topic Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates in Wireless

Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

Gmorrallee — Tue, 19 May 2020 12:00:48 GMT

Hi all.

We've taken on a new client to roll out a bunch of Azure AD joined clients to the users. As part of this they will need to use their Meraki WiFi solution.

The Meraki is currently configured to use Radius on a Windows 2019 Server with NPS installed. There is an on premise AD which is synced down to Azure AD. The Radius server is currently configured to use the on premise Domain Users group for authentication. However to prevent personal devices being joined to the WiFi network using their AD creds the client wishes to use certficates to authenticate instead.

We have an internal CA and the root certificate is installed on all clients via InTune.

It seems the we potentially need to deploy PKCS certificates via InTune and leverage the InTune Certificate Connector to sit betweeen the CA and InTune.

However the part of this I'm struggling with and can't seem to find any information on is the actual connection between the certificates deployed via InTune and the Certificate Connector and the Radius Server authentication.

So basically we can get certificates to the clients but how does the Radius server know to authenticate them?

Any thoughts?

Thanks

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

joey.debra — Tue, 19 May 2020 18:50:06 GMT

I'm no expert on the matter but the basics things I know:

1) Your clients will be configured through intune with the SSID to connect to using WPA2-Enterprise and EAP-TLS and the correct certificate to use. Also if it's using machine or user auth or both depending on login screen or logged in.

2) When the client connects the AP will transmit the radius attributes service-type:framed (for dot1x) and a called-station-id which contains SSID and AP MAC address. The client will also transmit it wants to do EAP-TLS.

3) The NPS server would have been configured with:
A list of IP's or radius clients (the AP's) or a subnet where the AP's live
The policy where it matches on service-type framed and called-station-id containing the SSID, and EAP-TLS as auth method.
The fields to look at in the certificate mostly common name and the attributes containing the AD group.

4) NPS sends it's cert to the client which is signed by the same CA, so the client trusts the NPS server
5) The client sets up the TLS connection and sends it cert over it containing all necessary fields
6) NPS evaluates and sends access-accept with attributes or access-reject if something is wrong

If I'm mistaken somewhere, please correct me 😉

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

Philip D'Ath — Wed, 20 May 2020 16:45:05 GMT

Be prepared for a lot of work. Microsoft has made the configuration you describe really hard.

You'll need to configure Intune to issue certificates from the on-premise CA server using SCEP/NDES. These certificates are authenticated against the user in AD (they have the username embedded in the certificate).

When the user connects to WiFi and presents their certificate RADIUS extracts out the username and then continues to process as normal.

This is a lot of work to deploy and get working. I'm waiting for Trusted Access to add support for Windows 10 so I can forget this nightmare.

https://documentation.meraki.com/zGeneral_Administration/Cross-Platform_Content/Trusted_Access_for_Secure_Wireless_Connectivity

Actually, I think you could do this via Meraki Systems Manager (which you would have to buy). You can only enrol a Windows 10 machine in one MDM at a time - and you have already enrolled in Intune - but I think if you used Intune to deploy the Meraki Systems Manager agent you could then use the Meraki Agent to deploy Meraki certificates onto the machines for authentication, all automated. It would also configure the WiFi settings on the machine.

https://documentation.meraki.com/zGeneral_Administration/Cross-Platform_Content/Configuring_EAP-TLS_Wireless_Authentication_with_Systems_Manager_Sentry_Wifi

I'd be tempted by this approach because the Microsoft method is such a lot of work.

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

RonaldB1 — Mon, 06 Jul 2020 20:00:03 GMT

Hello,

To deploy user and device certificates you can deploy PKCS certificates. This is easy to do. What you need is to download the PKCS certificate connector. You can find it when you go to the intune portal and Device configuration | Certificate connectors. Click on Add and download the PKCS certificate connector.

Go to an on-prem server which is in the same domain as the internal CA server. Don't worry, connection with the certificate connector will be as save encrypted tunnel so no complex firewall settings or other things to worry about.

Install the certificate connector and only PKCS have to be installed. If SCEP is applicable you can choose for PKCS ans SCEP during the setup steps of the connector.

After installing start the connector. If starting the app later, run the connector as admin.

Make sure you have a Azure global admin with an Intune (EM+S) license activated. If not do so but it will take some time before this is active, at least 15 min.

In the certificate connector login with the Azure Global Admin, and you are finished. You can see in Intune a green check that the connector is up and running.

Next is to create a certificate connector which has the correct certificate requirements. For Intune I believe you have 2 requirements to make sure you can enroll the certificate and that is under Subject Name: Supply in the request, and at permissions, add the server which has the certificate connector installed the read and enroll certificate permissions. I think that is it but be sure to look online for advise when deploying the certificates with Intune.

I used this method for always on vpn configurations and WPA2 Enterprise PEAP Wifi Configurations based on user certificates.

Hopefully this helps.

