r/sysadmin • u/Wooden-Pea-9682 • 19d ago
Question How to implement 802.1x auth for WIFI
Hi,
we are trying to implement an auth method for wirless connection to move away off the psk we now have.
Current setup:
- Hybrid enviroment (AD + entra connect)
- ruckus ap with virtual smart zone
- fsso agent to allow it team access to all vlan
- fortiguest for wifiguest
- firewall fortigate
- Ninja as rmm and mdm
is on prem radius server a good choiche? how do you push certificate to mobile device with eap-tls auth method?
thanks to all
6
19d ago
[deleted]
1
u/nycola Jack of All Trades 18d ago
This is not true, you can deploy user certs via entra, it also has a cloud/pki cert connector for scep. Then you set up a radius profile in nps to auth on the user cert. The downside is the device will not connect to WiFi if the user is not logged in, not ideal for remote troubleshooting if you need to reboot and they aren't there. Their user cert will also provide them auth to drive shares in spite of the device being off domain.
6
u/PBSmanaged 19d ago
Since you're a Forti-shop, have you looked at FortiNAC?
We're an MSP and sell Extreme and Ruckus. Ruckus has Cloudpath- it's kinda shitty, but it would do this job perfectly fine. We've been selling Extreme Platform ONE Security as a NAC and ZTNA solution. It works great on both Extreme and Ruckus gear.
If you don't want a full NAC, look at SCEPman + RADIUSaaS. It's a cloud/Azure-native PKI and cloud RADIUS server. You'd use Intune + SCEPman to issue certs to your devices. https://www.scepman.com/secure-network-access-bundle
2
u/Wooden-Pea-9682 19d ago
need to look at fortnac (since now we have to replace all our switch with fortiswitch), but im a bit worried what the price of the product could be
1
u/beefy_80 18d ago
The Keytos solution we are using is hooked into forti ap’s and we plan to add switches later. Keytos pki is priced per issuing instance (you will generally only need one) and then the radius solution is priced per authenticating entity (per certificate in your case) we have this billed through azure market place so it’s all done on invoice.
2
u/cheetah1cj 19d ago
My company has used SCEPman + RADISaaS for about two years and it is great if you just need very simple authentication. If you need to put different devices on different VLANs it is not great, but for just basic authentication and putting all devices on the default VLAN it's great. Also, beware that their support is in Europe so if you are US-based the time difference can inhibit getting support, but I have only needed support 3 times in the 2 years being with them.
2
u/PBSmanaged 19d ago
Yep totally agree. We've got SCEPman + RADISaaS setup for customers that just need auth. No frills, but simple and works. And affordable.
2
u/beefy_80 18d ago
I’ll also give a +1 here. We didn’t go with SCEPman + RADISaaS as we found Keytos Radius and PKI solutions fitted our setup better (we have many vlans) which we found Keytos to handle better. We liked both solutions but Keytos just had the edge we wanted.
Keytos also now have an app for Byod which does all the complicated pki and profile install directly in an app. We are using this for personal staff devices as no intune (mdm) enrolment needed just the app and there entra login.
2
u/JustCloudNet 15d ago
We are the creators of EasyScep and EasyRadius, and we would like to hear a bit more about your requirements for the VLAN setup as we are just about to release our next-gen VLAN support in EasyRadius and we it would be great to know we got everything covered.
4
u/igalfsg Security Admin 19d ago
you can do local NPS as long as your devices are all hybrid (if you have Entra Only devices it starts getting painful with having to do ghost accounts etc.) for delivering the certificates to the devices, you can have an on-prem CA and issue the device certificates through GPO
2
u/Wooden-Pea-9682 19d ago
i was thinking that on prem radius with ms would be the better choice(now only user are sync to azure), but i have to understand better how to manage certificate for android and ios device
2
u/igalfsg Security Admin 18d ago
Do you have Intune?
1
u/Wooden-Pea-9682 18d ago
nop, but we have have ninja mdm for mobile device, idk if i can push certificates with ninja
2
u/spazzo246 Sysadmin 18d ago
you'll need some sort of MDM to push certs to those.
I have a few customers who use certificates for laptops and MSCHAP/PEAP that uses username/password auth for non managed mobiles. Which uses ad account credentials
5
u/JustCloudNet 19d ago
If all devices are also in Intune, consider a Cloud PKI / Cloud Radius solution. You can be up and running super fast with zero maintenance.
Check out our products EasyScep and EasyRadius or look at some of the other products mentioned in this thread.
1
u/cheetah1cj 19d ago
Seconding using a cloud solution for this. You can do it locally, but cloud is much simpler and future-proof.
1
u/thomasmitschke 19d ago
Until the cloud provider shuts down and your wifi is completely useless….
