Unable to find EAP config settings

[tobycouchman]

Hi,

I'm struggling to find the settings that relate to the EAP authentication method.

Am I able to configure the following settings in the DPC configs:

EAP Method
SimpleCertSelection
ClientAuthEKUList
AnypurposeEKUList

Thanks
Toby

[ld0614]

Hey,

DPC was designed with an opinionated approach to EAP Config, effectively it generates the EAP Config dynamically based on the settings presented to it. These settings assume that your using certificate based authentication with optional EKU Mapping.

When using the default (required) settings, EapMethod is always 13 and simpleCertSelection is always true. EKU Settings are configured through the setting 'Limit the User Certificate EKU'.

If these EAP settings don't meet your requirements I'd be very interested to understand how the settings you would want differ and the reasons for this. I'm generally open to implementing more settings to enable additional functionality, I generally don't enable options that actively degrade security, for example, I'm never going to enable CHAPv2 support as this in fundamentally insure when compared to certificate based auth.

[tobycouchman]

Thanks for the speedy response.

I enabled the debug path setting and in the resulting XML file I found that EapCommon is set to Type 25 instead of 13.

What settings can we enable that will change the EAP type to 13?

[ld0614]

DPC doesn't currently allow you to select the EAP Type. It currently assumes that you wish to use PEAP with an inner EAP of EAP-TLS.

According to people that I've spoken to (and summarised by Wikipedia here

PEAP-EAP-TLS is very similar in operation to the original EAP-TLS but provides slightly more protection because portions of the client certificate that are unencrypted in EAP-TLS are encrypted in PEAP-EAP-TLS.

Ultimately if a good reason can be defined to enable EAP-TLS only rather than PEAP-EAP-TLS its possible to change the profile generation. However when speaking to others previously with the same query they all just upgraded to PEAP-EAP-TLS.

[DHaimann]

We have exactly the same problem. In our profile the line is
<Type xmlns="http://www.microsoft.com/provisioning/EapCommon">13</Type>
AlwaysOn VPN configured the Authentication Type is EAP <Microsoft: Geschütztes EAP (PEAP)> instead of Authentication Type = EAP <Microsoft: Smartcard- oder anderes Zertifikat (EAP-TLS)>
How to fix this?

[richardhicks]

This is expected and by design. EAP type 25 is the outer EAP method (PEAP). The inner EAP method is EAP-TLS, which is type 13. You can't configure EAP type 25 inside EAP type 25. That would be PEAP inside of PEAP. You'd still need an inner method at some point, which ideally would be EAP-TLS. ;)

[richardhicks]

To add to this discussion, the security best practice is to use Protected EAP on untrusted networks. For that reason, the decision was made to have DPC follow that best practice and use PEAP with EAP-TLS (client certificate authentication). I can't imagine why you would need/want to downgrade security for such a critical workload. I'd be very interested in understanding the use case for this, though. Perhaps it's something we've not considered. Let us know!

[DHaimann]

The (working) settings we deploy with ConfigMgr at the moment have the value of 13 and everything works like a charm.

[richardhicks]

Got it. I'd recommend migrating to PEAP-EAP-TLS when switching to DPC in that case. No changes are required on the backend infrastructure. I'm curious, did you try using PEAP as configured by default with DPC?

[DHaimann]

Yes, I tried but I get the error 812.

[DHaimann]

We need this config: Certificate located on computer, simple certificate selection. However, I do not get this exact config with DPC for some reason. Any ideas?

[richardhicks]

When you tried changing to PEAP, did you also configure EAP-TLS as the inner authentication method? If you select PEAP from the EAP drop-down list and then click 'Properties' you'll need to define the EAP-TLS settings there as well. You would use the same settings as you did using just EAP-TLS natively.

[DHaimann]

Yes. Of course, I did. Exact the same settings. I try to chat with my networking colleague who manages our ISE. I fear PEAP is not allowed. Only EAP-TLS is allowed for authentication.

[richardhicks]

Ok, good to know. That technique works perfectly with NPS. I guess ISE handles it differently. :/

At this point, @ld0614 will have to decide if implementing EAP-TLS as an option in DPC is feasible. I have no idea what it would take from a programming perspective. Hopefully it isn't too difficult.

[richardhicks]

Also, I stand corrected. NPS must also support EAP-TLS explicitly. In my testing I switched from PEAP to EAP-TLS and it worked without issue. I failed to realize the policy I was using indeed supported both protocols. So, in your environment, you'd need to have your ISE administrators enable PEAP support. If that's not possible, then hopefully DPC will be updated to support EAP-TLS natively.