How to access Wi-Fi automatically after set up Radius Server
-
Wednesday, August 29, 2012 8:19 AM
hi,all
i set up Radius Server, i wanna Windows 7 client connect Wi-Fi automatically with users certificate. i followed the instruction as below. is there anything else should i do after set up it
pls help. thank you.
http://www.windowsnetworking.com/articles_tutorials/Setting-up-Wi-Fi-Authentication-Windows-Server-2008-Part2.html
All Replies
-
Wednesday, August 29, 2012 1:59 PM
To setup 802.1x certificate based wireless access is somewhat complex. Maybe you can tell us where you are having problems if it;s not working. Error messages would be helpful, as well as what the operating system version and service pack level of the server that you used to install certificate services, as well as if you created a certificate from a v2 template, set the permissions correctly, and if you setup a GPO for autoenrollment.
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/This post is provided AS-IS with no warranties or guarantees and confers no rights.
-
Thursday, August 30, 2012 2:22 AM
Thank you Ace
i used to work in a company. their network infrastructure like this--they used Windows 7 for client and connected wireless automatically without any password when user log on,i learned that there's user certificate from Radius Server works.
i have already added certifcate services and NAP services in a Server 2008.i just wanna know how to set the permissions or user certificate so that user can connect wireless without any prompt.Plus, can you show me how to deploy this with Group Policy
thank you very much
-
Thursday, August 30, 2012 2:45 AM
Hi Anthony,
Setting this up is a very length procedure. The last time I did it, it took me 3 weeks in between other tasks and assistance from Cisco to configure an AP 1231.
Whatever AP you are using, it must support 802.1x wireless.
I see you have Windows 2008. You didn't state the Edition, but you MUST install Certificate Services on a Windows 2008 Enterprise Edition because that is what provides the ability to create a v2 certificate from a v2 Certificate Template. Standard does not have this feature. Windows 2008 R2 Standard does, but without web-enrollment, but we usually simply opt to use the Enterprise Edition.
And when you create the template, choose WIndows 2003 compatible, not 2008, or it won't work.
.
Here are some links. I hope you find them helpful.
Configure RRAS and Radius to work with WIFI wireless certs
The following are non-Microsoft links that provide screenshots and explanations. Note: Since the web sites are not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
Setting up Wi-Fi Authentication in Windows Server 2008 (Part 1)
http://www.windowsnetworking.com/articles_tutorials/Setting-up-Wi-Fi-Authentication-Windows-Server-2008-Part1.htmlSetting up Wi-Fi Authentication in Windows Server 2008 (Part 2)
http://www.windowsnetworking.com/articles_tutorials/Setting-up-Wi-Fi-Authentication-Windows-Server-2008-Part2.html
The passage below was quoted from:
http://social.technet.microsoft.com/Forums/en/winserverNIS/thread/f6382dfc-7f6e-4b0b-9098-281ce82758ad
Extensible Authentication Protocol (EAP) extends Point-to-Point Protocol (PPP) by enabling additional authentication methods that use credential and information exchanges of arbitrary lengths. With EAP authentication, both the network access client and the authenticator (such as the NPS server) must support the same EAP type for successful authentication to occur. However, PEAP-MS-CHAP v2 is easier to deploy than EAP-TLS because user authentication is performed by using password-based credentials (user name and password), instead of certificates or smart cards. Only NPS or other RADIUS servers are required to have a certificate. The NPS server certificate is used by the NPS server during the authentication process to prove its identity to PEAP clients.
For more information, please also read the following Microsoft TechNet articles:802.1X Authenticated Wireless Access
http://technet.microsoft.com/en-us/library/cc771455(WS.10).aspxIntegrating Wireless Access Points with RADIUS and AD.
http://www.hansenonline.net/Networking/wlanradius.htmlAD CS Step-By-Step Guide (about setting up a CA with wireless and autoenrollment):
http://www.microsoft.com/DOWNLOADS/details.aspx?familyid=44315BFF-B744-4637-A66B-E69B4955EE45&displaylang=enGood discussion on wireless 802.1x and Cisco APs:
Thread - Moving Certificate Services
http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/227591ef-ae8b-4eb3-8450-d626b59eb8acGood discussion on wireless 802.1x and Cisco APs:
Thread - Configuring NPS for AD authentication on a Cisco router? 3/10/2012
http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/bf5634bd-c3ca-4c19-9622-9238e5ef8e2f/Cisco IOS - fu#7 - Cisco + RADIUS + Windows Server 2008 NPS
http://www.darylhunter.me/blog/2010/06/cisco-ios-fu-7-cisco-radius-windows-server-2008-nps.html.
