Re: IEEE 802.1x & EAP-TLS design based on Windows 2000 Server

Hi Rodrigo,

I know your e-mail doesn't mention this, so maybe it's because you've 
chosen not to use/deploy PEAP, but using PEAP you would need only 
certificated for your IAS (radius) server(s) - to authenticate 
themselves with the WAP et al. Then if you deploy PEAP the client 
computers won't need certificates, but instead use windows domain 
accounts to authenticate against.

Running over Microsofts own documentation you should be able to host 
PEAP fine with the outlined Windows 2000 infrastructure you suggest; 
http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/ed80211.mspx

As for answering some other of your questions; No, you cannot use 
autoenrollment without Enterprise CAs as far as I know. When using stand 
alone CAs all you really get is web based enrollment for your Windows 
clients. From my point of view, I'd use PEAP in the spirit of 'least 
administrative effort'.

Regards,
r@smus

Rodrigo Blanco wrote:

> Hello list,
>
> I am currently facing an IEEE 802.1x deployment based on EAP-TLS. I
> have found tons of documentation for Windows 2003 environments (and
> with MS Certificate Services in Enterprise mode), but my environment
> is a little older (upgrade is unfortunately not an option):
>
> - Active Directory on Windows 2000 Server
> - MS IAS on Windows 2000 Server (regitered in and reading from the
> domain) as RADIUS server
> - MS Cert Services - Standalone Mode - on Windows 2000 Server
> - Windows XP Professional workstations as clients
> - IEEE 802.1x-enabled Cisco Switches
>
> My questions are:
>
> - Although the MS Certificate Services are in standalone mode, can I
> still configure some auto-enrollment based on the users' AD logon? If
> not, what is the best option in order to minimize administrative
> effort?
> - Since MS Certificate Services are in standalone mode, is it possible
> to have the IAS server map certificates to AD users, and based on
> these AD identities, apply different IAS remote access policies?
>
> If you could point me to any paper or step-by-step guide that can
> provide me with some insight on what the design options (and
> associated pros and cons) are for such an environment, I would also be
> more than grateful.
>
> Thanks in advance and best regards,
> Rodrigo.
>
> ---------------------------------------------------------------------------
> ---------------------------------------------------------------------------
>
>  


---------------------------------------------------------------------------
---------------------------------------------------------------------------