Wireless Security.pdf - PDF Archive

570 Chapter 21
There are a number of ways you can register the IAS server:
●
●
●
The IAS snap-in
The Active Directory Users and Computers admin tool
The netsh command
NOTE
Perhaps the simplest way to register the IAS server is through the netsh command.
To do this, log on to the IAS server, open a command prompt, and type the
command netsh ras add registeredserver. If the IAS server is in a different domain, you
will have to add arguments to this command. For more information on registering
IAS servers, see Windows Help.
Once you have installed and, if necessary, registered the IAS server(s), you can configure
the Remote Access Policy . Before configuring a Remote Access Policy , make sure that
you apply the latest service pack and confirm that the IAS server has an X.509 computer
certificate. In addition, you should create an Active Directory Global or Universal Group
that contains your wireless users as members.
The Remote Access Policy will need to contain a condition for NAS-Port-Type that
contains values for Wireless-Other and Wireless-IEEE802.11 (these two values are
used as logical OR for this condition) and a condition for Windows-Groups[the group
created for wireless users]. Both conditions have to match (logical AND) for access to be
granted by the policy.
The Profi le of the Remote Access Policy will need to be configured to use the Extensible
Authentication Protocol , and the Smart Card or Other Certifi cate EAP type. Encryption
in the Profi le should be configured to force the strongest level of encryption, if supported
by the AP. Depending on the AP you are using, you might have to configure vendor
specific attributes (VSA) in the Advanced tab of the Profi le . If you have to configure a
VSA, you will need to contact the vendor of the AP to find out the value that should be
used, if you can’t find it in the documentation.
www.newnespress.com