.
And sorry not able to post a complete step by step on how to set it up, but it is a VERY LENGTHY procedure with numerous tasks involved, and each AP is different. I usually recommend to purchase a Cisco AP or compatible competitive name brand and model that supports 802.1x. If you purchase a Cisco device, make sure you get a 24x7 Gold support contract, because Cisco support will actually step you through the procedure step by step, even on the Windows side, to an extent.
Read the info above, look at the Microsoft step by step guide. THis will give you a feel for it, then set up what you can, and test it. Let us know how far you get and where it failed.
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/This post is provided AS-IS with no warranties or guarantees and confers no rights.
-
Thursday, August 30, 2012 6:39 AM
Hey,Ace
Thank you so much, that's really helpful to me. BTW, do u have any instructions about deploying them with Group Policy
Thanks again
-
Friday, August 31, 2012 2:30 AMModerator
Hi Anthony,
BTW, do u have any instructions about deploying them with Group PolicyAce Fekay posted Guide (802.1X Authenticated Wireless Access) already covered instruction about Wireless Network (IEEE 802.11) Policies.
http://technet.microsoft.com/en-us/library/dd283034(WS.10).aspx
Regards,
Rick Tan
TechNet Community Support
- Proposed As Answer by Ace Fekay [MCT]MVP Friday, August 31, 2012 2:35 AM
- Unproposed As Answer by Anthony Fu Wednesday, September 05, 2012 1:01 PM
-
Friday, August 31, 2012 2:40 AM
Anthony,
In addition, look at the link that I previously posted above that has the word "Autoenrollment" in it. That's what you will be configuring to give out certificates in a GPO. And don't forget, it must be a version 2 Windows 2003 certificate. I keep reiterating v2, because it won't work with any other type. Please re-read that part so you understand.
.
More info:
Good discussion with links for how-to
Technet thread: "Help/How to - Setting up Certificate servers on a Domain." 3/26/2012
http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/8f0a4abf-a3e4-4966-9965-1711a55f2e4f/If you want to configure a GPO Autoenrollment and 802.1x (for wireless), you must use Windows Enterprise Edition, not Windows Standard Edition, because Enterprise provides v2 certs. The only exception is Windows 2008 R2 Standard, which provides v2, but it does not allow you to use web enrollment.
.
Here are some articles on how to set up Microsoft CA's and deploy certificates to users.
.
Core Network Guides for Windows Server 2008 R2, Updated: August 5, 2010
The following guides are featured on this page:
Windows Server 2008 R2 Core Network Guide
Core Network Companion Guide: Deploying Server Certificates
Core Network Companion Guide: Deploying Computer and User Certificates
Core Network Companion Guide: Deploying Password-based 802.1X Authenticated Wireless Access
http://technet.microsoft.com/en-us/library/dd894464(WS.10).aspx.
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/This post is provided AS-IS with no warranties or guarantees and confers no rights.
-
Friday, August 31, 2012 3:51 AM
Thank u Ace
I got it, i'll read it carefully.
BTW, my server is running Windows Server 2008 Enterprise Edition,i'll check it if there is v2 certificate in it
Thank you very much
-
Friday, August 31, 2012 5:52 AM
Thank u Ace
I got it, i'll read it carefully.
BTW, my server is running Windows Server 2008 Enterprise Edition,i'll check it if there is v2 certificate in it
Thank you very much
You are welcome.
And I'm not sure what you mean by if there is a v2 certificate "in it." What I mean is you must install Certificate Services" on an Enterprise edition. When it's on a 2008 Enterprise Edition, you now have the ability to create a v2 certificate from a V2 Certificate Template in certificate server console.
When you do, choose the "Windows 2003" version.
As you read up on it, it will make more sense.
.
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/This post is provided AS-IS with no warranties or guarantees and confers no rights.
