RADIUS Server that Forces User *and* Computer Authentication?

We wish to prevent a problem on our WLANs where a valid domain user
could gain access on a non-domain computer. The concern is that the
non-domain computer could have all kinds of viruses, etc., to
propagate.

If Microsoft IAS would authenticate both the user *and* the computer,
our problem would be solved, but it appears that IAS will not* do
this.

Is there a RADIUS server that *can* do this?

Thanks,

Jeff

 

Are you using PEAP? It isn't so much a RADIUS problem as it is PEAP version
0. PEAP version 2 will fix this.

Meanwhile, if you switch to using RADIUS for computer authentication and
rely on regular domain authentication for users, that's a good temporary
stance until PEAP v 2 reaches a useful draft stage and we can implement it
in the product. That's how we run our EAP-TLS on our corpnet.

Steve Riley

 

Maybe this can help?

http://www.microsoft.com/resources/...proddocs/en-us/sag_rap_quarantine_network.asp

--PA

 

Thanks Pavel; at first blush it looks interesting, so I'll check it
out in detail.

Jeff

 

Thanks Steve. Hmmmmm.......it sounds like, among other things, you're
saying PEAP-MSCHAPv2 is different than PEAP v2. However, since you
invited me to send you an e-mail on a semi-related subject, I think
I'll move both topics there.

Jeff