1. Radius Authentication
2. Microsoft Radius Server 2016
3. Mac Address Lookup
4. Microsoft Radius Server Mac Address Authentication Free
5. Radius Server Mac Address Authentication
6. Microsoft Radius Server Mac Address Authentication Windows 10

-->

Jul 23, 2014 Radius Server utilizing Microsoft Active Directory. Microsoft NPS with Cisco/Meraki Wireless Authentication. Radius Server utilizing Microsoft Active Directory. Skip navigation Sign in. Nov 04, 2016  Under “RADIUS Auth Server” enter the IP Address of the RADIUS or RADIUS Proxy Server Enter the port used by RADIUS Server for authorization, by default 1812 In the password field, enter the shared secret you assigned to the access point as a radius client. Optional steps- only needed for RADIUS Accounting Functionality.

Introduction

Hi, I noticed in the controller there's a section for Radius MAC Authentication: What exactly does this do? For instance - if I setup normal username/password Radius authentication (e.g. Over FreeRADIUS 3.0) - does this allow me to whitelist certain devices to bypass that auth? Anyone successfully configured Meraki Wireless MAC Address Authentication using Microsoft’s NPS server as struggling to get it to work, getting failures to connect to radius server. If any of you have a config you could share much be greatly appreciated Regards Richard. Dec 31, 2017 Devices that don’t support 802.1x can be authenticated using mac authentication bypass or MAB. There are two ways to achieve this: Mac authentication on NPS Radius based authentication In order to achieve this, the switch port must be configured with the right configuration to attempt MAB authentication either as priority or after the failure of Continue reading NPS settings for Mac.

Radius Authentication

Recently I worked with customer on interesting scenarios where they needed they were unable to make necessary restriction when using multiple WIFI Networks. They created WIFI Network devices such as Computer, Tablets and Mobile Phones. That was necessary because which network provided a different level of access. The goal was to ensure all WIFI networks (SSIDs) can be handled by a single NPS Server and users cannot use their credentials to access other WIFI SSID if they are not authorized. However, after creating a few Network Policy Rules, the first side effect was when a user accessed SSID, for example for SSID dedicated to mobiles, user was getting authenticated in another rule dedicated SSID for computers.

Microsoft Radius Server 2016

Scenario

Mac Address Lookup

For this scenario, the following Network Policy Rules and respective specific Groups show below:

• Rule 1: Wireless-Computers [SSID: CTCORP]
  - NAS Port Type = Wireless - Other OR Wireless - IEE 802.11
  - Windows Groups = CONTOSOWIFI-Corp-Users
• Rule 2: Wireless-Mobiles [SSID: CTMOBILE]
  - NAS Port Type = Wireless - Other OR Wireless - IEE 802.11
  - Windows Groups = CONTOSOWIFI-Mobiles
• Rule 3: Wireless-Tablets [SSID: CTTABLETS]
  - NAS Port Type = Wireless - Other OR Wireless - IEE 802.11
  - Windows Groups = CONTOSOWIFI-Tablets

Here is a view of the same rules above inside the NPS interface:

The diagram below shows how the policies should work. One of the requirements is to ensure when I user does not belong to a group, she or he should not be authorized to use the respective SSID. In this case, we can do more granular control of which type of devices can access the network with different restrictions. For example, for tables accessing CTTABLETS will have only access to Internet but no access internal resources, while for computers accessing WIFI SSID CTCORP they should have full access to the network and Internet.

The real problem starts when user belongs to two or more groups. For example, user John Smith is authorized to access WIFI from all types of devices, which means he belongs to all groups listed above. However, when using his computer, we need to make sure he authenticates on WIFI SSID CTCORP, when using his Smartphone, he needs to access WIFI SSID CTMOBILE and when he uses his Tablet he needs to use WIFI SSD CTTABLETS.

In case we John Smith is removed from group CONTOSOWIFI-Mobiles he will still have access to the SSID CTMOBILE. Why? If you see the list of rules Rule: Wireless-Computers [SSID: CTCORP] has process order 1. Which means he will be authenticated by that Rule.

Microsoft Radius Server Mac Address Authentication Free

Resolution
The Solution for this scenario is to add a Condition inside the Network Policy and specify the Called Station ID which presents the WIFI Access Point MAC Address plus SSID.This information can be easily extracted from NPS Event logs (Event Viewer – Custom Views – Server Roles – Network Policy and Access Services). When user is using a specify SSID that information is specified on Called Station ID populated as highlighted below.

Source: Microsoft-Windows-Security-Auditing
Event ID: 6278
Task Category: Network Policy Server
Level: Information
Keywords: Audit Success
Description: Network Policy Server granted full access to a user because the host met the defined health policy.
Security ID: CONTOSOJohnSmith
Account Name: CONTOSOJohnSmith
Account Domain: Domain
Fully Qualified Account Name: CONTOSOJohnSmith

Called Station Identifier: 00-1C-C5-01-52-00: CTMOBILE

Calling Station Identifier: 25-E6-8C-24-E3-11
NAS: NAS IPv4 Address: 10.1.1.210
NAS IPv6 Address: -
NAS Identifier: 3Com NAS
Port-Type: Wireless - IEEE 802.11
RADIUS Client: Client Friendly Name: WIFIAccessPoint
Client IP Address: 10.1.1.210
Authentication Details: Connection Request Policy
Name: Secure Wireless Connections Network Policy
Name: 802.1X-Wireless-MOBILES [CORPv3]
Authentication Provider: Windows

Note: While creating the condition in Network Policy do not make confusion between Called Station Identifier with Calling Station Identifier which presents real computer's MAC address.

Radius Server Mac Address Authentication

In summary, here are the action to do in each one of the Network Policy Rile, where you will specify the respective SSID as shown:

• Rule 1 Wireless-Computers [SSID: CTCORP]
  Called Station ID= CTCORP
• Rule 2 Wireless-Mobiles [SSID: CTMOBILE]
  Called Station ID= CTMOBILE
• Rule 3 Wireless-Tablets [SSID: CTTABLETS]
  Called Station ID= CTTABLETS

Microsoft Radius Server Mac Address Authentication Windows 10

Here is an example on how is done via GUI in five and self-explanatory simple steps :

It is important to note that you just need to add the SSID name as is and it will be searched in the field as string in any position. You can play with regular expression also well to adequate with your needs. You can leverage this documentation in TechNet: Using Regular Expressions in NPS

Conclusion

In this article, we demonstrated how to allow a single user who belongs which needs access multiple WIFI Networks (SSID's) while using a single Network Policy Server (NPS) to perform the authentication correctly on its respective rule matching the SSID by using Called Station ID. I hope this help you to implement this kind of scenario on your network and let us know your thoughts or questions in the comments below.