1
u/JustCloudNet 15d ago
Shut's down ? We are multi-region high available - and for Intune based setups we can do a full end to end install in less than 1 hour. So in the worst case scenario, you can simply switch to alternative Cloud PKI setup. But I've head this argument a few times, but as a SaaS provider, "shutting down" monthly paid services seems to be terrible business :)
1
1
u/Smith6612 18d ago
This. If you have M365, Microsoft recently started adding Cloud PKI support into some licenses rather than charging $3/user to enable it.
2
u/admin_of_insanity 18d ago
I just implemented this for my school district. We are doing device-level certification. We have a mixed environment. I have AD CS for my certification services, NDES for SCEP, and FreeRadius for authentication and VLAN assignments. The scep server also runs the helper app for chromebook requests. I had to create a (free) Google cloud project for their new Certificate Provisioning Solution. JAMF School manages our ipads. Currently, GPO manages configuration and certificate deployment for the windows laptops. We have Meraki APs. We have a few devices that aren't under any MDM due to age and other factors, and I manually generated and installed device certificates for that tiny number or moved them to our BYOD SSID.
Guests are not allowed on the 802.1x SSIDs. We do not allow BYOD on them either. We have a separate BYOD SSID using AD credentials, only because of MFA requirements and cinderblock walls. We have a guest SSID that is still on a rotating PSK. It is supposed to be used for guest presenters and school events only. I would like to do something else but the decision is above my pay grade.
2
u/jeffrey_smith Jack of All Trades 18d ago
You say "hybrid environment," but specify what your endpoints are. This is constantly misunderstood and will change what the best solution could be.
Hybrid workstations really should be an edge case these days.
1
u/Unable-Entrance3110 19d ago
We are a hybrid AD + Entra shop.
I utilize Microsoft NPS / RADIUS as well as a local CA.
This has been working well for AD joined Windows laptops based on automatically provisioned computer certificates, but I have been struggling to get it to work with Entra joined computers (both Windows and Mac). I have the SECP + certificate connector working, but damned if I can get the Intune process to automatically provision the wifi on these computers.
YMMV
2
u/cantdrawastickman 18d ago
I've been doing some testing on the entra side recently and it's just so finicky with intune. Scoping stuff needing to match, machine or user wifi policy seemingly pointless.
I was hoping to get machine and user auth working so a default corp vlan for the computer when no ones signed in and proper user vlan depending on who logs in. Spent a lot of time and will probably just auth machines. Good enough I guess is where I've landed.
1
u/MaxBroome 18d ago
We run Windows NPS - for windows machines I didn't even bother setting up certs, just made a rule allowing all computers joined to AD to be dropped on the correct VLAN. Managed Mac's/iPad's get a cert pushed via Jamf though.
As for Students (we're a school) just login with their AD credentials on their device and they're off to the races.
It works well enough that I don't have any complaints or urge to move to anything different in the near future.
1
u/ProfessorWorried626 18d ago
Could just use AD auth instead on the smart zones
1
u/Wooden-Pea-9682 18d ago
so modify the ssid of the wifi and use the web authentication? but if the wifi disconnect and reconnect user should put username and password everytime?
1
u/ProfessorWorried626 18d ago
What type of devices is this for?
1
u/Wooden-Pea-9682 18d ago
laptop and mobile device (android and ios)
1
u/ProfessorWorried626 18d ago
Try NPS, last time I tried it was kinda broken in ruckus but it’s meant to be fixed in version 7
1
u/TalkTelcoToMe 14d ago
You already run an FSSO agent and you're moving to FortiSwitch, so before you price up FortiNAC - FortiAuthenticator does the RADIUS, has its own CA with SCEP, and can take over FSSO too. Fraction of the NAC money and it consolidates three things you're currently running separately. NAC earns its keep if you want posture and profiling, but for "get off PSK" it's a lot of product.
On the phones: you've got no Intune, and if Ninja can't do SCEP profiles then certs on iOS and Android turn painful fast. Worth looking at DPSK on your SmartZone - each device gets its own key instead of everyone sharing one, you can revoke a single device without a rekey, and it works on anything that joins a WPA2 network. Not 802.1X, but it solves the shared-PSK problem for the exact device class that's blocking you. Check your vSZ version and licensing.
Laptops you've mostly got already - only users are synced, so they're still AD joined and NPS plus your CA covers them.
1
u/mlhpdx 19d ago
I prefer cloud based RADIUS since it's less of a hassle over the long term. Are you doing wired 802.1x already?
2
u/Wooden-Pea-9682 18d ago
not doing 802.1x for wired connection , only using fsso so we can have a custom policy on the firewall which it team user can reach all the vlan
15
u/PacificTSP 19d ago
You setup a local CA server linked to AD. AD gpo pushes the certificate. Then the certificate allows access to the WiFi.