topic Re: Peap and Machine authentication in Wireless

Peap and Machine authentication

relsethagen — Sun, 04 Jul 2021 00:28:23 GMT

I am attempting to come up with a secure deployment scenario. I have strong control over image on mobile devices. I am testing utilizing PEAP with ACS. I am currently running legacy 3.3 ACS server but am about to upgrade. The dillemma I have is that I only want to allow machines that are domain members to authenticate. I have configured machine authentication Rules to prevent access for users that have not machine authenticated, however I have test devices, specifically Iphone and Itouch devices that can still consistently authenticate using only user domain credentials. Is there something I am missing in setting up the Machine Access restriction? If there is, is this possibly something that is fixed in 4.X ACS?

Re: Peap and Machine authentication

rsumpter — Mon, 27 Apr 2009 17:37:03 GMT

I'm curious. What rules are you referring to? ACS or the client rules?

Re: Peap and Machine authentication

r.bishop — Wed, 06 May 2009 15:26:35 GMT

Hi there,

We have this running on ACS 4.2 and the only elements we need to enable on the ACS server are under the "Machine Authentication" section of "External Databases".

Tick "Enable PEAP machine authentication".

Tick "Enable Machine Access Restrictions".

Ensure that "Group map for successful user authentication without machine authentication:" is mapped to "No Access".

Ensure that no groups are exempt from this.

If your setup in ACS3.3 is the same but does not function, then all I can say is that it works OK in v4.2! I cannot comment on whether this is a bug in 3.3

Hope this helps,

Russell

Re: Peap and Machine authentication

colin.lynch — Tue, 21 Jul 2009 13:50:45 GMT

Hi Russell

What is the config if any on the windows side to allow machine authentication?

As I am seeing the PEAP user auth pass

but the machine auth fail with the below log

host/wks1.lnd.uk Authen failed EAP-TLS or PEAP authentication failed during SSL handshake

Re: Peap and Machine authentication

Robert.N.Barrett_2 — Wed, 22 Jul 2009 12:48:11 GMT

What 802.1x supplicant are you using on the Windows side? If you are using the one built-in to Windows XP (Wireless Zero Config), then you can simply check/tick the "Authenticate as computer when computer information is available" box on the authentication tab.

Re: Peap and Machine authentication

colin.lynch — Tue, 28 Jul 2009 18:20:27 GMT

Hi Russel

What config if any did you have to do on the windows server / AD side?

Regards

Colin

Re: Peap and Machine authentication

colin.lynch — Tue, 28 Jul 2009 18:29:04 GMT

Hi Robert

I am using the windows XP SP2 Supplicant

auth as machine is ticked and ACS sends machine auth to AD and fails.

PEAP user auth works fine.

Regards

Colin

Re: Peap and Machine authentication

brian.kachel — Thu, 06 Aug 2009 13:06:56 GMT

I am running into the same issue. I desire to lock out devices that are not part of the AD. We are using ACS4.2 appliances (which use the remote agents) and I beleive machine authentication works because it was enabled to allow logon scripts to run etc.

However - if I check the box to Enable Machine Access Restrictions and set it to No Access - no users can authenticate.

As mentioned earlier, the Itouch's and Iphones are prompted to continue without a certificate, and are able to get on by only providing the AD username and password.

This is the failed attempt log when MAR is enabled:

Windows External DB user access was denied due to a Machine Access Restriction

Re: Peap and Machine authentication

Robert.N.Barrett_2 — Fri, 14 Aug 2009 16:36:14 GMT

The MAR may be coming in to play because the machine didn't authenticate. The error you posted, I believe, is from when a USER account was presented for authentication without the machine having been previously authenticated.

Check the logs - do you see anything about failed auths for MACHINE accounts (or successful machine authentications in the successful auth logs)?

Re: Peap and Machine authentication

iceteanolemon — Thu, 07 Oct 2010 20:58:05 GMT

I am running into the same issue.

I can authenticate as a machine and use eap-tls for machine authentication.

I cannot however get a windows computer to combine active directory authentication with machine authentication.

I want a supplicant to send BOTH machine auth via eap-tls to satisfy the "MAR" then send the active directory username and password info to satisfy the peap.

**ps: I CAN get a user cert and active directory combined to authenticate but this is not as secure as checking the machine certificate.

I have tried and tried and can only do one or the other and not both. Anyone have input on how to do this?