topic iPSK Configuration with Microsoft NPS in Wireless

iPSK Configuration with Microsoft NPS

j-shearer — Wed, 20 Nov 2019 13:32:24 GMT

Greetings.

I see that Meraki MR access points now support iPSK. I also saw a configuration example posted using FreeRADIUS and Cisco ISE but I was wondering if there was anything available for configuring iPSK with Microsoft NPS posted anywhere.

Any information would be greatly appreciated.

Thanks in advance.

Joe

Re: iPSK Configuration with Microsoft NPS

Nolan H. — Wed, 20 Nov 2019 15:48:02 GMT

Take a look at this recent blog here:

https://www.synic.nl/2019/11/11/configuring-meraki-ipsk-with-freeradius/

The documentation Meraki provides for IPSK is at the moment a bit sparse:

https://documentation.meraki.com/MR/Access_Control/IPSK_with_RADIUS_Authentication.

They do provide some information, but it’s rather incomplete and even incorrect at places. The main caveat is that it lacks instructions for Windows NPS support, which is presumably the most used RADIUS server for Meraki 802.1X implementations. The reason for this is that Windows NPS probably lacks the RADIUS attributes or functionality to support IPSK. The instructions do mention Cisco ISE, which is a rarity in the SMB market, and FreeRADIUS, but this is more of a pointer than an instruction. Plus it forgets to mention the most awesomest feature of all: VLAN assignment!

Re: iPSK Configuration with Microsoft NPS

j-shearer — Wed, 20 Nov 2019 16:21:21 GMT

Nolan -

Thank you. The customer currently does implement Microsoft NPS for Windows user/computer authentication using PEAP so I think I'll have to just try iPSK with it and see how it goes.

I believe that since Microsoft NPS integrates directly with AD I may have to generate AD user accounts that reflect the MAC address of the 'PSK-only' devices (older IoT devices) for authentication. As far as I can tell the RADIUS attributes that are needed are options in Microsoft NPS.

Cheers

Joe

Re: iPSK Configuration with Microsoft NPS

Philip D'Ath — Wed, 20 Nov 2019 18:27:58 GMT

Microsoft NPS definately can not do iPSK.

You could integrate FreeRADIUS with AD and simply replace NPS.

Re: iPSK Configuration with Microsoft NPS

Kurtis1 — Wed, 27 Nov 2019 05:25:19 GMT

Did you have any luck with Microsoft NPS and iPSK setup?

Re: iPSK Configuration with Microsoft NPS

j-shearer — Wed, 27 Nov 2019 12:08:11 GMT

Kurtis -

I haven't tried it yet. I am waiting to get a 'PSK-only' device in my hands. Hoping to give the config a shot later on this week or sometime next week. I'll gladly post if it's a success of failure.

Cheers

Joe

Re: iPSK Configuration with Microsoft NPS

Kurtis1 — Wed, 27 Nov 2019 16:10:05 GMT

That would be great, thank Joe!

Re: iPSK Configuration with Microsoft NPS

Daniel Jensen — Tue, 14 Jan 2020 12:17:24 GMT

Hi Jie2112

Had you any luck with configuring this with Windows NPS. I can get it to accept the Filter-ID for Group Policy - but I can't get it to accept the PSK. I have used the attribute Tunnel-Password for this.

Re: iPSK Configuration with Microsoft NPS

j-shearer — Tue, 14 Jan 2020 12:53:26 GMT

@Daniel Jensen

I ran into the same issue. I was using NPS on Windows 2012 R2. What version of Windows server are you using? I was thinking of trying Windows Server 2019 to see if any updates to NPS features/functions were done.

In the meantime I am waiting for approval to get an MR license or two so I can continue testing (my eval license expired). Really hoping to get this working using NPS since the majority of my customer already deploy it.

Cheers,

Joe

Re: iPSK Configuration with Microsoft NPS

Daniel Jensen — Tue, 14 Jan 2020 13:37:31 GMT

@j-shearer

I am using Windows Server 2019 - which attributes did you use?