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

Chabs — Mon, 24 Aug 2020 13:23:21 GMT

Did you ever work this out? I can't believe such a simple part of the puzzle isnt really in any documentation anywhere- how do you configure Microsoft's NPS server to use these cloud SCEP certs for authentication? How do we add an external cert to the trusted lists within the NPS settings. I dont really see any of these replies succinctly giving you this answer.

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

Gmorrallee — Mon, 24 Aug 2020 13:29:33 GMT

Not yet - we seem to get loads of different parts of the puzzle but have not yet been able to complete it.

We've been engaged with MS support for several months and still haven't got it resolved. We've got a field services engineer helping out now but between either or him cancelling we've still not got anywhere.

Apparently it's seemingly impossible find any sort of documentation to explain this from the ground up and work through it step by step.... (i.e. what sort of certificate, what settings do we need in InTune, on the NPS box etc)

Hopefully when we finally get our field service tech involved next week we might finally get there.

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

Gmorrallee — Mon, 24 Aug 2020 13:31:29 GMT

I actually had a blazing row with MS support cos they were like "oh you need to do this, this and this" but missing vital steps on actually HOW you do those things along the way.

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

Chabs — Mon, 24 Aug 2020 13:49:21 GMT

Ugh dealing with Microsoft support, there goes weeks of going round in circles.

Sounds like our Infrastructure is exactly the same as yours.
I am thinking to just try importing the cloud SCEP cert (in our case SCEPMan cert) in to the Radius server Trusted Root Certificates. Then there seems to be an option to add additional certs in the Microsoft NPS settings. (currently its using the PKI cert assigned to the RADIUS server)

Playing with this risks breaking our current wifi and RADIUS servers though.

I'm currently talking to Glueck Kanja who have been very helpful - I'll let you know if we get anywhere.

Thanks again!

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

kschutte — Mon, 31 Aug 2020 12:19:03 GMT

I am trying to achieve the exact same thing in our organization. Thus far my efforts have not been fruitful. I will post an update if I happen to get it working.

The advice given here thus far has been a huge help.

Thank you.

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

cockneymanc — Wed, 02 Sep 2020 15:01:32 GMT

I used the following to set this up.

I have AP-deployed, Intune-enrolled W10 devices, enrolling device/user certs from on-prem CA via SCEP and the NDES connector as part of ESP, as described in this article, using an Intune-deployed WIFI profile, connecting to Meraki wifi network, auth'ing against NPS using PEAP-TLS.

https://www.jeffgilb.com/ndes-for-intune/

Only real issue for us is the lack of device-based certificate auth, simply because with AAD-joined devices there are no computer account objects in on-prem AD to add to an AD group used in an NPS condition. So yes on full-AAD joined devices we have to use User certs, so available post-logon. If you require device-based certs enabling pre-user-logon auth to the WiFi network, you will prob need to use hybrid AAD join, so you get the computer account on-prem which you can add to a group and use in NPS.

Looks like a lot of work, but it isn't really. If you already have on-prem AD, on-prem enterprise CA, an Azure tenant, familiarity with AAD Applications/Enterprise Applications, it's not a big deal. Took a couple of hours. Good luck 🙂

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

Chabs — Wed, 02 Sep 2020 23:44:22 GMT

Unfortunately your post is pointless! Everyone already knows how to get user certs to work on inTune devices.

The whole point of the issue is trying to have Intune only devices connect with device certs - so connected before user logins. We obviously don't want to join these in a hybrid manner on prem, we're rolling off on prem, these devices are NON DOMAIN JOINED/non hybrid joined. Not in Active Directory, only AAD. Thank you though!

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

cockneymanc — Thu, 03 Sep 2020 09:21:36 GMT

Sorry for my pointless post.

More pointless than PhilipDAth's (great) post:

"You'll need to configure Intune to issue certificates from the on-premise CA server using SCEP/NDES. These certificates are authenticated against the user in AD (they have the username embedded in the certificate)...

...When the user connects to WiFi and presents their certificate RADIUS extracts out the username and then continues to process as normal."

(User certs)

More pointless than RonaldBs (very useful) post:

"I used this method for always on vpn configurations and WPA2 Enterprise PEAP Wifi Configurations based on user certificates."

(User certs)

OP makes no reference to only using device certs. Are user certs not a valid approach to his desire to prevent his staff connecting personal devices to his Meraki Wifi?

OP says in various replies:

"Apparently it's seemingly impossible find any sort of documentation to explain this from the ground up and work through it step by step.... (i.e. what sort of certificate, what settings do we need in InTune, on the NPS box etc)"

and:

"I actually had a blazing row with MS support cos they were like "oh you need to do this, this and this" but missing vital steps on actually HOW you do those things along the way."

Chabs says:

"Did you ever work this out? I can't believe such a simple part of the puzzle isnt really in any documentation anywhere- how do you configure Microsoft's NPS server to use these cloud SCEP certs for authentication?"

No mention of device certs anywhere? My psychic powers are letting me down again (i have a similar problem with the wife.......)

So i was trying to be helpful by providing a link to a blog by an Azure senior PFE containing step-by-step instructions on how to set this up, that i know to work as i used it myself when first setting this up. Yes, it is user-based certs.

