Guide to configuring eduroam using a Cisco wireless controller Best ...

Step 5: Network Policies
Remote Access Policies handle the local authentication and can for example grant different users
access to different networks: some to the guest network, some to VLAN 10, VLAN 12, etc.
• Right-click on “Network Policies” and click on “New”
• Choose descriptive names for policies, such as “Employees with Guest network”, “Students in
VLAN10”, etc.
• Click on “Next”
• “Conditions” are the criteria which determine whether a user shall use this policy or try the next.
• Click on “Add”
• The criteria which should be checked for each Network Policy are up to the system operators and
depend to a large extent on how allocation is to take place.
Some standard options may be:
“User Groups”, adding “Domain Users” and for example “Quarantine” or “WiFi VLAN 10” or other groups
from AD. NB: The AD groups must be created first!
• When the criteria have been specified, click on “Next”, select “Access granted” and click on “Next”
o Network Policies may also be created which deny access to users. For example, all users
belonging to the security group “Wireless Access Denied” will be assigned the criterion “Access
denied”. But remember: the policies are handled in a predetermined order and users will obtain
access to the first alternative which is appropriate. Hence it may be advisable to specify all
policies which use “Access denied” first.
• Click on “Add”, add “Microsoft: Protected EAP (PEAP)” and click on “OK”
• Ensure that “Microsoft Encrypted Authentication version 2 (MS-CHAP v2)” is ticked.
o The remainder of the selections are optional.
• Click on “Next”
• Note the NAS Port Type
• Select “Ethernet”, “Wireless – IEEE 802.11” and “Wireless – Other”
• Click on “Next”, then “Next” again, followed by “Finish”
Do this for each Network Policy that is needed.
53