roles<\/strong> &gt; <strong>Add Roles<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"Windows Server 2008 Server Manager Roles\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-server-manager-roles.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2889\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-server-manager-roles.png\" alt=\"Windows Server 2008 Server Manager Roles\" width=\"800\" height=\"556\" \/><\/a><\/p>\n<p>Click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"Windows Server 2008 Add Roles Wizard\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-add-roles-wizard.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2890\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-add-roles-wizard.png\" alt=\"Windows Server 2008 Add Roles Wizard\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>Select <strong>Network Policy and Access Services<\/strong> and click Next to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-server-roles-network-policy-server\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-server-roles-network-policy-server.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2934\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-server-roles-network-policy-server.png\" alt=\"windows-server-2008-server-roles-network-policy-server\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>Make sure Network Policy Server is selected and click on <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-nps-role-services\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-nps-role-services.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2937\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-nps-role-services.png\" alt=\"windows-server-nps-role-services\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>You will see the confirmation screen, click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-nps-confirmation\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-nps-confirmation.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2939\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-nps-confirmation.png\" alt=\"windows-server-nps-confirmation\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>You\u2019ll see the installation progress\u2026<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-nps-progress\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-nps-progress.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2940\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-nps-progress.png\" alt=\"windows-server-nps-progress\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>And you\u2019ll see the installation results\u2026<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-installation-results\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-installation-results.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2941\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-installation-results.png\" alt=\"windows-server-2008-nps-installation-results\" width=\"780\" height=\"575\" \/><\/a><\/p>\n<p>Click on <strong>Close<\/strong>.<\/p>\n<p>The Network Policy server is now installed. In the next part we\u2019ll install a computer certificate that we can use to authenticate the RADIUS server to the wireless clients.<\/p>\n<h2>Create RADIUS Computer Certificate<\/h2>\n<p>With NPS up and running we are ready to create user and computer certificates. The RADIUS server will have to present a certificate to the wireless users so that they can verify if they are talking to the correct RADIUS server. Let me show you how to check if you have a computer certificate and otherwise how to generate one.<\/p>\n<p>Click on Start and type \u201c<strong>mmc<\/strong>\u201d (without the quotes), press enter.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-mmc\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2943\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc.png\" alt=\"windows-server-2008-mmc\" width=\"405\" height=\"464\" \/><\/a><\/p>\n<p>Click on <strong>File<\/strong> &gt; <strong>Add\/Remove Snap-in<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-mmc-add-remove-snap-in\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-add-remove-snap-in.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2944\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-add-remove-snap-in.png\" alt=\"windows-server-2008-mmc-add-remove-snap-in\" width=\"864\" height=\"596\" \/><\/a><\/p>\n<p>Select <strong>Certificates<\/strong> from <strong>Available snap-ins<\/strong> and click on <strong>Add<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-mmc-snap-ins\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-snap-ins.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2946\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-snap-ins.png\" alt=\"windows-server-2008-mmc-snap-ins\" width=\"678\" height=\"470\" \/><\/a><\/p>\n<p>Select <strong>Computer account<\/strong> and click on <strong>Next<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-mmc-snap-in-computer-account\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-snap-in-computer-account.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2947\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-snap-in-computer-account.png\" alt=\"windows-server-2008-mmc-snap-in-computer-account\" width=\"524\" height=\"381\" \/><\/a><\/p>\n<p>Select <strong>Local computer<\/strong> and click on <strong>Finish<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-select-computer\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-select-computer.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2948\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-select-computer.png\" alt=\"windows-server-select-computer\" width=\"524\" height=\"381\" \/><\/a><\/p>\n<p>At the right side you can see that he computer certificates are now selected. Click on <strong>OK<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-mmc-selected-snap-ins\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-selected-snap-ins.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2949\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-selected-snap-ins.png\" alt=\"windows-server-2008-mmc-selected-snap-ins\" width=\"678\" height=\"470\" \/><\/a><\/p>\n<p>Click on <strong>Personal<\/strong> &gt; <strong>Certificates<\/strong> to see all computer certificates. If everything went OK you should see a certificate that says \u201cIntended Purposes\u201d with Client and Server Authentication.<\/p>\n<div class=\"woo-sc-box note\">If you installed NPS on a separate Windows Server 2008 installation, you won\u2019t see a computer certificate here and you\u2019ll have to generate one as well.