RE: device certs, as i think you already know, you are unlikely to get native NPS doing cert auth for non-domain-joined devices. It is from an era where this requirement was inconceivable and the on-prem domain is the security boundary etc. I'm sure every guide you have googled starts with 'Create an AD account and....' or 'From a domain-joined machine...'. Having Meraki auth against a 3rd party RADIUS solution may do the job though, or something like PhilipDAth's nifty idea with Systems Manager agent.

Microsoft's new Always-On VPN (replacing Direct Access) will do machine-based vpn tunnel initialisation, pre-logon, but - unsurprisingly - requires hybrid join so the computer object exists on-prem, for the cert auth to work. So i think this is also suggestive of the idea you can't do device-based cert auth on a non-hybrid device, using only Microsoft stack.

Good luck with it. It will be interesting to see what solutions appear. No doubt an AAD service will appear at some point to provide this sort of facility and 'bridge the gap'. AAD/Intune/MDM is still in it's infancy really.

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

Chabs — Thu, 03 Sep 2020 11:41:41 GMT

Thank you, gosh yes ignore my strong wording in hindsight. Thanks for your well thought out responses!

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

cockneymanc — Thu, 03 Sep 2020 11:52:31 GMT

All good my friend. We're all on the same team with this stuff 🙂

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

RonaldB1 — Thu, 03 Sep 2020 21:03:57 GMT

Hello all,

Deploying a device certificate from an internal CA is not very difficult as I mentioned in my last post. But using NPS as a Radius server with device certificates is. This is because the NPS server checks the device from the certificate.

. But with Azure AD joined device the NPS server will not find the device in Active Directory and because of this it will not except the connection like cockneymanc mentioned.

I have read in other posts about creating the devices in Active Directory as an object (so not Hybrid joined) just to be able to check the device. I can't remember the exact steps but it was for me to much manual tasks which I didn't like doing.

At one customer I deployed device certificates for Wifi which works great, but they don't use NPS. I saw that they are connecting to a Linux server which does the authentication check. I have no idea what this was but it works. If it is secure? I don't know. It probable just checks if the certificate is valid with a working certificate chain and CRL. But that is all guessing. If anyone is interested I can ask the customer to explain what has been setup to just have an idea if someone would like to go for this approach.

This means:

- Azure AD joined devices.

- Certificate Authority in on-prem AD

- Intune Certificate Connector for deploying certificates to Azure AD joined devices.

- Device Certificates en Root certificate deployed with Intune on the devices

- PEAP smartcard/certificate based authentication Wifi profile with device authentication. Wifi profile deployed with Intune.

- Some kind of Linux server as the RADIUS server (so no NPS here)

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

kschutte — Tue, 08 Sep 2020 10:51:05 GMT

Thanks @RonaldB1 for all your help with this.

I'm fairly new to certificate auth methods, so im learning on the job.

I have set up and deployed NDES with the Intune connector by following the article you posted.

Cert enrollment works and a cert is issued from my on-prem CA to the Azure AD Device.

I will test the user cert auth on my internal NPS later this week via Meraki wi-fi radius auth.

If its not too much trouble to ask your client what Linux Radius solution there where running, it would be much appreciated and very interesting.

On that note, has anyone tried using a cloud based 3rd party radius service that integrates into Azure AD, like this one from SecureW2 (https://www.cloudradius.com/radius-authentication-with-azure-ad) ?

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

Philip D'Ath — Tue, 08 Sep 2020 20:35:16 GMT

The cloud-based RADIUS service looks good @kschutte . Another one I have seen but not tried is:

https://wiflex.eu/

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

RonaldB1 — Wed, 09 Sep 2020 09:07:36 GMT

Hello @kschutte ,

I asked the customer and it seems that they are using an Aruba Wifi system which comes with 2 Clearpass servers. The Clearpass servers do the authentication which do not require the device to be available in the domain controller to check the device name which the certificate has been requested for.

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

kschutte — Wed, 09 Sep 2020 09:39:14 GMT

Hi @RonaldB1,

Thanks for finding out. I presume it only works for Aruba.

I have seen one user implemented user based cert auth using FreeRadius: https://stackoverflow.com/questions/40747952/freeradius-authentication-through-azure-active-directory

I wonder if the same can be done for device cert auth...

@Philip D'AthThanks for the link, it looks promising. I'm going to try to get it working on NPS with user cert auth before I give up and pay for a cloud based service.

AFAIK, the only difference between user cert auth and device cert auth is that the wi-fi will only connect once the user has logged into the device. I can live with that until we find a working device cert auth method for Azure AD Joined devices.

Re: Meraki - RADIUS (NPS) Auth - AAD Devices & Certificates

kschutte — Thu, 10 Sep 2020 12:48:23 GMT

Hi All,

So my test today did not go as expected.

Seems my Intune Wi-Fi profile is not configured correctly.

Anybody have any experience in how to configure the profile for it to work on Meraki?

I currently get an error saying "cant connect because you need a certificate to sign in"

This is what I currently have: