I've demonstrated how to set up a WPA Enterprise architecture with PEAP-MSCHAPv2. You can find the tutorial here. However, as mentioned in the article, while it's relatively simple to configure, it may not be the most secure way to protect your WiFi. If security is a priority for you or your company, I highly recommend using EAP-TLS instead. And the good news is that's precisely what I'll be discussing here!
In this guide, we will learn how to implement WPA Enterprise access using the most secure protocol for WiFi connections: EAP-TLS.
We will focus on setting up an architecture oriented towards Microsoft and Ubiquiti. As EAP-TLS relies on a PKI, it requires a Certificate Authority (CA). Therefore, we will also configure Active Directory Certificate Services (AD CS) to distribute certificates to both Supplicants and the Authentication Server, which will be a NPS server (RADIUS server from Microsoft).
The Active Directory Certificate Services (AD CS) enables the issuance and management of public key infrastructure (PKI) certificates. In this setup, it will facilitate the provision of certificates that will allow each user in an Active Directory to authenticate securely.
We have two options for installing the AD CS role: using PowerShell or the Graphical User Interface.
PS C:\Users\administrator.STD> Add-WindowsFeature Adcs-Cert-Authority -IncludeManagementTools
From the ADCS server, we need to create two certificate templates: one for the Authentication Server (NPS), which will allow to generate a Computer certificate, and another for the Supplicants, which will allow the Domain Users to authenticate.
Finally, click OK to create the template.
Finally, click OK to create the template.
We have two options for installing the NPS role: using PowerShell or the Graphical User Interface.
PS C:\Users\administrator.STD> Install-WindowsFeature NPAS -Restart -IncludeManagementTools
With the AD CS correctly configured we can request a computer certificate from the NPS server.
In order to automate the process of certificate renewal, we can create a GPO.
C:\> gpupdate
Now we need to create a Network Policy where we will define which group of users will be able to connect and the protocols used.
We now need to configure our UniFi Network Server to integrate the RADIUS (NPS) server.
Now we will see how the supplicants will obtain the certificate they will use for authentication.
C:\> gpupdate
The supplicants can now connect to the WPA Enterprise WiFi Access using EAP-TLS.
Contact :