<\/div>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-mmc-computer-certificate\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-computer-certificate.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-2950\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-computer-certificate-1024x261.png\" alt=\"windows-server-2008-mmc-computer-certificate\" width=\"1024\" height=\"261\" \/><\/a><\/p>\n<p>If there\u2019s no certificate, we\u2019ll create a new one. Right mouse click on the white space and select<strong>Request New Certificate<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-request-new-certificate\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-request-new-certificate.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-2951\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-request-new-certificate-1024x328.png\" alt=\"windows-server-2008-request-new-certificate\" width=\"1024\" height=\"328\" \/><\/a><\/p>\n<p>You will see the following screen, click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-certificate-enrollment\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-certificate-enrollment.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2952\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-certificate-enrollment.png\" alt=\"windows-server-2008-certificate-enrollment\" width=\"639\" height=\"448\" \/><\/a><\/p>\n<p>Select<strong> Active Directory Enrollment Policy<\/strong> and click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-select-certificate-enrollment-policy\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-select-certificate-enrollment-policy.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2953\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-select-certificate-enrollment-policy.png\" alt=\"windows-server-2008-select-certificate-enrollment-policy\" width=\"640\" height=\"448\" \/><\/a><\/p>\n<p>Click on <strong>Finish<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-certificate-installation-results\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-certificate-installation-results.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2955\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-certificate-installation-results.png\" alt=\"windows-server-2008-certificate-installation-results\" width=\"640\" height=\"448\" \/><\/a><\/p>\n<p>You\u2019ll be back at the MMC and you\u2019ll see the installed certificate. Make sure you see that it can be used for client and server authentication before you continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-mmc-computer-certificate\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-computer-certificate.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-2950\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-computer-certificate-1024x261.png\" alt=\"windows-server-2008-mmc-computer-certificate\" width=\"1024\" height=\"261\" \/><\/a><\/p>\n<p>Your server now has a certificate that can be presented to wireless clients when they request the identify of the RADIUS server. Now we can configure a wireless policy\u2026<\/p>\n<h2>\u00a0Configure Network Policy for EAP Authentication<\/h2>\n<p>Network Policy Server is running but we\u2019ll still have to create a policy for our wireless users.<\/p>\n<p>Click on <strong>Start<\/strong> &gt; <strong>Administrative Tools<\/strong> &gt; <strong>Network Policy Server<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-network-policy-server-start-menu\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-network-policy-server-start-menu.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2957\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-network-policy-server-start-menu.png\" alt=\"windows-server-2008-network-policy-server-start-menu\" width=\"407\" height=\"463\" \/><\/a><\/p>\n<p>Do a right mouse click on <strong>NPS<\/strong> &gt; <strong>Register server in Active Directory<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-register-nps-in-ad\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-register-nps-in-ad.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2958\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-register-nps-in-ad.png\" alt=\"windows-server-2008-register-nps-in-ad\" width=\"795\" height=\"565\" \/><\/a><\/p>\n<p>You\u2019ll be presented the following screen, click <strong>OK<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-dial-in-properties\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-dial-in-properties.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2959\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-dial-in-properties.png\" alt=\"windows-server-2008-nps-dial-in-properties\" width=\"416\" height=\"191\" \/><\/a><\/p>\n<p>And a notification that is has been registered, click <strong>OK<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-authorized\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-authorized.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2960\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-authorized.png\" alt=\"windows-server-2008-nps-authorized\" width=\"416\" height=\"191\" \/><\/a><\/p>\n<h3>Add Cisco WLC as RADIUS Client<\/h3>\n<p>Now we can add a RADIUS client. Don\u2019t confuse the RADIUS client with the wireless clients. We are talking about the wireless LAN controller here. Select <strong>NPS<\/strong> &gt; <strong>RADIUS Clients and Servers<\/strong> &gt; <strong>RADIUS Clients<\/strong> (right mouse click) and click on <strong>New<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-new-radius-client\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-new-radius-client.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2961\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-new-radius-client.png\" alt=\"windows-server-2008-new-radius-client\" width=\"795\" height=\"566\" \/><\/a><\/p>\n<p>Enter a friendly name (can be everything but I suggest to use the hostname of the WLC) and the IP address of the WLC. Enter a password in the <strong>Shared secret<\/strong> field. We\u2019ll need this once we configure the wireless LAN controller.<\/p>\n<p>Click on <strong>OK<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-radius-client\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-radius-client.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2962\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-radius-client.png\" alt=\"windows-server-2008-nps-radius-client\" width=\"458\" height=\"578\" \/><\/a><\/p>\n<p>You\u2019ll be back at the main screen and you will see that the RADIUS client has been added.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-radius-clients\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-radius-clients.