topic Re: NPS Wireless authentication based on user group in Wireless

NPS Wireless authentication based on user group

kevinjapto — Mon, 05 Jul 2021 19:05:23 GMT

I have two SSID : 1. SSID-NPS and 2. SSID-NPS2

both of them is using nps radius server.

I want to make the rule

1. only groups 8021x can connect SSID-NPS

2. only groups 8021xb can connect to SSID-NPS2

i have already using called station ID, but only rule 1 is running well,

when i test SSID-NPS2, the user in group 8021x still can connect to that ssid.

Note : I only using eap-peap method (connect using username and password from active directory)

below is the configuration of NPS server. please correct if i missing the configuration

Re: NPS Wireless authentication based on user group

Rasika Nayanajith — Mon, 25 May 2020 07:19:43 GMT

I think it is because your two SSID names are not unique. If you use distinguish SSID names ( SSID-NPS-1 & SSID-NPS-2) you should be able to filter using called-station-id

HTH

Rasika

Re: NPS Wireless authentication based on user group

JPavonM — Mon, 25 May 2020 07:40:28 GMT

Terhe should be a condition to match "Called Station ID" with the value of the BSSID like ".*.:SSID-NPS" or ".*.:SSID-NPS2" (without the quotes) for every Machine Group you want to split.

HTH
-Jesus
*** Please Rate Helpful Responses ***

Re: NPS Wireless authentication based on user group

Karsten Iwen — Mon, 25 May 2020 07:48:26 GMT

Instead of solving this problem I would first think about your environment. Typically it does not make any sense to "waste" two SSIDs if both use the same authentication-methods to the same authentication-server. It's likely that you only need one SSID.

Re: NPS Wireless authentication based on user group

Scott Fella — Mon, 25 May 2020 10:58:59 GMT

I agree with Karsten here... you can achieve this by rules and vlan assignments. However, if you still want to go ahead and figure your scenario out, you need to use a better regex. Your ssid #1 overlaps with ssid #2 so you either can follow what Rasika mentioned and really make then unique or see if NPS takes standard anchor in regex.

^.*: SSID-NPS$
^.*: SSID-NPS2$