Security

Howdy,

We are currently running Windows 10 and using CPPM to perform 802.1X on our WIRED ports for both user and computer accounts. The access switch is a 6300M. Our Windows 10 clients are using EAP-PEAP, EAP-MSCHAPv2. 

In testing Windows 11 we have found that this no longer works and are forced to change to a more secure and modern method of EAP-TLS.

We have created a test service to only use EAP-TLS in CPPM and manually added the test Windows 11 machine to the policy and everything works as it should.

The challenge we are facing, and can't seem to find a solution, is how we can target this policy to only Windows 11 machines we are replacing as we don't want to change the Windows 10 machines. Was hoping to use an AD group attribute, but don't see that as an option. Does anyone have any ideas?

Thanks in advance

Use static host list to enlist all the Win11 machines MAC address and create separate policy based on EAP-TLS

Use Connection:Client-Mac-Address BELONGS_TO_GROUP [Static Host List group]

Thanks. Will consider this option.

Original Message:
Sent: Aug 03, 2023 09:07 PM
From: matchabear
Subject: CPPM: Migrate from EAP-MSCHAPv2 to EAP-TLS

Use static host list to enlist all the Win11 machines MAC address and create separate policy based on EAP-TLS

Use Connection:Client-Mac-Address BELONGS_TO_GROUP [Static Host List group]

Hi

As mentioned the static host list will for sure work, but the static hosts lists are mostly left in ClearPass due to backward compatibility. The user interface for the static host list is quite user unfriendly, in my opinion. The entries are added in cronological order and it's not possible to search in the list.

Why not have both EAP-PEAP and EAP-TLS in the same service? Eventually you need to modify the AD search query to search for both sAmAccountName and UPN, but if the only difference is the authentication method I would recommend having only one service.

The reason why you can't utilize an AD attribute is that the AD information is read after the actual authentication has taken place. You can also add a custom attribute to the Endpoints repository if you would like to have two services. Endpoints repository is searchable but depending on your administrative delegation of rights the static host list can be a better option if you need to delegate the right to add MAC addresses to a person who is not familiar with ClearPass and you would like to limit the damage they can do.

------------------------------
Best Regards
Jonas Hammarbäck
MVP 2023, ACCX #1335, ACX-Network Security, Aruba SME, ACMP, ACDP , ACEP, ACSA
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution
------------------------------

I will need to also change GPO options when switching to EAP-TLS. I didn't want to mess with anything the way it is now. Was hoping to have both operating in parallel.

Original Message:
Sent: Aug 04, 2023 02:31 AM
From: jonas.hammarback
Subject: CPPM: Migrate from EAP-MSCHAPv2 to EAP-TLS

Hi

As mentioned the static host list will for sure work, but the static hosts lists are mostly left in ClearPass due to backward compatibility. The user interface for the static host list is quite user unfriendly, in my opinion. The entries are added in cronological order and it's not possible to search in the list.

Why not have both EAP-PEAP and EAP-TLS in the same service? Eventually you need to modify the AD search query to search for both sAmAccountName and UPN, but if the only difference is the authentication method I would recommend having only one service.

The reason why you can't utilize an AD attribute is that the AD information is read after the actual authentication has taken place. You can also add a custom attribute to the Endpoints repository if you would like to have two services. Endpoints repository is searchable but depending on your administrative delegation of rights the static host list can be a better option if you need to delegate the right to add MAC addresses to a person who is not familiar with ClearPass and you would like to limit the damage they can do.

------------------------------
Best Regards
Jonas Hammarbäck
MVP 2023, ACCX #1335, ACX-Network Security, Aruba SME, ACMP, ACDP , ACEP, ACSA
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution
------------------------------

You can have EAP-TLS and EAP-PEAP in the same service in CPPM, so you can manually move PCs that you want to migrate to a parallel GPO that does (1) autoenrollement and (2) configures the wireless to use EAP-TLS.

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

HPE Design and Deploy Guides: https://community.arubanetworks.com/support/migrated-knowledge-base?attachments=&communitykey=dcc83c62-1a3a-4dd8-94dc-92968ea6fff1&pageindex=0&pagesize=12&search=&sort=most_recent&viewtype=card
------------------------------

Original Message:
Sent: Aug 08, 2023 02:01 PM
From: hhiggins
Subject: CPPM: Migrate from EAP-MSCHAPv2 to EAP-TLS

I will need to also change GPO options when switching to EAP-TLS. I didn't want to mess with anything the way it is now. Was hoping to have both operating in parallel.

Original Message:
Sent: Aug 04, 2023 02:31 AM
From: jonas.hammarback
Subject: CPPM: Migrate from EAP-MSCHAPv2 to EAP-TLS

Hi

As mentioned the static host list will for sure work, but the static hosts lists are mostly left in ClearPass due to backward compatibility. The user interface for the static host list is quite user unfriendly, in my opinion. The entries are added in cronological order and it's not possible to search in the list.

Why not have both EAP-PEAP and EAP-TLS in the same service? Eventually you need to modify the AD search query to search for both sAmAccountName and UPN, but if the only difference is the authentication method I would recommend having only one service.

The reason why you can't utilize an AD attribute is that the AD information is read after the actual authentication has taken place. You can also add a custom attribute to the Endpoints repository if you would like to have two services. Endpoints repository is searchable but depending on your administrative delegation of rights the static host list can be a better option if you need to delegate the right to add MAC addresses to a person who is not familiar with ClearPass and you would like to limit the damage they can do.

------------------------------
Best Regards
Jonas Hammarbäck
MVP 2023, ACCX #1335, ACX-Network Security, Aruba SME, ACMP, ACDP , ACEP, ACSA
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution

Probaby the username sent for a certificate authentication is the UPN or E-mail (depending on the certificate configuration). What you could do is create your EAP-TLS service just above the legacy service and in the service conditions add 'IETF:Username ENDS_WITH @yourdomain.local' (must match all). That just depends on the username being different, and users on windows 10 not signing in with their UPN, but it may work.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------

I think in Windows 11 Credential Guard is on by default.

This will break EAP-PEAP, EAP-MSCHAv2 authentication as CG doesn't allow for the NTLM credentials to be shared.

You can temporarily disable Credential Guard if you wish to but yourself time to get prepared for EAP-TLS. This can be done via Group Policy.

We are in the early stages of testing Windows 11 and discovered. We disabled CG to allow us to continue testing and begin planning migrating to EAP-TLS.

We also went through the process of disabling CG in out initial testing. 

Cheers

Original Message:
Sent: Aug 11, 2023 02:13 PM
From: th_son
Subject: CPPM: Migrate from EAP-MSCHAPv2 to EAP-TLS

I think in Windows 11 Credential Guard is on by default.

This will break EAP-PEAP, EAP-MSCHAv2 authentication as CG doesn't allow for the NTLM credentials to be shared.

You can temporarily disable Credential Guard if you wish to but yourself time to get prepared for EAP-TLS. This can be done via Group Policy.

We are in the early stages of testing Windows 11 and discovered. We disabled CG to allow us to continue testing and begin planning migrating to EAP-TLS.

Hi All,

I was able to add EAP-TLS to my existing service. I also adjusted my AD filter. Now both Win10 and Win11 and authenticating wired connections. 

Thanks!