802.1x wireless authenticaiton against RADIUS authenticator

Question

Hi all,
Would like to check out some client side setting on Wireless 802.1x authenticaiton.
Network setup is using
- Cisco WLC 7.2 and AP3500,
- ACS 5.3
- Microsoft Windows server 2008 hosting AD and CA services (same machine)
- Client OS is Microsoft Window 7.
Authentication mehtod would use PEAP-MSChap V2 Combo.
My question :
01. In AD environment, should ACS 5.3 be part of the domain computer?
02. To have secure connectivity, IF the security policy force client to check "Validate server certificate", which certificate it is look for? Is it ACS's identity certifate, that require CA server to sign on the CSR?
03. Back to client side, should the client also need to import this certificate in trusted root certification authorities?
Or the client will trust ACS identity certificate against the root CA certificate store at client's trusted root certification authorities, where they have the identical issuer?
04. Extra question: If no CA environment, would it be sufficient simply export ACS self-signed certificate and import to client computer, and it's trusted?
Thanks
Noel

Answer 1

Hello Noel-
Please find my answers below:
01. In AD environment, should ACS 5.3 be part of the domain computer?
You should not have to make any changes to the ACS machine once you join it to your domain. You need to ensure that the account that you use to join it to the domain has the proper permissions. For more info on that you can check this link:
http://www.cisco.com/en/US/products/ps9911/products_configuration_example09186a0080bc6506.shtml
02. To have secure connectivity, IF the security policy force client to check "Validate server certificate", which certificate it is look for? Is it ACS's identity certifate, that require CA server to sign on the CSR?
Yes, if you want the connection to be secured/encrypted you will need to use a certificate. The certificate can be either a public/paid one. The important part is for that certificate to be pushed to all of the end workstations. This can usually be done via GPO
03. Back to client side, should the client also need to import this certificate in trusted root certification authorities?
Or the client will trust ACS identity certificate against the root CA certificate store at client's trusted root certification authorities, where they have the identical issuer?
See above
04. Extra question: If no CA environment, would it be sufficient simply export ACS self-signed certificate and import to client computer, and it's trusted?
See above
Thank you for rating!