User Guide for Cisco Secure Access Control Server - Stewing Home

Windows User Database
12-14
User Guide for Cisco Secure Access Control Server 4.2
Chapter 12 User Databases
2. Ensure that the certification authority (CA) certificate of the CA that issued the ACS server
certificate is stored in machine storage on client computers. User storage is not available during
machine authentication; therefore, if the CA certificate is in user storage, machine authentication
fails.
3. Select the wireless network:
– In Windows XP, you can choose Windows Network Connection > Properties > Network
Connection Properties.
– In Windows 2000, you can manually enter the Service Set Identifier (SSID) of the wireless
network. Use the Advanced tab of the properties dialog box for the wireless network adapter.
4. To enable PEAP machine authentication, configure the Authentication tab. In Windows XP, the
Authentication tab is available from the properties of the wireless network. In Windows 2000, it is
available from the properties of the wireless network connection. To configure the Authentication
tab:
a. Check the Enable network access control using IEEE 802.1X check box.
b. Check the Authenticate as computer when computer information is available check box.
c. From the EAP type list, select Protected EAP (PEAP).
d. On the Protected EAP Properties dialog box, you can enforce that ACS has a valid server
certificate by checking the Validate server certificate check box. If you do check this check
box, you must also select the applicable Trusted Root Certification Authorities.
e. Also open the PEAP properties dialog box, from the Select Authentication Method list, select
Secured password (EAP-MS-CHAP v2).
5. To enable EAP-TLS machine authentication, configure the Authentication tab. In Windows XP, the
Authentication tab is available from the properties of the wireless network. In Windows 2000, it is
available from the properties of the wireless network connection.
a. Check the Enable network access control using IEEE 802.1X check box.
b. Check the Authenticate as computer when computer information is available check box.
c. From the EAP type list, select Smart Card or other Certificate.
d. On the Smart Card or other Certificate Properties dialog box, select the Use a certificate on
this computer option.
e. Also on the Smart Card or other Certificate Properties dialog box, you can enforce that ACS
has a valid server certificate by checking the Validate server certificate check box. If you
check this check box, you must also select the applicable Trusted Root Certification Authorities.
If you have a Microsoft certification authority server that is configured on the domain controller, you
can configure a policy in Active Directory to produce a client certificate automatically when a computer
is added to the domain. For more information, see the Microsoft Knowledge Base Article 313407, HOW
TO: Create Automatic Certificate Requests with Group Policy in Windows.
OL-14386-02