Users Guide

618 | 802.1x Configuration for IAS and Windows Clients Dell PowerConnect ArubaOS 5.0 | [User Guide
4. In the New RADIUS Client dialog window, enter the name and IP address for the controller. Click Next.
5. In the next window that appears, enter and confirm a shared secret. The shared secret is configured on both
the RADIUS server and client, and ensures that an unauthorized client cannot perform authentication against
the server.
6. Click Finish.
Remote Access Policies
The IAS policy configuration defines all policies related to wireless access, including time of day restrictions,
session length, authentication type, and group-related policies. See Microsoft product documentation for
detailed descriptions and explanations of IAS policy settings.
Active Directory Database
The Active Directory database serves as the master authentication database for both the wired and wireless
networks. The IAS authentication server bases all authentication decisions on information in the Active Directory
database. IAS is normally used as an authentication server for remote access and thus looks to the Active
Directory “Remote Access” property to determine whether authentication requests should be allowed or denied.
This property is set on a per-user or per-computer basis. For a user or computer to be allowed access to the
wireless network, the remote access property must be set to “Allow access”.
The authentication policy configured in IAS depends on the group membership of the computer or user in Active
Directory. These policies are responsible for passing group information back to the controller for use in assigning
computers or users to the correct role, which determines their network access privileges. When the IAS server
receives a request for authentication, it compares the request with the list of remote access policies. The first
policy to match the request is executed; additional policies are not searched.
Configuring Policies
The policies in this 802.1x authentication example are designed to work by examining the username portion of
the authentication request, searching the Active Directory database for a matching name, and then examining
the group membership for a computer or user entry that matches. For example, the following policies would
operate with the controller configuration shown in “Authentication with an 802.1x RADIUS Server” on
page262:
z The Wireless-Computers policy matches the “Domain Computers” group. This group contains the list of all
computers that are members of the domain. This group is used for all computers to authenticate to the
network.
z The Wireless-Student policy matches the “Student” group. This group is used for all student users.
z The Wireless-Faculty policy matches the “Faculty” group. This group is used for all faculty users.
z The Wireless-Sysadmin policy matches the “Sysadmin” group. This group is used for system administrators.
In addition to matching the respective group, the policy also specifies that the request must be from an 802.11
wireless device. The policy instructs IAS to grant remote access permission if all the conditions specified in the
policy match, a valid username/password is supplied, the user’s or computer’s remote access permission is set to
“Allow”.
To configure a policy:
1. In the Internet Authentication Service window, select Remote Access Policies.