Administrator Guide

1154 | 802.1X Configuration for IAS and Windows Clients Dell Networking W-Series ArubaOS 6.4.x| User Guide
detailed descriptions and explanations of IAS policy settings.
Active Directory Database
The Active Directory database serves as the master authentication database for both the wired and wireless
networks. The IAS authentication server bases all authentication decisions on information in the Active
Directory database. IAS is normally used as an authentication server for remote access and thus looks to the
Active Directory “Remote Access” property to determine whether authentication requests should be allowed or
denied. This property is set on a per-user or per-computer basis. For a user or computer to be allowed access to
the wireless network, the remote access property must be set to “Allow access”.
The authentication policy configured in IAS depends on the group membership of the computer or user in
Active Directory. These policies are responsible for passing group information back to the controller for use in
assigning computers or users to the correct role, which determines their network access privileges. When the
IAS server receives a request for authentication, it compares the request with the list of remote access policies.
The first policy to match the request is executed; additional policies are not searched.
Configuring Policies
The policies in this 802.1x authentication example are designed to work by examining the username portion of
the authentication request, searching the Active Directory database for a matching name, and then examining
the group membership for a computer or user entry that matches. For example, the following policies would
operate with the controller configuration shown in Configuring Authentication with an 802.1X RADIUS Server
on page 339:
l The Wireless-Computers policy matches the “Domain Computers” group. This group contains the list of all
computers that are members of the domain. This group is used for all computers to authenticate to the
network.
l The Wireless-Student policy matches the “Student” group. This group is used for all student users.
l The Wireless-Faculty policy matches the “Faculty” group. This group is used for all faculty users.
l The Wireless-Sysadmin policy matches the “Sysadmin” group. This group is used for system administrators.
In addition to matching the respective group, the policy also specifies that the request must be from an 802.11
wireless device. The policy instructs IAS to grant remote access permission if all the conditions specified in the
policy match, a valid username/password is supplied, the user’s or computer’s remote access permission is set
to “Allow”.
To configure a policy:
1. In the Internet Authentication Service window, select Remote Access Policies.
2. To add a new policy, select Action > New Remote Access Policy. This launches a wizard that steps you
through configuring the remote access policy.
3. Click Next on the initial wizard window to proceed.
4. Enter the name for the policy, for example, “Wireless Computers” and click Next.
5. In the Access Method window, select the Wireless option, then click Next.
6. in the User or Group Access window, select Group and click Add to add the group of users to which this
policy applies (for example, “Domain Computers”). Click Next.
7. For Authentication Methods, select either Protected EAP (PEAP) or Smart Card or other certificate.
8. Click Configure to select additional properties.
9. Select a server certificate. The list of available certificates is taken from the computer certificate store on
which IAS is running. In this case, a self-signed certificate was generated by the local certificate authority and
installed on the IAS system. On each wireless client device, the local certificate authority is added as a
trusted certificate authority, thus allowing this certificate to be trusted.