Mobility Hero Tutorials

802.1X with Server Derived user role - Instant + Windows Server 2012 Config - Mar 2014

Super Contributor II

Tutorial by: 

Hello!

In this tutorial i ll show you how to configure 802.1x with server derived role(which is the interesting part of 802.1x with Aruba)

 

What do you need to achive this?

1-Windows Server 2012( a 2008 and 2003 works as well)

2-NPS Role on windows server 2012

3-Cetificate installed on Windows server 2012(the tutorial asume you have it already installed)

4-Instant AP cluster

 

Before beggining lets do some explanaitiong about this:

 

Server derived user role is a feature that is on Aruba product only!

It permits you to give different roles to different types of users, with roles i mean rules

For example you got 2 groups in Active Directory

Accounting

Engineering

 

You would like with the SAME SSID give it different access to the users on accouting than the users on engineering

Let say that you would like with the same SSID give access to everything in the company to the engineering group but to the accounting group you just want to give it access to 2 servers in the company!

You can do it with server derived user role!

In other brands like Cisco you need to set them in different vlans, and you need to start creating one vlan for each differnt access you want, which  makes you work more and  having inecesary vlans, plus you need to restrict this access on another devices....

With Aruba you can do all this on the same box!

 

Okay lets Beging

 

Windows Server 2012 Configuration

After you already installed the NPS ROLE you need to open the NPS role, and as soon as you open it you will see this wizard which is great because it makes it a way easier!

NPS_8021xConfig.JPG

 

Click on Configure 802.1x

NPS_8021xConfig2.JPG

Click on configure secure wireless Network  like in the image! and click next

 

NPS_8021xConfig3.JPG

On radius clients click add

 

NPS_8021xConfig4.JPG

Next to the blue arrow you need to put the cluster IP Address

Next to the orange arrow you need to put  a preshared key between the Cluster of instant and the radius server, and click accept

 

NPS_8021xConfig5.JPG

 

Select Microsoft EAP PEAP and click configure

Then on the dropdown as you see on the blue box, you need to select the certificate that you installed on your server, and then click accept and then click next

NPS_8021xConfig6.JPG

 

Click add, and then in the space in there you type the Active directory group which will have access to the network with the first role.

Remenber that we can have through the same SSID different roles with different access to the network.  Those roles are linked to a user group which is this one we are selecting in here.

NPS_8021xConfig7.JPG

 

Click next

 

NPS_8021xConfig8.JPG

Click configure

 

NPS_8021xConfig9.JPG

Click on filter ID and click edith

Remenber that with this filter ID is the the word that we send to the cluster of instant aps so they know  the name of the role they are assigning... for example if  i put Home in here then there should be a role name Home in the instants ap, if i put in here a word engineering then there should be a role named engineering in the instant aps

 

NPS_8021xConfig10.JPG

Click add and put the string which is the word that will be send to the IAP cluster as you see on the green box

 

NPS_8021xConfig11.JPG

Click accept and then finish

 

If you got more roles with differnet access let say you got 2 more groups you would liek to do, then go and repeat the wizard! the only thing that will change will be the group of Active directory you choosing, and the word you using to send that value to the instant cluster!

 

Now you are done with the Windows 2012

 

 

Now lets beging to configure the Instant AP cluster

 

Instant_8021x_1.JPG

When you enter the Web Gui click on security

Instant_8021x_2.JPG

Click New

Instant_8021x_3.JPG

In the Ip address put the ip of the NPS server(windows server 2012 in this case)

Put also the preshared key(they one that we used before in the Windows server 2012)

click OK

 

Instant_8021x_4.JPG

 

Click on System

Instant_8021x_5.JPG

On dynamic radius proxy put enabled, this is really important... otherwise you would need to add all the Instant aps in the cluster to the clients on the windows 2012 NPS, but if you enabled it you wont have to do that.

 

Instant_8021x_6.JPG

 

Click New

 

Instant_8021x_7.JPG

 

Put the name of the SSID in th box

 

Instant_8021x_8.JPG

Here you need to put Network assign

And Client vlan assigment depends on what vlan you willl use for your wireless(in my case for demo purpuse i choosed default)

 

Instant_8021x_9.JPG

On security leve put Enterprise and authentication server select the server that we configured earlier on the instant AP and click next

 

Instant_8021x_10.JPG

Click New like you see on the red box

Instant_8021x_11.JPG

Choose on Atribute Filter-ID and on Operator Is the role

Click OK

Instant_8021x_12.JPG

And in the name of the role put the word that you are using on the NPS on the filter ID to send to the Cluster Instant.

If you got 3 different access to your network for differnt group of users on your network then you need to create 3 differnt roles with 3 different names, which you will use on the NPS to send to the Instant Cluster

On each Role you need to put the rules you want  for exmample in the next picture i show you

Instant_8021x_13.JPG

In the Home role the users does not have access to the 172.17.0.2 Server and has access to everything else

 

Instant_8021x_14.JPG

 

In engineering role they got access to everything!

 

Remenber that word of Home and Engineering comes from the value you assign to the group of users on the NPS.

 

And well you click finish and you are done!

 

After configuring this you should check out my other tutorial which tell you how to configure correctly the end point i mean the windows machine with EAP PEAP.  Which is really important for security reasons.  I see many configuring it incorrectly

 

http://community.arubanetworks.com/t5/AAA-NAC-Guest-Access-BYOD/Correctly-configure-EAP-PEAP-Windows-client/td-p/43398

 

 


Cheers

Carlos

 

Version history
Revision #:
2 of 2
Last update:
‎04-14-2014 08:01 AM
Updated by:
 
Labels (1)
Contributors
Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: 
Is this a frequent problem?

Request an official Aruba knowledge base article to be written by our experts.