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2963\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-radius-clients.png\" alt=\"windows-server-2008-nps-radius-clients\" width=\"796\" height=\"400\" \/><\/a><\/p>\n<h3>Create Wireless Policy<\/h3>\n<p>Now we can create a network policy. Click on <strong>Policies<\/strong> &gt; <strong>Network Policies<\/strong> (right mouse click) and click on <strong>New<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-new-network-policy\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-new-network-policy.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2964\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-new-network-policy.png\" alt=\"windows-server-2008-nps-new-network-policy\" width=\"795\" height=\"399\" \/><\/a><\/p>\n<p>Give the policy a name, I\u2019ll call it \u201cWireless\u201d. Leave the type of network access server as <strong>Unspecified<\/strong>.<\/p>\n<p>Click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-policy-name\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-policy-name.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2965\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-policy-name.png\" alt=\"windows-server-2008-nps-policy-name\" width=\"686\" height=\"587\" \/><\/a><\/p>\n<p>Now we can specify some conditions. I\u2019ve set the following conditions:<\/p>\n<ul>\n<li><strong>Windows Groups<\/strong>: NETWORKLESSONS\\Domain Users. By default all users in our Active Directory our member of the domain users group. If you only want certain users to be able to connect to the wireless network then it\u2019s better to create a new domain group for this.<\/li>\n<li><strong>NAS Port Type<\/strong>: Wireless \u2013 IEEE 802.11. This ensures that the network policy only applies to wireless users.<\/li>\n<li><strong>Authentication Type<\/strong>: EAP<\/li>\n<\/ul>\n<p>Click on <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-policy-wireless-conditions\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-policy-wireless-conditions.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2966\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-policy-wireless-conditions.png\" alt=\"windows-server-2008-nps-policy-wireless-conditions\" width=\"686\" height=\"587\" \/><\/a><\/p>\n<p>Select <strong>Access granted<\/strong> and click on <strong>Next<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-access-permissions\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-access-permissions.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2967\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-access-permissions.png\" alt=\"windows-server-2008-nps-access-permissions\" width=\"686\" height=\"587\" \/><\/a><\/p>\n<p><strong>De-select all options<\/strong> in the following screen. We only want to allow PEAP and\/or EAP-TLS.<\/p>\n<h4>Wireless Policy \u2013 PEAP Authentication<\/h4>\n<p>First we will add PEAP authentication to our wireless policy. Click on <strong>Add<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-authentication-methods\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-authentication-methods.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2968\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-authentication-methods.png\" alt=\"windows-server-2008-nps-authentication-methods\" width=\"686\" height=\"587\" \/><\/a><\/p>\n<p>Here you can select the authentication types that you want. I\u2019ll start with PEAP. Click on <strong>Microsoft: Protected EAP (PEAP)<\/strong> and click on <strong>OK<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-add-eap\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-add-eap.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2969\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-add-eap.png\" alt=\"windows-server-2008-nps-add-eap\" width=\"334\" height=\"224\" \/><\/a><\/p>\n<p>You will see it in the overview. Select <strong>Microsoft: Protected EAP (PEAP)<\/strong> and click on <strong>Edit<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-peap-edit\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-peap-edit.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2970\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-peap-edit.png\" alt=\"windows-server-2008-nps-peap-edit\" width=\"686\" height=\"587\" \/><\/a><\/p>\n<p>Make sure you have selected the correct certificate. This is the computer certificate that will be presented to wireless users when they connect using PEAP. It allows our wireless clients to confirm the identity of the RADIUS server.<\/p>\n<p>Click <strong>OK<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-eap-properties\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-eap-properties.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2971\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-eap-properties.png\" alt=\"windows-server-2008-nps-eap-properties\" width=\"438\" height=\"386\" \/><\/a><\/p>\n<h4>Wireless Policy \u2013 EAP-TLS Authentication<\/h4>\n<p>I\u2019m also going to add support for EAP-TLS. Click <strong>Add<\/strong> and select <strong>Microsoft: Smart Card or other certificate<\/strong>.<\/p>\n<p>Click <strong>OK<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-add-eap-tls\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-add-eap-tls.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2973\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-add-eap-tls.png\" alt=\"windows-server-2008-nps-add-eap-tls\" width=\"334\" height=\"224\" \/><\/a><\/p>\n<p>Select <strong>Microsoft: Smart Card or other certificate<\/strong> and click on <strong>Edit<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-eap-tls-properties\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-eap-tls-properties.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2974\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-eap-tls-properties.png\" alt=\"windows-server-2008-nps-eap-tls-properties\" width=\"686\" height=\"587\" \/><\/a><\/p>\n<p>Make sure the correct computer certificate has been selected and click on <strong>OK<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-eap-tls-certificate\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-eap-tls-certificate.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2975\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-eap-tls-certificate.png\" alt=\"windows-server-2008-nps-eap-tls-certificate\" width=\"401\" height=\"240\" \/><\/a><\/p>\n<p>You will now see both EAP types in the list.<\/p>\n<p>Click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-peap-and-eap-tls\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-peap-and-eap-tls.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2976\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-peap-and-eap-tls.png\" alt=\"windows-server-2008-nps-peap-and-eap-tls\" width=\"686\" height=\"587\" \/><\/a><\/p>\n<p>You will see an option to configure constraints, you can use these if you want to restrict access to the wireless network\u2026for example you can set a day and time restriction. If you want to do this, it\u2019s best to leave it alone for now and first make sure that everything is working.<\/p>\n<p>Click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-constraints\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-constraints.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2977\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-constraints.png\" alt=\"windows-server-2008-nps-constraints\" width=\"686\" height=\"587\" \/><\/a><\/p>\n<p>Click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-network-policy\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-network-policy.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2978\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-network-policy.png\" alt=\"windows-server-2008-nps-network-policy\" width=\"686\" height=\"587\" \/><\/a><\/p>\n<p>And click on <strong>Finish<\/strong> to complete the configuration of our wireless policy.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-nps-completed-policy\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-completed-policy.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2979\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-nps-completed-policy.png\" alt=\"windows-server-2008-nps-completed-policy\" width=\"686\" height=\"587\" \/><\/a><\/p>\n<p>NPS is running and we have successfully created a policy for wireless users.<\/p>\n<h2>Add Wireless User to Active Directory<\/h2>\n<p>The wireless policy that we created in NPS allows all users in the \u201cdomain users\u201d group to access the wireless network but we still have to create a user account.<\/p>\n<p>Click on <strong>Start<\/strong> &gt; <strong>Administrative Tools<\/strong> &gt; <strong>Active Directory Users and Computers<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-start-menu-active-directory\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-start-menu-active-directory.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2980\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-start-menu-active-directory.png\" alt=\"windows-server-2008-start-menu-active-directory\" width=\"407\" height=\"465\" \/><\/a><\/p>\n<p>Select <strong>Active Directory Users and Computers<\/strong> &gt; <strong>NETWORKLESSONS.LOCAL<\/strong> &gt; <strong>Users<\/strong> and do a right mouse click on the white space on the right side. Select <strong>New<\/strong> &gt; <strong>User<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ad-new-user\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-new-user.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2981\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-new-user.png\" alt=\"windows-server-2008-ad-new-user\" width=\"767\" height=\"536\" \/><\/a><\/p>\n<p>You will have to enter some details for the new user account. I\u2019ll call my user \u201cWifi1\u2033. Click on <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ad-new-object-user\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-new-object-user.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2982\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-new-object-user.png\" alt=\"windows-server-2008-ad-new-object-user\" width=\"441\" height=\"371\" \/><\/a><\/p>\n<p>Enter a password and make sure the \u201c<strong>User must change password at next logon<\/strong>\u201d field is unchecked. Click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ad-user-password\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-user-password.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2983\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-user-password.png\" alt=\"windows-server-2008-ad-user-password\" width=\"441\" height=\"371\" \/><\/a><\/p>\n<p>Click on <strong>Finish<\/strong> to create the new user account.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-ad-user-created\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-user-created.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2984\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-ad-user-created.png\" alt=\"windows-server-2008-ad-user-created\" width=\"441\" height=\"371\" \/><\/a><\/p>\n<p>So far so good\u2026Active Directory is up and running with a user account, our server is a root CA and has a computer certificate and we configured NPS for wireless users. Now we\u2019ll have to configure the Cisco Wireless LAN controller to use the RADIUS server for authentication.<\/p>\n<h2>Configure Cisco Wireless LAN Controller to use Radius Authentication<\/h2>\n<p>Configuring a RADIUS server on the Cisco WLC isn\u2019t difficult. First we\u2019ll have to configure the RADIUS server and the next step is to configure a WLAN profile to use WPA(2)-enterprise mode.<\/p>\n<p>Start your web browser and log into the WLC:<\/p>\n<p><a class=\"cboxElement\" title=\"cisco-wlc-login-screen\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/cisco-wlc-login-screen.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2985\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/cisco-wlc-login-screen.png\" alt=\"cisco-wlc-login-screen\" width=\"800\" height=\"600\" \/><\/a><\/p>\n<h3>Add RADIUS server<\/h3>\n<p>Select <strong>Security<\/strong> &gt; <strong>RADIUS<\/strong> &gt; <strong>Authentication<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"cisco-wlc-security-radius\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/cisco-wlc-security-radius.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-2986\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/cisco-wlc-security-radius-1024x775.png\" alt=\"cisco-wlc-security-radius\" width=\"1024\" height=\"775\" \/><\/a><\/p>\n<p>Click on <strong>New<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"cisco-wlc-new-radius-server\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/cisco-wlc-new-radius-server.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2987\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/cisco-wlc-new-radius-server.png\" alt=\"cisco-wlc-new-radius-server\" width=\"838\" height=\"317\" \/><\/a><\/p>\n<p>Here you need to enter the IP address and the shared secret (password) that you created when you configured the RADIUS client in NPS.<\/p>\n<p>Click <strong>Apply<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"cisco-wlc-radius-fields\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/cisco-wlc-radius-fields.