Cisco 9800 SSID with NPS for Domain Joined Computers

mumbles202 · ‎05-02-2023

Working on a 9800 configuration and have it setup w/ a radius server for 1 of the SSIDs. That radius server is a Windows server w/ NPS and it's currently configured to only allow domain joined computers. Created a GPO and assigned it to the correct OU and have validated that all is working.

As the SSID is set to broadcast, a non-domain computer or smartphone can attempt to join, which fails. If they keep trying to connect, they get a login prompt asking for username and password. If they use valid credentials they're unable to login, which is expected; the question has been asked if it's possible to simply not display this prompt at all. So if they keep trying nothing happens, they just fail to connect.

marce1000 · ‎05-02-2023

- Perhaps it could be possible to add a policy on the NPS server to deny non-domain devices ,

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

Rich R · ‎05-03-2023

I suspect this is a client behaviour rather than NPS. You might be able so solve it with an exclusion policy on the WLAN.
https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/guide-c07-743627.html#Clientexclusion

------------------------------
Please click Helpful if this post helped you and Select as Solution (drop down menu at top right of this reply) if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's and TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's, Best Practices for 9800 WLC's and Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.196.0, latest 9800 releases, 8.5.182.12 (8.5.182.13 for 3504) and 8.5.182.109 (IRCM, 8.5.182.111 for 3504)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs
Default AP console baud rate from 17.12.x is 115200 - introduced by CSCwe88390

JPavonM · ‎05-04-2023

As @Rich R says, this is Windows bvehaviour and cannot be modified, as Windows tries to use the login credential first and then ask for a new credential. Are you using PEAP only for authentication? If so try using EAP-TLS as NPS should be able to reject all connections without the proper certificate before asking for credentials.