ACS 5.1 and Windows Vista : Machine Certificate and AD-Account-Verification

[swiss_ewok]

Hi there.

We plan to use machine certificates on our notebooks with Windows Vista. Our authenticating server is Cisco ACS 5.1. To access the wireless network we want to use the machine certificate of the notebook and a verification of the corresponding computer account in the Active Directory. The machine certificate won't store in Active Directory. The ACS Server checks the certificate locally and only the verification of the computer account will checked against the Active Directory.

What authentication method (EAP-TLS, PEAP...) to check the machine certificate and if exists the enabled corresponding computer account in the Active Directory ?

How to configure the ACS and the notebook to use it like described ?

Thanks.

Regards,

swiss_ewok

[alex.dersch]

Hello Swissewok,

there are different flavours of EAP available, it depends basicially on your security requirements. EAP-TLS is considered very secure but diffucult to implement. You need a client and a server certificate for a successful authentication. For PEAP you just need a server certificate for authentication.

First you have set up an CA.

2. Deploy the certificates to your notebooks.

3. Issue an certificate for your ACS

4. Set up the ACS to use Active Directory as an external Identity Source and map the appropriate OU's

4. Create Access Policies

5. Configure your Wireless Controller or Access Point to do EAP authentication

6. Configure your notebook's wireless connection for EAP authentication

Voila

there is a good book which explains the procedure quite good.

http://store.fullpond.com/cisco/ProductCompactBooks.aspx?catalogid=1&categoryid=7205&productid=7666

hope it helps

alex