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-2988\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/cisco-wlc-radius-fields-1024x775.png\" alt=\"cisco-wlc-radius-fields\" width=\"1024\" height=\"775\" \/><\/a><\/p>\n<h3>Create WLAN for RADIUS Authentication<\/h3>\n<p>Now we can create a new WLAN and configure it to use WPA-enterprise mode so it will use RADIUS for authentication.<\/p>\n<p>Select <strong>WLANs<\/strong> from the main menu, click on <strong>Create New<\/strong> and click on <strong>Go<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"cisco-wlc-create-new-wlan\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/cisco-wlc-create-new-wlan.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-2989\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/cisco-wlc-create-new-wlan-1024x775.png\" alt=\"cisco-wlc-create-new-wlan\" width=\"1024\" height=\"775\" \/><\/a><\/p>\n<p>I will call the new WLAN \u201cEAP\u201d. Click <strong>Apply<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"cisco-wlc-new-wlan-settings\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/cisco-wlc-new-wlan-settings.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-2990\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/cisco-wlc-new-wlan-settings-1024x282.png\" alt=\"cisco-wlc-new-wlan-settings\" width=\"1024\" height=\"282\" \/><\/a><\/p>\n<p>Select the <strong>General<\/strong> Tab and ensure Status is <strong>Enabled<\/strong>. The default security policy is 802.1X authentication and WPA2.<\/p>\n<p><a class=\"cboxElement\" title=\"cisco-wlc-wlan-edit-general\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/cisco-wlc-wlan-edit-general.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-2991\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/cisco-wlc-wlan-edit-general-1024x775.png\" alt=\"cisco-wlc-wlan-edit-general\" width=\"1024\" height=\"775\" \/><\/a><\/p>\n<p>Now select the <strong>Security<\/strong> &gt; <strong>AAA Servers<\/strong> tab and select the RADIUS server that you just configured.<\/p>\n<p><a class=\"cboxElement\" title=\"cisco-wlc-wlan-edit-security-aaa\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/cisco-wlc-wlan-edit-security-aaa.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-2992\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/cisco-wlc-wlan-edit-security-aaa-1024x775.png\" alt=\"cisco-wlc-wlan-edit-security-aaa\" width=\"1024\" height=\"775\" \/><\/a><\/p>\n<p>That\u2019s all you have to configure on the Wireless LAN Controller. It\u2019s a good idea to verify that you can reach the RADIUS server from the WLC before you continue. RADIUS uses UDP port 1812 so make sure you don\u2019t have any access-lists or firewalls blocking your traffic between the server and WLC.<\/p>\n<h2>Configure Wireless Client (Windows 7)<\/h2>\n<p>This is where the real fun starts\u2026it\u2019s time to configure a wireless client to connect to our wireless network. I will be using Windows 7 to demonstrate how to connect using PEAP and EAP-TLS.<\/p>\n<p>If your Windows 7 computer is in <strong>workgroup<\/strong> mode (the default) then you will have to import the root CA from the windows 2008 server yourself otherwise you will get an error that the client doesn\u2019t recognize the root CA. This is normal because we created a new root CA and generated a new certificate. When your computer has joined the domain then you can skip this step because it will automatically receive the root CA from the domain controller.<\/p>\n<p>Let me show you how to import the root CA on your Windows 7 computer, if you joined the domain then you can skip this step\u2026<\/p>\n<h3>Export root CA from Server<\/h3>\n<p>First we will have to export the root CA from the server. Normally you can find it in a shared folder on the server. Connect your client using a network cable and open the shared folder on the server:<\/p>\n<pre><code>\\\\10.82.2.50\\CertEnroll<\/code><\/pre>\n<p>If you don\u2019t have a network cable or you can\u2019t access the shared folder then it\u2019s also possible to export the root CA from the server ourselves. Go to the server and open MMC:<\/p>\n<p>Click on <strong>Start<\/strong> &gt; type \u201c<strong>MMC<\/strong>\u201d (without the quotes) and hit enter.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2943\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc.png\" alt=\"windows-server-2008-mmc\" width=\"405\" height=\"464\" \/>Select <strong>File<\/strong> &gt; <strong>Add\/Remove Snap-In<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-mmc-add-remove-snap-in\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-add-remove-snap-in.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2944\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-add-remove-snap-in.png\" alt=\"windows-server-2008-mmc-add-remove-snap-in\" width=\"864\" height=\"596\" \/><\/a><\/p>\n<p>Select <strong>Certificates<\/strong> from the available snap-ins and click on <strong>Add<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-mmc-snap-ins\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-snap-ins.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2946\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-snap-ins.png\" alt=\"windows-server-2008-mmc-snap-ins\" width=\"678\" height=\"470\" \/><\/a><\/p>\n<p>Select <strong>Computer account<\/strong> and click on <strong>Next<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-mmc-snap-in-computer-account\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-snap-in-computer-account.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2947\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-snap-in-computer-account.png\" alt=\"windows-server-2008-mmc-snap-in-computer-account\" width=\"524\" height=\"381\" \/><\/a><\/p>\n<p>When you see <strong>Certificates (Local Computer)<\/strong> on the right side you can click on <strong>OK<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-mmc-selected-snap-ins\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-selected-snap-ins.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2949\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-mmc-selected-snap-ins.png\" alt=\"windows-server-2008-mmc-selected-snap-ins\" width=\"678\" height=\"470\" \/><\/a><\/p>\n<p>Select <strong>Certificates (Local Computer)<\/strong> &gt; <strong>Trusted Root Certification Authorities<\/strong> &gt; <strong>Certificates<\/strong>. On the right side you will your root CA. Select it, do a right mouse click and select <strong>All Tasks<\/strong> &gt; <strong>Export<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-export-root-ca\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-export-root-ca.