{"id":1260,"date":"2015-05-13T09:50:41","date_gmt":"2015-05-13T14:50:41","guid":{"rendered":"http:\/\/it.thelibrarie.com\/weblog\/?p=1260"},"modified":"2015-05-13T09:53:55","modified_gmt":"2015-05-13T14:53:55","slug":"securing-enterprise-wireless","status":"publish","type":"post","link":"https:\/\/it.thelibrarie.com\/weblog\/2015\/05\/securing-enterprise-wireless\/","title":{"rendered":"Securing Enterprise Wireless"},"content":{"rendered":"

Our small business is growing into a medium sized business rather quickly. What was acceptable before (BYOD, honor system, etc) is no longer able to be sustained.<\/p>\n

I’ve been at this same company since we had a single Linksys WRT54GS access point with ~40 employees to a 7x Meraki APs (MR18 and MR24’s) with 3 locations and 200+ employees.<\/p>\n

Originally we had a standard WPA\/TKIP with a pre-shared key (PSK) that was given out to those who needed it. Unfortunately this PSK ended up in the hands of so many people that it was difficult to control. I rolled out an NPS server (Windows RADIUS) to allow only those with domain credentials to connect; this alleviated the issue of having non-employees on the network (for the most part), but individuals quickly realized they could add their iPad\/Tablet, phone, and other laptops to the company network.<\/p>\n

If that’s OK with you, here’s my NPS configuration (I have this on two different NPS servers for redundancy):
\nRADIUS Clients<\/strong><\/p>\n

Friendly name: SuiteNumber_DeviceModel
\nIP Address: The statically assigned IP of the device
\nDevice Manufacturer: RADIUS Standard
\nNAP-Capable: No (for now)
\nStatus: Enabled<\/p><\/blockquote>\n

\"wireless_01\"<\/p>\n

Connection Request Policies<\/strong><\/p>\n

Policy Name: I picked “Secure Wireless Connections” and Enabled the policy
\nConditions: NAS Port Type of Wireless-Other OR Wireless-IEEE802.11
\nSettings: I left these as the defaults as I wanted the Network Policy to dictate the authentication methods<\/p><\/blockquote>\n

\"wireless_02\"<\/a><\/p>\n

Network Policies<\/strong><\/p>\n

Policy Name: I once again picked “Secure Wireless Connections” and enabled the policy
\nConditions: NAS Port Type of Wireless-Other OR Wireless-IEEE802.11 \/ Windows Groups of domain\\domain computers and domain\\domain users
\nSince I don’t feel like typing it all out, look at the picture.<\/p><\/blockquote>\n

\"wireless_03\"<\/a><\/p>\n

Just point your wireless device(s) to your NPS\/RADIUS server IP with the default port and away you go.<\/p>\n

\n

Now to get it with certificate-based security it was a bit more work:<\/p>\n

I am assuming that you’re using an on-premise Certificate Authority and that it’s already up and running. In my case we have a 2008R2 CA already published in Active Directory. If it’s not published in AD, you can always have a GPO that pushes the trusted root certificate authority to all domain members.<\/p>\n

Anyway, I needed to set it so that every domain joined computer would enroll with a computer certificate against this CA, so I created a GPO called Wireless Settings (I don’t really like adding things to the default domain policy, so I end up creating new).
\nUnder Computer Configuration \/ Policies \/ Windows Settings \/ Security Settings \/ Public Key Policies \/ Certificate Services Client – Auto-Enrollment Settings
\n\"wireless_04\"<\/a><\/p>\n

From this I verified that computers had the appropriate certificates installed by looking at my MMC:
\nstart, run, MMC
\nAdd Certificates (Computer account) for the local machine
\nVerify there’s a certificate issued to your computername.yourdomainname.tld from the Certificate Authority with hooks into AD
\n\"wireless_05\"<\/a><\/p>\n

Now I finished up my Wireless Settings GPO with some Wireless Network (802.11) Policies. See the picture. Lazy.
\nThe Profile Name will be the one displayed when people search for available wireless networks and, to the end-user, they will be connecting to this access point. You can actually publish multiple SSID’s under this name (I only have the “Linksys47532” name available currently).
\n\"wireless_06\"<\/a><\/p>\n

You’d have to run
\nnetsh, wlan, show interfaces<\/code>
\nwith an administrative command window to actually see the network being connected to.<\/p>\n

When I get around to publishing a computer certificate that can be imported on an iPhone, I’ll update this post.<\/p>\n","protected":false},"excerpt":{"rendered":"

Our small business is growing into a medium sized business rather quickly. What was acceptable before (BYOD, honor system, etc) is no longer able to be sustained. I’ve been at this same company since we had a single Linksys WRT54GS access point with ~40 employees to a 7x Meraki APs (MR18 and MR24’s) with 3 … Continue reading Securing Enterprise Wireless<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,4],"tags":[],"class_list":["post-1260","post","type-post","status-publish","format-standard","hentry","category-microsoft","category-networking"],"_links":{"self":[{"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/posts\/1260","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/comments?post=1260"}],"version-history":[{"count":4,"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/posts\/1260\/revisions"}],"predecessor-version":[{"id":1270,"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/posts\/1260\/revisions\/1270"}],"wp:attachment":[{"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/media?parent=1260"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/categories?post=1260"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/it.thelibrarie.com\/weblog\/wp-json\/wp\/v2\/tags?post=1260"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}