Description

This article provides information on how to configure Windows Server 2003 and a Wireless Juniper device (MX) to authenticate a MAC user.

Symptoms

How to configure Windows Server 2003 and a Wireless Juniper device (MX) to authenticate a MAC user.

Solution

Windows Server 2003 configuration :
 
  1. Make sure that AD (Active Directory Users and Computers) and IAS (Internet Authentication Service) are installed on Windows Server 2003.
  2. Configure a MAC user in Active Directory.
    1. Open AD and select the 'create user' icon.
    2. Enter a  First name (i.e. user1)
    3. In the User logon name , enter the user MAC address into the left window (separated by hyphens i.e 00-00-00-00-46-94) and the domain name in the right window (i.e. @host1.example.com).
    4. Click Next
    5. Enter a password (default password on WLC/MX is trapeze )
    6. Click Next , and then Finish
  3. Right-click on the new user and select  Properties > Dial-in ; and then select  Allow access :

IAS configuration :
  1. Start IAS :
    alt
  2. The RADIUS client is the WLC or MX device. Right click Radius Clients and select New RADIUS Client :
    alt
  3. Enter a device name and set the IP address of the access device; and then click  Next.
  4. Select Radius Standard from the Client-Vendor drop-down menu, type the Radius secret (it must be the same password that was configured on the WLC device), and then click Finish
  5.  
Add  the remote access policies :

Now, create a remote access policy to authenticate and authorize the users:
  1. Right-click Remote Access Policies and click New Remote Access Policy
  2. Click Next   and enter a name for the policy.  Click Next
  3. Select  Wireless  and then click Next
  4. Grant access for either the required User or Group (i.e. in this example, select Group; the user configured earlier is a member of a domain). Click Next :
  5. For the Authentication Methods type, select Protected EAP (PEAP) authentication.  Click Configure , if you want to select a different certificate or change the EAP type. Click Next  and then Finish
  6. After the remote access policy is created, click it and select Properties , and then click Edit Profile to proceed.

    alt
  7. Click the Authentication tab and select the Unencrypted authentication (PAP, SPAP) check box:

    alt


Configuration on  the  MX device :

Via the CLI :

For example:
MX# set service-profile router ssid-name USER-MAC
MX# set service-profile router ssid-type clear
MX# set service-profile router wpa-ie auth-dot1x disable
MX# set service-profile router rsn-ie auth-dot1x disable
MX# set service-profile router attr vlan-name vlanname

MX# set radius mac-addr-format hyphens
MX# set radius server radiusserver address 172.31.203.104 deadtime key secret
MX# set server group radiusserver-group members radiusserver
MX# set authentication mac ssid USER-MAC * radiusserver-group

Modification History

2024-09-03: Minor non tech changes
2020-10-10: Archived article.
2020-02-21: minor non-technical edits