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2994\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-export-root-ca.png\" alt=\"windows-server-2008-export-root-ca\" width=\"967\" height=\"614\" \/><\/a><\/p>\n<p>You will see the Certificate Export Wizard. Click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-certificate-export-wizard\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-certificate-export-wizard.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2995\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-certificate-export-wizard.png\" alt=\"windows-server-2008-certificate-export-wizard\" width=\"503\" height=\"453\" \/><\/a><\/p>\n<p>Don\u2019t export the private key. Click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-certificate-export-private-key\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-certificate-export-private-key.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2996\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-certificate-export-private-key.png\" alt=\"windows-server-2008-certificate-export-private-key\" width=\"503\" height=\"453\" \/><\/a><\/p>\n<p>Select the <strong>DER encoded binary X.509 (CER)<\/strong> file format and click <strong>Next<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-certificate-file-formats\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-certificate-file-formats.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2997\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-certificate-file-formats.png\" alt=\"windows-server-2008-certificate-file-formats\" width=\"503\" height=\"453\" \/><\/a><\/p>\n<p>Choose a folder and filename and select <strong>Next<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-certificate-save-as\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-certificate-save-as.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2998\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-certificate-save-as.png\" alt=\"windows-server-2008-certificate-save-as\" width=\"503\" height=\"453\" \/><\/a><\/p>\n<p>And click on <strong>Finish<\/strong> to complete the export.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-server-2008-certificate-export-completed\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-certificate-export-completed.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2999\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-server-2008-certificate-export-completed.png\" alt=\"windows-server-2008-certificate-export-completed\" width=\"503\" height=\"453\" \/><\/a><\/p>\n<p>Copy the certificate that you just exported to a USB stick or something and move it to your Windows 7 computer.<\/p>\n<h3>Import Root CA to Windows 7<\/h3>\n<p>Double click on the certificate file that you just exported on your Windows 7 computer and you will see the following screen. Click on <strong>Install Certificate<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-certificate-install\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-certificate-install.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3001\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-certificate-install.png\" alt=\"windows-7-certificate-install\" width=\"409\" height=\"508\" \/><\/a><\/p>\n<p>Click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-certificate-import-wizard\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-certificate-import-wizard.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3002\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-certificate-import-wizard.png\" alt=\"windows-7-certificate-import-wizard\" width=\"503\" height=\"453\" \/><\/a><\/p>\n<p>Make sure the <strong>Trusted Root Certification Authorities<\/strong> store has been selected. If not click on the<strong>Browse<\/strong> button and select it. Click <strong>Next<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-certificate-store\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-certificate-store.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3003\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-certificate-store.png\" alt=\"windows-7-certificate-store\" width=\"503\" height=\"453\" \/><\/a><\/p>\n<p>Click <strong>Finish<\/strong> to complete the certificate import wizard.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-certificate-import-completed\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-certificate-import-completed.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3004\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-certificate-import-completed.png\" alt=\"windows-7-certificate-import-completed\" width=\"503\" height=\"453\" \/><\/a><\/p>\n<p>You might get a security warning that you are about to trust a new root certificate. Click <strong>Yes<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-certificate-security-warning\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-certificate-security-warning.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3005\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-certificate-security-warning.png\" alt=\"windows-7-certificate-security-warning\" width=\"416\" height=\"373\" \/><\/a><\/p>\n<p>We are almost done, we also have to add this certificate in the Windows registry or your computer will still not trust the root CA. If you want to know the exact reason you can look at <a title=\"Microsoft KB 2518158\" href=\"http:\/\/support.microsoft.com\/kb\/2518158\" target=\"_blank\" rel=\"noopener\">KB 2518158 on the Microsoft Website<\/a>.<\/p>\n<p>Click on <strong>Start<\/strong> &gt; type \u201c<strong>cmd<\/strong>\u201d (without the quotes) and hit <strong>CTRL+SHIFT+ENTER<\/strong>. This will open a command prompt with administrative rights.<\/p>\n<p><code>C:\\Users\\vmware\\Desktop&gt;<strong>certutil -f -enterprise -addstore NTAuth AD.crt<\/strong><br \/>\nNTAuth<br \/>\nSignature matches Public Key<br \/>\nCertificate \"CN=NETWORKLESSONS-AD-CA, DC=NETWORKLESSONS, DC=LOCAL\" added to store.<br \/>\nCertUtil: -addstore command completed successfully.<\/code><\/p>\n<p>Your computer now trusts the root CA. We can now connect to the wireless network.<\/p>\n<h3>Configure Wireless Profile for PEAP<\/h3>\n<p>We\u2019ll create a new profile to connect using PEAP.<\/p>\n<p>Open <strong>Control Panel<\/strong> and select <strong>Manage wireless networks<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-control-panel-manage-wireless\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-control-panel-manage-wireless.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3006\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-control-panel-manage-wireless.png\" alt=\"windows-7-control-panel-manage-wireless\" width=\"792\" height=\"326\" \/><\/a><\/p>\n<p>Click on <strong>Add<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-manage-wireless-networks\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-manage-wireless-networks.