Dell W-7030 AOS 6.4.x User Guide - Page 1154

detailed descriptions and explanations of IAS policy settings. Active Directory Database The Active Directory database serves as the master authentication database for both the wired and wireless networks. The IAS authentication server bases all authentication decisions on information in the Active Directory database. IAS is normally used as an authentication server for remote access and thus looks to the Active Directory "Remote Access" property to determine whether authentication requests should be allowed or denied. This property is set on a per-user or per-computer basis. For a user or computer to be allowed access to the wireless network, the remote access property must be set to "Allow access". The authentication policy configured in IAS depends on the group membership of the computer or user in Active Directory. These policies are responsible for passing group information back to the controller for use in assigning computers or users to the correct role, which determines their network access privileges. When the IAS server receives a request for authentication, it compares the request with the list of remote access policies. The first policy to match the request is executed; additional policies are not searched. Configuring Policies The policies in this 802.1x authentication example are designed to work by examining the username portion of the authentication request, searching the Active Directory database for a matching name, and then examining the group membership for a computer or user entry that matches. For example, the following policies would operate with the controller configuration shown in Configuring Authentication with an 802.1X RADIUS Server on page 339: l The Wireless-Computers policy matches the "Domain Computers" group. This group contains the list of all computers that are members of the domain. This group is used for all computers to authenticate to the network. l The Wireless-Student policy matches the "Student" group. This group is used for all student users. l The Wireless-Faculty policy matches the "Faculty" group. This group is used for all faculty users. l The Wireless-Sysadmin policy matches the "Sysadmin" group. This group is used for system administrators. In addition to matching the respective group, the policy also specifies that the request must be from an 802.11 wireless device. The policy instructs IAS to grant remote access permission if all the conditions specified in the policy match, a valid username/password is supplied, the user's or computer's remote access permission is set to "Allow". To configure a policy: 1. In the Internet Authentication Service window, select Remote Access Policies. 2. To add a new policy, select Action > New Remote Access Policy. This launches a wizard that steps you through configuring the remote access policy. 3. Click Next on the initial wizard window to proceed. 4. Enter the name for the policy, for example, "Wireless Computers" and click Next. 5. In the Access Method window, select the Wireless option, then click Next. 6. in the User or Group Access window, select Group and click Add to add the group of users to which this policy applies (for example, "Domain Computers"). Click Next. 7. For Authentication Methods, select either Protected EAP (PEAP) or Smart Card or other certificate. 8. Click Configure to select additional properties. 9. Select a server certificate. The list of available certificates is taken from the computer certificate store on which IAS is running. In this case, a self-signed certificate was generated by the local certificate authority and installed on the IAS system. On each wireless client device, the local certificate authority is added as a trusted certificate authority, thus allowing this certificate to be trusted. 1154 | 802.1X Configuration for IAS and Windows Clients Dell Networking W-Series ArubaOS 6.4.x | User Guide