How to setup Windows Server 2008 R2 as an 802.1X Authentication Server.

The following guide shows an example Windows Server 2008 R2 configuration for use with the PCoIP Zero Client and PCoIP Remote Workstation Cards. The example sets up a brand new environment including a Active Directory Domain. It is recommended this example be done in the lab and then adapted to your production environment once you complete a security assessment and plan on how to implement it into your existing environment.

How to setup Windows Server 2008 R2 as an 802.1X Authentication Server

1.  Install Windows Server 2008 R2.
2.  Install the following roles:
   1. ADDS (Active Directory Domain Services)
      1. Remember to setup a new domain.
   2. ADCS (Active Directory Certificate Services)
      1.  This is used for setting up a Certificate Authority.
      2.  You will also be prompted to install IIS.
   3. NPS (Network Protection Services)
3. Add a new 802.1X user in Roles > ADDS > AD Users & Computers > my.new.domain > Users.
4. Enable the HTTPS protocol for web services (refer to http://support.microsoft.com/kb/324069).
5. Download the client and root CA certificates from https://localhost/certsrv/.
   1. Remember to do necessary conversions to PEM file format (refer to How do I get a PEM certificate from Windows for IEEE 802.1x Network Authentication?)
6. Add a RADIUS client here: Roles > NP&AC > NPS > RADIUS Clients and Servers > RADIUS Clients:
   1. Add the switch information (e.g. Cisco 802.1X switch).
   2. Make sure the IP address and Shared Secret are set.
7. Create 802.1X Policies here: Roles > NP&AC > NPS > Polices:
   1. Add Connection Request Policies
      1.  Add either a Day Time Resctriction policy or NAS Port Type: Ethernet policy.
      2.  Use Microsoft: Smart Card or other certificate as the authentication method and make sure the correct root CA certificate  is selected.
   2. Add Network Policies.
      1.  Add a NAS Port Type: Ethernet policy.
      2.  Use Microsoft: Smart Card or other certificate as the authentication method and make sure the correct root CA certificate is selected.
8. Configure the zero client:
   1. On the zero client Administrative Web Interface (AWI), enable the 802.1X checkbox.
   2. Upload the root CA and client certificate to the zero client.
   3. Set the identity string of the zero client to Subject Alternative Name of the client certificate (e.g. "teralab@8021x.testnetwork.com").
9. Connect the network together and the zero client should successfully authenticate.

 Troubleshooting Tips

1. Make sure there are RADIUS packets going back and forth between the 802.1X switch and the authentication server
   1. This can be done by installing Wireshark on the authentication server and making sure the RADIUS packets are being sent between the switch and server.
   2. If we only see RADIUS packets from the switch going to the server, we need to make sure the configured IP addresses are correct and the Shared Secret is set to the same value.
2. To debug an authentication issue, we can use Wireshark to capture the 802.1X packets between the client and switch.  This can be done with the use of a hub (not a switch or router) or with a "port mirroring" feature on the switch.
   1. When viewing the captured packets, we will be able to tell which step the authentication is failing at and whether it is the zero client or authentication server that has initiated the failure packet.

References

http://www.jadota.com/2010/11/setting-up-wireless-802-1x-with-windows-server-2008-and-nps/

http://www.jadota.com/2010/11/setting-up-wireless-802-1x-with-windows-server-2008-and-nps