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3007\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-manage-wireless-networks.png\" alt=\"windows-7-manage-wireless-networks\" width=\"792\" height=\"634\" \/><\/a><\/p>\n<p>Select \u201c<strong>Manually create a network profile<\/strong>\u201c.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-manually-create-network-profile\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-manually-create-network-profile.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3008\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-manually-create-network-profile.png\" alt=\"windows-7-manually-create-network-profile\" width=\"625\" height=\"441\" \/><\/a><\/p>\n<p>Enter the network name, select WPA-Enterprise or WPA2-Enterprise and click on <strong>Next<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-wireless-security-profile\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-wireless-security-profile.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3009\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-wireless-security-profile.png\" alt=\"windows-7-wireless-security-profile\" width=\"625\" height=\"441\" \/><\/a><\/p>\n<p>Select <strong>Change connection settings<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-wireless-profile-created\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-wireless-profile-created.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3010\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-wireless-profile-created.png\" alt=\"windows-7-wireless-profile-created\" width=\"625\" height=\"441\" \/><\/a><\/p>\n<p>Select the <strong>Security<\/strong> tab , choose <strong>Microsoft: Protected EAP (PEAP)<\/strong> and click on <strong>Settings<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-peap-settings\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-peap-settings.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3011\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-peap-settings.png\" alt=\"windows-7-peap-settings\" width=\"379\" height=\"492\" \/><\/a><\/p>\n<p>Select <strong>Validate server certificate<\/strong>. You should see the root CA that we imported here but you don\u2019t have to select it. Your computer will trust all root CAs in this list by default when you connect to a wireless network.<\/p>\n<p>Make sure the authentication method is <strong>Secured password (EAP-MSCHAP v2)<\/strong> and press the <strong>configure<\/strong>button.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-peap-properties\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-peap-properties.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3012\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-peap-properties.png\" alt=\"windows-7-peap-properties\" width=\"383\" height=\"550\" \/><\/a><\/p>\n<p>Uncheck the button that wants to automatically use the windows username\/password for authentication. Click <strong>OK<\/strong> to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-eap-mschapv2-properties\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-eap-mschapv2-properties.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3013\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-eap-mschapv2-properties.png\" alt=\"windows-7-eap-mschapv2-properties\" width=\"291\" height=\"165\" \/><\/a><\/p>\n<p>Click <strong>OK<\/strong> until you return at the EAP Wireless Network Properties and select <strong>Advanced Settings<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-eap-advanced-settings\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-eap-advanced-settings.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3014\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-eap-advanced-settings.png\" alt=\"windows-7-eap-advanced-settings\" width=\"379\" height=\"492\" \/><\/a><\/p>\n<p>Select <strong>specify authentication mode<\/strong> and choose for <strong>user authentication<\/strong>. Click OK to continue.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-eap-user-authentication\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-eap-user-authentication.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3015\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-eap-user-authentication.png\" alt=\"windows-7-eap-user-authentication\" width=\"379\" height=\"492\" \/><\/a><\/p>\n<p>Keep clicking on <strong>OK<\/strong> until you are out of the wireless profile configuration, you are now ready to connect to the wireless network using PEAP. Look for the wireless icon in the taskbar, select the wireless network and click on <strong>Connect<\/strong>.<\/p>\n<pre><code><a href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-available-wireless-networks.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3016\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-available-wireless-networks.png\" alt=\"windows-7-available-wireless-networks\" width=\"265\" height=\"535\" \/><\/a><\/code><\/pre>\n<p>&nbsp;<\/p>\n<p>You will see a pop-up that asks for your credentials. Enter the <strong>username<\/strong> and <strong>password<\/strong> that you configured in Active Directory and click on <strong>OK<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-wifi-username\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-wifi-username.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3017\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-wifi-username.png\" alt=\"windows-7-wifi-username\" width=\"427\" height=\"224\" \/><\/a><\/p>\n<p>And you will see that you are now connected:<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-wireless-connected\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-wireless-connected.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3018\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-wireless-connected.png\" alt=\"windows-7-wireless-connected\" width=\"265\" height=\"381\" \/><\/a><\/p>\n<p>Congratulations! You just authenticated a user through PEAP. In the next part I\u2019ll show you how to authenticate the user by using EAP-TLS and a client certificate.<\/p>\n<h3>Configure Wireless Profile for EAP-TLS<\/h3>\n<p>To authenticate a wireless user through EAP-TLS instead of PEAP we will have to generate a client certificate. Connect your Windows 7 computer to the network so that you can access the server, open a web browser and enter the following address:<\/p>\n<p>https:\/\/\/certsrv<\/p>\n<p>You will see a pop-up that asks for credentials. Enter the <strong>username<\/strong> and <strong>password<\/strong> of the <strong>wireless user that requires a client certificate<\/strong> and click on OK.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-certsrv\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-certsrv.