JSI Tip 6908. How do I configure a Windows Server 2003 domain to support Microsoft Windows XP Professional-based client computers that are using Institute of Electrical and Electronics Engineers, Inc. (IEEE) 802.11 access with IEEE 802.1x authentication i

NOTE: The text in the following Microsoft Knowledge Base article is provided so that the site search can find this page. Please click the Knowledge Base link to insure that you are reading the most current information.

Microsoft Knowledge Base article Q816589 contains:

IN THIS TASK

SUMMARY

This step-by-step article describes how to configure a Windows Server 2003 domain to support Microsoft Windows XP Professional-based client computers that are using Institute of Electrical and Electronics Engineers, Inc. (IEEE) 802.11 access with IEEE 802.1x authentication in a wireless network.

802.1X is an IEEE standard for authenticated network access to wired Ethernet networks and wireless 802.11 networks. IEEE 802.1X supports centralized user identification, authentication, dynamic key management, and accounting. 802.1X supports the following Extensible Authentication Protocol (EAP) authentication methods for wireless clients and servers:

This article discusses the EAP-Transport Layer Security (TLS) authentication method. For more information about the different authentication methods that Windows Server 2003 supports, see the "Understanding 802.1X authentication for wireless networks" topic in Windows Server 2003 Help.

EAP-TLS is an EAP type that is used in certificate-based security environments, and it provides the strongest authentication and key determination method. EAP-TLS provides mutual authentication, negotiation of the encryption method, and encrypted key determination between the client and the authenticating server. If you want to use certificates or smart cards for user and client computer authentication, you must use EAP-TLS.

back to the top

Requirements

To deploy Windows XP Professional clients that use EAP-TLS, use the following list as a checklist of elements to configure:

back to the top

Configuring IAS Servers

You can use IAS to support authentication, authorization, and accounting for wireless connections to an organization. This section provides information about how to configure a typical IAS for an organization.

Note You may want to configure two IAS servers, one primary and one secondary, to provide fault tolerance for RADIUS-based authentication. If you configure only one RADIUS server, and it becomes unavailable, wireless access clients cannot connect. If you configure two IAS servers and configuring all the wireless access points (RADIUS clients) for both the primary and the secondary IAS servers, the RADIUS clients can detect when the primary RADIUS server is unavailable and automatically use the secondary IAS server.

For information about how to configure a secondary IAS server on a different domain controller, see the "Wireless access" topic in the Windows Server 2003 Help and Support Center.

back to the top

Configuring Active Directory Accounts and Groups for Wireless Access

To configure Active Directory to support wireless access, follow these steps:

back to the top

Configuring RADIUS Accounting and Authentication on Wireless Access Points

Configure your third-party wireless access point as a RADIUS client with two RADIUS servers (the primary and secondary IAS servers). For more information, see the documentation for the wireless access point.

For information about how to contact computer hardware manufacturers, click the appropriate article number in the following list to view the article in the Microsoft Knowledge Base:

65416 Hardware and Software Third-Party Vendor Contact List, A-K

60781 Hardware and Software Third-Party Vendor Contact List, L-P

60782 Hardware and Software Third-Party Vendor Contact List, Q-Z

Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
back to the top

Configuring a Certificate Server

For a wireless client computer to be authenticated by using EAP-TLS, you must install a computer certificate on the client computer and on the IAS server. The computer certificate on the wireless client computer establishes network connectivity with the domain. After a network connection is established and the user logs on, a user certificate authenticates wireless access.

Certificate Services provides customizable services for issuing and managing certificates that are used in software security systems that use public key technology. Certificate Services is available on computers running Microsoft Windows Server 2003, Standard Edition, Microsoft Windows Server 2003, Enterprise Edition, and Microsoft Windows Server 2003, Datacenter Edition.

Note You must also install a computer certificate on the IAS server so that the IAS server has a certificate to send to the wireless client computer for mutual authentication during the EAP-TLS authentication.

In a simple implementation, configure a single enterprise root certification authority (CA) to issue both the computer and the user certificates. If you install the computer or the user certificate on the wireless client computer, the root CA certificate for the issuing CA is also installed.

When you install the computer certificate on the IAS server, the root CA certificate for the issuing CA is also installed. Both the wireless client and the IAS server have the certificates that you must have to perform EAP-TLS authentication.

Note When an enterprise CA is installed, the installation includes the Smart Card Enrollment station. This gives the administrator the ability to act on behalf of a user to request and install a Smart Card Logon certificate or Smart Card User certificate on the user's smart card.
For additional information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

323342HOW TO: Install a Certificate for Use with IP Security in Windows Server 2003

For more information, see the "To install a stand-alone root certification authority" topic in the Windows Server 2003 Help and Support Center.

back to the top

Installing Computer and User Certificates on Wireless Client Computers

For user authentication with EAP-TLS, configure either user certificates or smart card authentication. Certificates can reside either in the certificate store on your computer or on a smart card. A smart card is a credit-card-sized device that is inserted into a smart card reader. The smart card reader is installed internally in your computer or connected externally to your computer.For more information, see the "Smart card and other certificate authentication" topic in the Windows Server 2003 Help and Support Center.

For information about requesting a certificate, see the "To request a certificate" topic in the Windows Server 2003 Help and Support Center.

For information about enabling smart card and certificate authentication, see the "To enable smart card or other certificate authentication" topic in the Windows Server 2003 Help and Support Center.For additional information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

323342HOW TO: Install a Certificate for Use with IP Security in Windows Server 2003

back to the top

REFERENCES

For more information about enterprise deployment of IEEE 802.11, visit the following Microsoft Web site:

http://www.microsoft.com/windowsxp/pro/techinfo/deployment/wireless/default.asp

back to the top