Implementing WPA Enterprise (802.1X and RADIUS) with EAP-TLS on UniFi WiFi Access Points

Installing the AD CS Role

We have two options for installing the AD CS role: using PowerShell or the Graphical User Interface.

PowerShell

• For a quick installation using PowerShell, run the following command:

Graphical User Interface (GUI)

• Using the Server Manager dashboard, navigate to Add Roles and Features:

• Click Next:

• Select Role-based or feature-based installation On the Installation Type menu then click Next:

• Select your AD CS server and click Next:

• Check the Active Directory Certificate Services box and click Next:

• Click Next on the Features menu:

• Read the Active Directory Certificate Services description if you want, then click Next:

• Check the Certificate Authority box and click Next:

• Check the Restart destination server box to allow it to restart if needed, then click Install:

• Open the Server Manager dashboard and navigate to the Post-deployment Configuration:

• Change Default credentials if you want, then click Next:

• Select Certificate Authority role and click Next to continue:

• Choose Enterprise CA and click Next:

• Select Root CA:

• We create a brand new private key:

• Choose proper cryptographic options:

• Specify the name of the CA:

• Specify the valid period for the certificate, 10 years seems to be good, given that we'll probably all be dead by then:

• Specify the database locations:

• Check the global configuration and click Configure to run the configuration:

• Once the Configuration succeeded click Close:

Configuring the AD CS Role

From the ADCS server, we need to create two certificate templates: one for the Authentication Server (NPS), which will allow to generate a Computer certificate, and another for the Supplicants, which will allow the Domain Users to authenticate.

• Open the Certification Authority management console:

• Go to the Certification Templates menu and delete templates that you don't need (in my case, I deleted everything as I just need it for the EAP-TLS authentication):

Create The Certificates Template

• Open the Certificate Templates Console by right-clicking the Certificate Templates folder and selecting Manage:

Authentication Users Certificates Template (For Supplicants)

• Do a right-click on User template and select Duplicate Template:

• Optional, but if you have a recent architecture, set the most recent systems in the Compatibility Settings:

• Give a name to the Template:

• Upgrade the key size:

• To enable automatic deployment of the certificates via GPO, check the Autoenroll box for Domain Users:

• Please note that the E-mail name is required for AD users who will request certificates. This means an email address should be entered in the user field of the Active Directory:

Finally, click OK to create the template.

• From the Certification Authority management console, right-click on Certificate Templates and select Certificate Template to Issue:

• Select the previously created template EAP-TLS:

• The EAP-TLS template should appear inside the Certificate Templates folder:

Authentication Server Certificates Template (For NPS Server)

• Open the Certificate Templates Console by right-clicking on the Certificate Templates folder and selecting Manage:

• Right-click on Computer template and select Duplicate Template:

• Optional, but if you have a recent architecture, set the most recent systems in the Compatibility Settings:

• Provide a name for the Template:

• Optional, you can upgrade the key size to improve security:

• To enable automatic deployment of the certificates via GPO, check the Autoenroll box for Domain Computers:

Finally, click OK to create the template.

• From the Certification Authority management console, right-click on Certificate Templates and select Certificate Template to Issue:

• Select the previously created template NPS:

• The NPS template should appear inside the Certificate Templates folder:

Installing the NPS Role

We have two options for installing the NPS role: using PowerShell or the Graphical User Interface.

PowerShell

• For a quick installation using PowerShell, run the following command:

Graphical User Interface (GUI)

• Using the Server Manager dashboard, navigate to Add Roles and Features:

• Select Role-based or feature-based installation:

• Select the server:

• Select the Network Policy Server role:

• Just click Next:

• Check Restart destination server and click on Install:

Certificate Distribution for the NPS Server

With the AD CS correctly configured we can request a computer certificate from the NPS server.

Manually through the Certificate Management Console

• From the NPS server, open the Certificate Management Console for the current computer:

• Right-click on the Personal folder and select Request New Certificate…:

• Click Next to start the certificate enrollment process:

• Select the Active Directory Enrollment Policy and click Next to continue:

• Select the previously set NPS Policy and click Enroll:

• Simply click Finish once the enrollment process is over:

• After clicking Refresh, you should see your Computer certificate appear:

Automatically through Group Policy (GPO)

In order to automate the process of certificate renewal, we can create a GPO.

• Go to Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies and edit the Certificate Services Client - Auto-Enrollment policy:

• Enable the Configuration Model and check the boxes to enable the automation of certificate renewal:

• Do a gpupdate to get a certificate:

Configure NPS

• Open the Network Policy Server Console:

Declare Access Point as RADIUS Clients

• Navigate to NPS > RADIUS Clients and Servers > RADIUS Client and click on New:

• For each Access Point, provide a Name, set the IP address, and create a strong password (use the same one for every Access Point):

• You should see all Access Point previously added in the RADIUS Clients folder:

Create a Network Policy

Now we need to create a Network Policy where we will define which group of users will be able to connect and the protocols used.

• Click New in the Network Policies folder:

• Give a name to the Policy:

• Click Add to specify the condition:

• Select User Groups, and click Add Groups…:

• Add an Active Directory group of users, such as Domain Users:

• Click Next:

• Select Access granted:

• Choose Microsoft: Smart Card or other certificate as EAP type and edit the configuration:

• Select the newly deployed certificate:

• Click Next:

• Click Next:

• Finally, click Finish to create the Policy:

UniFi Network Server

We now need to configure our UniFi Network Server to integrate the RADIUS (NPS) server.

• Go to the Profiles menu and create a new RADIUS profile:

• Click on Create New:

• Give a Name to the RADIUS profile and add the NPS server IP address for the Authentication Server and the RADIUS Accounting Server. Don't forget to add the password previously set on the NPS server, set the ports, and then click the Add buttons to validate the configuration:

• Now, go to the WiFi menu, and either add a new WiFi profile or modify an existing one:

• Set the Security Protocol and the RADIUS Profile:

Supplicant (Windows Stations)

Now we will see how the supplicants will obtain the certificate they will use for authentication.

Supplicant Certificate Distribution

Manually through the Certificate Management Console

• Open the Certificate Management Console for the current user on the Supplicant machine:

• Do a right-click on Personal and select Request New Certificate…:

• Click Next to start the certificate enrollment process:

• Select the Active Directory Enrollment Policy and click Next to continue:

• Select the EAP-TLS Policy that we previously set and click Enroll:

• Simply click Finish once the enrollment process is over:

• After refreshing, you should see your Client Authentication certificate:

Automatically through Group Policy (GPO)

• Go to User Configuration > Policies > Windows Settings > Security Settings > Public Key Policies and edit the Certificate Services Client - Auto-Enrollment policy:

• Enable the Configuration Model and check the boxes to enable the automation of renewing certificates:

• Do a gpupdate to get a certificate:

The supplicants can now connect to the WPA Enterprise WiFi Access using EAP-TLS.

References

• https://www.securew2.com/
• https://pbarth.fr/node/407
• https://pbarth.fr/node/426
• https://www.virtualizationhowto.com/2020/05/ubiquiti-unifi-radius-authentication-configuration/
• https://forsenergy.com/fr-fr/radius/html/25b886ed-75e9-4f49-8ca0-c90991dfc20e.htm
• https://irp.nain-t.net/