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3026\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-certsrv.png\" alt=\"windows-7-certsrv\" width=\"799\" height=\"600\" \/><\/a><\/p>\n<p>Select <strong>Request a Certificate<\/strong>.<\/p>\n<div class=\"woo-sc-box note\">If you are using Internet Explorer 10 you might receive a warning that says \u201cThis Web browser does not support the generation of certificate requests.\u201d . You need to enable IE10 compatibility mode to solve this problem.<\/div>\n<p><a class=\"cboxElement\" title=\"windows-7-certsrv-request-certificate\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-certsrv-request-certificate.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3027\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-certsrv-request-certificate.png\" alt=\"windows-7-certsrv-request-certificate\" width=\"800\" height=\"600\" \/><\/a><\/p>\n<p>Select <strong>User Certificate<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-user-certificate-request\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-user-certificate-request.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3028\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-user-certificate-request.png\" alt=\"windows-7-user-certificate-request\" width=\"446\" height=\"299\" \/><\/a><\/p>\n<p>Select <strong>Yes<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"certsrv-web-access-confirmation\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/certsrv-web-access-confirmation.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3029\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/certsrv-web-access-confirmation.png\" alt=\"certsrv-web-access-confirmation\" width=\"375\" height=\"217\" \/><\/a><\/p>\n<p>And click on <strong>Install this certificate<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"certsrv-install-certificate\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/certsrv-install-certificate.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3030\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/certsrv-install-certificate.png\" alt=\"certsrv-install-certificate\" width=\"666\" height=\"441\" \/><\/a><\/p>\n<p>You will see a notification that the certificate has been installed.<\/p>\n<p><a class=\"cboxElement\" title=\"certsrv-certificate-installed\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/certsrv-certificate-installed.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3031\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/certsrv-certificate-installed.png\" alt=\"certsrv-certificate-installed\" width=\"666\" height=\"441\" \/><\/a><\/p>\n<p>Now we can change the wireless profile that we created earlier for PEAP to use EAP-TLS instead. Do a right mouse click on the <strong>EAP wireless profile<\/strong> and select <strong>Properties<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-manage-wireless-profile-peap\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-manage-wireless-profile-peap.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3032\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-manage-wireless-profile-peap.png\" alt=\"windows-7-manage-wireless-profile-peap\" width=\"791\" height=\"634\" \/><\/a><\/p>\n<p>Select <strong>Microsoft: Smart Card or other certificate <\/strong>and click on <strong>OK<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-wireless-smart-card-certificate\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-wireless-smart-card-certificate.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3033\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-wireless-smart-card-certificate.png\" alt=\"windows-7-wireless-smart-card-certificate\" width=\"379\" height=\"492\" \/><\/a><\/p>\n<p>Now try to connect again to the wireless network, select the correct profile and click on <strong>Connect<\/strong>.<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-available-wireless-networks\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-available-wireless-networks.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3016\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-available-wireless-networks.png\" alt=\"windows-7-available-wireless-networks\" width=\"265\" height=\"535\" \/><\/a><\/p>\n<p>And you will be connected to the wireless network!<\/p>\n<p><a class=\"cboxElement\" title=\"windows-7-wireless-connected\" href=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-wireless-connected.png\" rel=\"lightbox[2881]\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3018\" src=\"https:\/\/networklessons.com\/wp-content\/uploads\/2013\/06\/windows-7-wireless-connected.png\" alt=\"windows-7-wireless-connected\" width=\"265\" height=\"381\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>Congratulations\u2026you just connected using EAP-TLS!<\/p>\n<h2>Troubleshooting<\/h2>\n<p>If everything went OK then you now have a working wireless network that offers PEAP and EAP-TLS authentication. There are many components in this tutorial so troubleshooting might be difficult sometimes. Your best friend is the Windows event viewer on the server as it will give you all errors. It\u2019s best to look for the security event log and to check for the network policy server notifications. These will give you a lot of information when you are unable to authenticate your wireless users. If you run into any issues, let me know and I\u2019ll add the troubleshooting steps here.<\/p>\n<h2>Conclusion<\/h2>\n<p>I hope this tutorial has been helpful to you to install a Windows Server 2008 machine to act as the RADIUS server for your (Cisco) wireless network that offers EAP-TLS and\/or PEAP authentication.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Content Table Introduction Basic Network Configuration Installing Active Directory Installing Certificate Server Installing Network Policy Server Create RADIUS Computer Certificate Configure Network Policy for EAP Authentication Add Wireless User to Active Directory Configure Cisco WLC to use RADIUS Authentication Configure Wireless Client (Windows 7) Troubleshooting Conclusion Introduction To make wireless networks really secure you should [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,21],"tags":[],"class_list":["post-189","post","type-post","status-publish","format-standard","hentry","category-cisco","category-microsoft"],"_links":{"self":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/189","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=189"}],"version-history":[{"count":3,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/189\/revisions"}],"predecessor-version":[{"id":523,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/189\/revisions\/523"}],"wp:attachment":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}