Yesterday we fixed the problem with Wireless laptops only needing to authenticate with machine only by altering the Wireless EAP group policy
âComputer authentication: With user re-authenticationâ
it was "computer only" previously.
Now when you start the laptop in the proximity of the Wireless access points the laptop uses machine and user authentication and successfully authenticates with PEAP.
This has highlighted a problem when users take their laptops from their desk already logged on down to the wireless Network as the infrastructure is now configured to use machine and username authentication with machine access restrictions enabled. now when the laptop is already logged on it will
try to authenticate with the username only.
The following report is logged on the ACS 4.1
Wireless access is denied with the following Windows External DB user access was denied due to a Machine Access Restriction
Is there anyway of ensuring that the Microsoft supplicant issues a machine authentication prior to user authentication?
Re: Cisco Wireless Machine and user authentication
I would use the authmode registry key.
see microsoft text.:
The AuthMode registry value (found at HKEY_LOCAL_MACHINE\Software\Microsoft\EAPOL\Parameters \General\Global\AuthMode) affects the behavior of computer authentication and user authentication. The AuthMode value can be set to the following:
0 - Computer authentication is performed when the wireless client computer is started. When a user logs in, if the computer authentication was successful, user authentication is not performed. This setting has been deprecated and its use is discouraged. This is the default setting for Windows XP with no service packs installed.
1 - Computer authentication is performed when the wireless client computer is started. When a user logs in, user authentication occurs. When the user logs out, computer authentication occurs. This is the default setting for Windows XP SP1, Windows XP SP2, and Windows Server 2003.
2 - Computer authentication is performed when the wireless client computer is started. User authentication is never performed.
I would leave the computer authenticate, then the user will have access to the LAN to autenticate, but can still autenticate with no computer
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...