By Eric Geier (NoWiresSecurity Founder & Owner) - originally published on EnterpriseNetworkingPlanet

 

Implementing WPA2 Enterprise encryption with 802.1X authentication provides the best Wi-Fi security for businesses. However, as you may know, it isn't easy to setup and support. Nevertheless, you shouldn't let this stop you.

The Personal or Pre-Shared Key (PSK ) mode of WPA2 doesn't provide adequate security for businesses. Encryption keys are more vulnerable to cracking, static encryption keys are a problem when devices are lost or stolen, and employees can snoop on others or even hand out the encryption key to outsiders.

The Enterprise mode of WPA2 gives you dynamic encryption keys distributed securely after a user logins with their username and password or provides a valid digital certificate. Users never see the actual encryption keys and they aren't stored on the device. This protects you against rogue or terminated employees and lost or stolen devices. The list of reasons to use Enterprise mode goes on.

In this article, I'll discuss the issues related to deploying and using 802.1X. Best of all, I'll share some tips that can help you overcome them. Let's get started!

Expertise, time, and cost to set up a RADIUS server

Your first concern might be the expertise, time and cost involved in setting up the RADIUS server, required for the 802.1X authentication. This is especially true for smaller businesses that don't have a big IT staff or budget, or any at all. However, there are RADIUS servers that are user-friendly, fairly easy to setup, and won't break the bank. The Elektron RADIUS Server runs at $750, the ClearBox Enterprise RADIUS Server $599, and the TekRADIUS Server is free. Another free option is the open source FreeRADIUS server, great for experienced IT administrators.

You don't even have to setup your own server if you use a hosted RADIUS service. This is great for smaller businesses, or those that don't want to dedicate the time or money to setting up and maintain a server. Plus it doesn't require any real advanced technical knowledge.

Configuring computers and devices

As you may know, you can't just connect to an Enterprise-protected wireless network like you do with the Personal or PSK mode. The 802.1X authentication settings must be preconfigured in Windows, either by you or the end-user. This is complicated even more if end users bring their own laptops or mobile phones.

If you run a domain with Active Directory on a Windows Server, you may be able to push client settings to some end-users with GPO. The Netsh command-line tool can also help, even without a Domain network.

Keep in mind, there are third-party solutions you can use to create a wizard to help automate the client configuration process. The SU1X 802.1X Configuration Deployment Tool is a free and open source solution. Xpressconnect and Quick1X are commercial options. Once you create a configuration wizard, you might even look into creating a separate setup SSID with a captive portal that's unencrypted just so users can download the wizard, which would then configure and connect them to the Enterprise-protected SSID.

There are also solutions to help configure mobile phones. Apple, for example, offers the iPhone Configuration Utility (iPCU) to push 802.1X and other settings to iPhones, iPod Touches, and iPads.

Creating and maintaining a PKI for digital certificates

If you're setting up your RADIUS server, another concern you might have is creating and maintaining a Public Key Infrastructure (PKI ) and certificate authority (CA) for issuing the digital certificates required by the 802.1X authentication. However keep in mind, if you use the PEAP protocol for 802.1X only one digital certificate is required for the RADIUS server, rather than the server and all the clients with the EAP-TLS protocol.

Remember, if you use a hosted RADIUS/802.1X service, you don't have to worry about this at all.

To get the digital certificate for the RADIUS server you can create your own CA, which most RADIUS servers help you with. Then a client configuration wizard like the three I mentioned can help install the CA certificate to the computers and devices.

If you don't want to install the CA certificate on all the computers, you can pay to get a digital certificate signed by a public CA, like VeriSign or GoDaddy. Most RADIUS servers can also help you create a signing request to submit to the public CA in order to get the signed certificate for the RADIUS server. GoDaddy charges as little as $50 for a SSL certificate.

Man-in-the-middle attacks

WPA2 Enterprise is also vulnerable to some attacks. For example, someone could setup an AP with the same SSID and a modified RADIUS server in hopes of capturing and cracking the login credentials. However, you can help prevent this type of attack from being successful by ensuring you specify three optional settings in Windows, on the PEAP or Smart Card/Certificate window:

 

• Check the Validate server certificate option and select the Trusted Root Certificate Authority from the list.

• Check the Connect to these servers option and input the domain name or IP address of the RADIUS server.

• Check Do not prompt user to authorize new servers or trusted certificate authorities.
  Similar settings exist for most other operating systems and devices.

 

Also remember that you can apply these settings with a client configuration wizard like I mentioned earlier.