Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Configure EAP-TEAP Authentication for a Windows Device

To secure your network, follow these steps to configure a client device for EAP-TEAP (Tunneled Extensible Authentication Protocol) authentication.

Tunneled Extensible Authentication Protocol (TEAP) is a tunnel-based EAP method that enables secure communication between a peer and a server by using the Transport Layer Security (TLS) protocol to establish a mutually authenticated tunnel. Within the tunnel, TLV objects are used to convey authentication-related data between the EAP peer and the EAP server. (RFC 7170 - Tunnel Extensible Authentication Protocol )

Note:

HPE Mist Networking Access Assurance supports EAP-TEAP with EAP-TLS as the authentication method for both machine and user authentication.

By default, Windows authenticates the machine at startup and does not automatically re-authenticate using user credentials after a user signs in. To enable automatic user authentication, configure Wireless 802.1X Single Sign-On (SSO)—either pre-logon or post-logon—in the Wi-Fi profile through a Group Policy, an MDM, or an XML profile. If SSO is not enabled, user authentication typically occurs only after the wireless connection is manually disconnected and then reconnected. See Single Sign-On profile sample.

Currently TEAP support is available for Windows 10 Version and above.

You can configure wireless and wired profile with TEAP manually or through scripts, which can be distributed using MDM or GPO. Current MDM solutions do not provide out-of-the box support for TEAP configuration.

To configure wireless EAP-TEAP on a Windows device:

  1. On your Windows device, navigate to Control Panel > Network and Internet > Network and Sharing Center. Then, click Set up a new connection or network.
  2. Select Manually connect to a wireless network and click Next.
    Network and Sharing Center displaying options for network setup. Highlighted option is Manually connect to a wireless network for connecting to hidden networks or creating new profiles.
  3. Enter the following details for the wireless network and click Next:

    • Network name—Provide an SSID name.

    • Security type—Select the WPA2-Enterprise or WPA3-Enterprise option.

    Windows interface for manually connecting to a wireless network. Prompts for network name, security type, encryption type, and security key with options to hide characters. Includes checkboxes for automatic connection and connecting to hidden networks. Next and Cancel buttons at the bottom.

  4. Click Change connection settings.
    Wireless network Campus-NET successfully added with options to change connection settings or close.

    The Wireless Network Properties dialog box appears.

  5. Select the Security tab and select TEAP under Choose a network authentication method. Then, click Settings.

    Campus-NET Wireless Network Properties Security tab showing WPA2-Enterprise security type, AES encryption, Tunnel EAP authentication, and a checked Remember credentials option.

  6. Select the following options in the TEAP Properties dialog box:
    • Identity privacy—The Identity is set to anonymous by default, but you can override it to the desired identity if necessary.
    • Connect to these servers—Enter auth.mist.com if you're using the default HPE Mist Networking Access Assurance server certificate. If you're using a custom RADIUS server certificate, provide the certificate SAN:DNS name.
    • Trusted Root Certification Authorities—Select the HPE Mist Org CA certificate (or your custom RADIUS server certificate).
    • Authentication Method—Select Microsoft: Smart Card or other certificate (EAP-TLS) as the Primary and Secondary EAP methods for authentication.

    TEAP Properties configuration window for authentication and certificate validation, including identity privacy, server certificate validation, EAP methods, and additional security options.

  7. Click Configure for both the primary and secondary EAP methods. In the Smart Card or other certificate Properties dialog box that appears for each:

    • Ensure that the Use simple certificate selection (Recommended) option is selected.

    • Select the trusted root Certificate Authority (CA) that enables the client to trust the HPE Mist Networking Access Assurance server certificate. Ensure that you select the same CA for both the primary and secondary EAP methods

    • Click OK.

    Smart Card or Certificate Properties dialog box for configuring certificate-based authentication, with options for certificate selection, server validation, and trusted authorities.

  8. In the Security tab of the Wireless Network Properties dialog box, click Advanced settings.
  9. In the Advanced settings dialog box:
    1. Select the Specify authentication mode check box and choose User or Computer authentication.
    2. Click OK and then click Close.
    Advanced settings window for configuring 802.1X and 802.11 network authentication, including authentication mode options, single sign-on settings, and OK and Cancel buttons.
  10. Verify the configuration:
    1. In the HPE Mist management portal, configure auth policy rules to permit EAP-TEAP client authentication. 
      User interface displaying authentication policies in a network system, titled Auth Policies. Includes policy names, match criteria, network access status, assigned policies, hit count, and active status indicators. Features options to add rules, create labels, assign labels, filter policies, save changes, and view NAC events.
    2. Add the CA certificate to enable HPE Mist Networking Access Assurance to trust client certificates issued by your added CAs. To add the certificate, navigate to the Organization > Access > Certificates> Add Certificate Authority page. For detailed steps about adding a CA certificate, see Use Certificate Authority (CA) Certificate.
    3. Connect the client device to the network.
    4. Click Show NAC Events on the Auth Policies page and verify the NAC Client authentication events.

      You can also view the NAC Client authentication events by selecting the NAC Client on the Insights page (Monitor>Service Levels>Insights).

      The following example shows a client that authenticated through EAP-TEAP using only the machine certificate.

      Network access control events log showing authentication details, event categories Good, Neutral, Bad, filters, search options, and summary of 100 events.

      The following example shows a client that authenticated through EAP-TEAP after user logon, with successful validation of both machine and user certificates.

      NAC events log showing authentication details for a user or device, including timestamps, statuses, hostname, authentication type, certificate info, roles, and site.

Related Documentation