Skip to main content

 

Cisco Meraki Documentation

How to Create an NPS Policy for EAP-TLS Authentication

  1. Last updated
  2. Save as PDF

Overview 

When you use WPA2-Enterprise with 802.1X authentication, you can specify EAP-TLS as the authentication method. With EAP-TLS, both the wireless client and the RADIUS server use certificates to verify their identities to each other and perform mutual authentication. 

This article explains how to configure a policy in Windows Network Policy Server (NPS) to support EAP-TLS. Complete these two tasks in order: 

  1. Create a connection request policy for IEEE 802.11 wireless 

  1. Create a network policy for EAP-TLS wireless authentication 

Prerequisites

  • A wireless network that uses WPA2-Enterprise with 802.1X authentication 
  • Access to the Network Policy Server console on the Windows server 
  • A certificate issued to the NPS server by the Active Directory CA server 
  • Certificates on the wireless clients, because EAP-TLS requires both the client and the RADIUS server to authenticate with certificates

Step-by-step instructions 

Create a connection request policy for IEEE 802.11 wireless 

The connection request policy tells NPS to process RADIUS requests from IEEE 802.11 wireless connections. 

  1. Open the Network Policy Server console. 

  1. Go to NPS (Local) > Policies > Connection Request Policies. 

  1. Right-click Connection Request Policies and select New. 

  1. On the Specify Connection Policy Name and Connection Type page, enter a name in the Policy name field, then select Next. 

  1. On the Specify Conditions page, select Add. 

  1. Select NAS Port Type as the condition. 

  1. Under NAS Port Type, select the Wireless - IEEE 802.11 and Wireless - Other checkboxes, then select OK. 

  1. Select Next. 

  1. On the Specify Connection Request Forwarding page, keep the default settings and select Next. 

  1. On the Specify Authentication Methods page, keep the default settings and select Next. 

  1. On the Configure Settings page, select Next. 

  1. On the Completing Connection Request Policy Wizard page, review the settings and select Finish. 

  1. Right-click the connection request policy you created and select Move up until it appears above all other policies. NPS then processes it before any other policies. 
    Screenshot of the "Conditions" window in NPS. The desired condition has the highest processing order, as there are no other conditions above it.

Create a network policy for EAP-TLS wireless authentication 

The network policy sets EAP-TLS as the authentication method for IEEE 802.11 wireless connections. 

  1. In the Network Policy Server console, go to NPS (Local) > Policies. 

  1. Right-click Network Policies and select New. 

  1. On the Specify Network Policy Name and Connection Type page, enter a name in the Policy name field, then select Next. 

  1. On the Specify Conditions page, select Add. 

  1. Select NAS Port Type as the condition. 

  1. Under NAS Port Type, select the Wireless - IEEE 802.11 and Wireless - Other checkboxes, then select OK. 

  1. Select Next. 

  1. On the Specify Access Permissions page, confirm that Access granted is selected, then select Next. 

  1. On the Configure Authentication Methods page, select Add. 

  1. In the Add EAP window, choose Microsoft: Smart Card or other certificate, then select OK. 

  1. Under Less secure authentication methods, clear all checkboxes. 

  1. Under EAP Types, select Microsoft: Smart Card or other certificate, then select Edit. 

  1. Confirm that the Certificate issued to drop-down shows the correct certificate and that the issuer is the Active Directory CA server, then select OK. 

  1. Select Next. 

  1. On the Configure Constraints page, select Next. 

  1. On the Configure Settings page, choose NAP Enforcement. 

  1. Under Auto-Remediation, clear the Auto-remediation of client computers checkbox, then select Next. 

  1. On the Completing New Network Policy page, review the settings and select Finish. 

  1. Right-click the network policy you created and select Move up until it appears above all other policies. NPS then processes it before any other policies.
    EAP-TLS_conditions_processing_order.png 

Verification 

Confirm the policy processing order 

  1. In the Network Policy Server console, go to NPS (Local) > Policies > Connection Request Policies. Confirm that the connection request policy you created appears first in the processing order. 

  1. Go to NPS (Local) > Policies > Network Policies. Confirm that the network policy you created appears first in the processing order.