My clients are not accepting my attributes for the PSK.

I have created an account in Acitive Directory (for MAB) and it gets authenticated successfully. But it will not accept the Tunnel-Password as PSK - did you succced on getting the correct attribute to use?

Re: iPSK Configuration with Microsoft NPS

j-shearer — Tue, 14 Jan 2020 14:01:23 GMT

@Daniel Jensen

I am in the same position you are but I was using Windows Server 2012 R2.

I was also able to get MAB to work but the Tunnel-Password attribute would not be accepted by the clients. I was going to try using the Cisco-specific attributes to see if any of those would work.

I was hoping that the version of Windows server I was using was the cause of the issue but if you are using Windows Server 2019 then it's not that.

Cheers,

Joe

Re: iPSK Configuration with Microsoft NPS

Daniel Jensen — Tue, 14 Jan 2020 14:09:33 GMT

@j-shearer I have also tried with the Cisco-AV-Pair attributes. It didn't work either.

Here you can see my original attributes setup - where Tunnel-Password is not acceptet.

Re: iPSK Configuration with Microsoft NPS

roesch4alc — Wed, 08 Apr 2020 14:53:16 GMT

Hi all,

Im struggling with the same iPSK-NPS issue. I can tell you, that it is possible to generate a Radius Accept message, even if you have no AD users (theres a setting for that). But: What I can see, that all the additional attributes are missing in the Access-Accept message. There´s only the t=Class(25) Attribute in it, nothing more.

Did someone ever managed to get this running? Seems to be like an NPS issue.

Re: iPSK Configuration with Microsoft NPS

Philip D'Ath — Wed, 08 Apr 2020 20:46:52 GMT

It wont be possible to make this work with NPS.

Re: iPSK Configuration with Microsoft NPS

roesch4alc — Thu, 09 Apr 2020 07:07:55 GMT

Ok, seems to be like that, but why is that? What is the NPS doing different?

Re: iPSK Configuration with Microsoft NPS

Philip D'Ath — Thu, 09 Apr 2020 19:12:57 GMT

Upon re-reading all the documentation, I've changed my mind. I think it may be possible to re-configure NPS to make this work, but this is not a normal workflow you would use NPS for.

The first thing I don't like is you have to create a user in AD where the username and password are the MAC address of the device.

Unless you go to a lot of trouble, this means someone could just log into an AD attached machine using those same details, and access anything that "Domain Users" or "Authenticated users" has access to.

You have no way to change the password or lock the person out or any way to remove them from those two built-in groups.

This just sounds dangerous to me.

Re: iPSK Configuration with Microsoft NPS

Philip D'Ath — Thu, 09 Apr 2020 19:14:54 GMT

ps. The solution may be to stop NPS sending some of the other attributes, and getting it to just send the Tunnel-Password attribute.

Re: iPSK Configuration with Microsoft NPS

jonas@complit.be — Tue, 26 May 2020 09:00:11 GMT

In beta version 27.1 you have the feature IPSK without radius. Very interesting. But I don't like the limit of 50 unique psk's per ssid.

https://documentation.meraki.com/MR/Encryption_and_Authentication/IPSK_Authentication_Without_RADIUS

Re: iPSK Configuration with Microsoft NPS

j-shearer — Tue, 26 May 2020 11:39:39 GMT

@jonas@complit.be - I saw this in the release notes for the beta firmware last week and I am looking forward to trying this out. I hit a brick wall with the iPSK w/ Microsoft RADIUS config attempt (running into the same issues that others have posted in this thread), but this (iPSK w/o RADIUS) look very promising.

-Joe

Re: iPSK Configuration with Microsoft NPS

jonas@complit.be — Tue, 26 May 2020 11:42:12 GMT

Indeed look very promising. But I hope they well increase the number of allowed unique psk's. To give an example: Mist can do 5000 and Cisco Meraki 50. But it is a nice start!