-
Monday, September 03, 2012 3:51 AM
Hello Ace,
How about weekend~
I still have some problems about "you now have the ability to create a v2 certificate from a V2 Certificate Template " I installed Certificate Services and added a personal certificates as below pics, but i could't figure out v2 certificate from a v2 Certificate Template, i could't find "Windows 2003" version.
Thank you
Anthony
-
Monday, September 03, 2012 4:37 AMIs the issuing CA on WIndows 2008 Enterprise edition?
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/This post is provided AS-IS with no warranties or guarantees and confers no rights.
-
Monday, September 03, 2012 4:57 AM
See if this helps:
Adding the Certificate Templates to the Certification Authority
http://www.spywarepoint.com/adding-certificate-templates-certification-authority-t38775.htmlAce Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/This post is provided AS-IS with no warranties or guarantees and confers no rights.
-
Monday, September 03, 2012 4:59 AM
Yes
i'm trying to find "create a v2 certificate from a V2 Certificate Template" you ever told me, but i don't know where is and how could i create it
-
Monday, September 03, 2012 8:18 AM
Sorry, Ace
I'm afraid i couldn't find the answer from the above website.
I noticed that Certificate Templates had a tab named Minimum Supported CAs, it had some Windows Server 2003 options under it. I'm not sure if there has connections with v2 certificate from a v2 certificate template
Thank you
Anthony
-
Monday, September 03, 2012 3:12 PM
I think you're going about it wrong. Try this:
.
.
Call it Wireless User Auth:
.
Then configure it for Autoenrollment (this way it's ready for the GPO that you will create to automatically distribute the certificates through Autoenrollment):
.
And more. Follow the steps at:
Designing and Implementing a PKI: Part III Certificate Templates
http://blogs.technet.com/b/askds/archive/2010/05/27/designing-and-implementing-a-pki-part-iii-certificate-templates.aspx.
Then you can repeat it to create a Computer certificate, if you decide to use machine authentication, too.
.
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/This post is provided AS-IS with no warranties or guarantees and confers no rights.
-
Wednesday, September 05, 2012 7:55 AM
Thank you Ace
I read the website"Designing and Implementing a PKI", it's very helpful for me.
i did follow actions
a.Created user certificate template in Certificate Template, configured General tab, request handling tab security tab about it.
b.Added the certificate template i configured in Certification Authority.
c.Set Certificate Services Client - Auto-Enrollment to enable in Default Domain Policy--User Configuration--Policies--Windows Settings--Security Setting--Public Key Policies
d.Updated Group Policy
I'm not sure whether 4 steps from above can apply the certificate to Default Domain Policy or not, and then how can i deploy this policy to client
Thank you
Anthony
-
Wednesday, September 05, 2012 10:16 AMWe should never touch the default Domain GPO. Create a separate, new GPO for this purpose. One of the links I posted earlier shows how to configure an Autoenrollment GPO.
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/This post is provided AS-IS with no warranties or guarantees and confers no rights.
-
Wednesday, September 05, 2012 1:27 PM
Thank you Ace
I noticed that one of the links as below is about how to configure an autoenrollment Gpo
I wanna ask that after I configure user certificate autoenrollment in GPO, how can i autoenrollment this GPO to client. After finishing that, how can i check whether the client apply this GPO rightly or not.
Thank you very much
Anthony
-
Thursday, September 06, 2012 3:06 AM
Thank you Ace
I noticed that one of the links as below is about how to configure an autoenrollment Gpo
I wanna ask that after I configure user certificate autoenrollment in GPO, how can i autoenrollment this GPO to client. After finishing that, how can i check whether the client apply this GPO rightly or not.
Thank you very much
Anthony
> how can i autoenrollment this GPO to client
Click on the link in the picture, "Configure Computer Certificate Autoenrollment." It should have the directions to configure Autoenrollment settings in a GPO.
.
> how can i check whether the client apply this GPO rightly or not
On the client, run gpresult /R to see if the client got the GPO applied.
Then create an MMC (start, type in mmc, enter), then add the Certificates snap-in, choose This Computer, then expand Personal. You should see the cert in there, if the GPO was configured properly, and GPOs are applying to the machines.
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/This post is provided AS-IS with no warranties or guarantees and confers no rights.
-
Tuesday, September 11, 2012 6:49 AM
Thank you Ace
I can see the cert under Certificates(Local Computer) on my client MMC, but i can not see any user cert under Certificates-Current User
I configured it according to the link in the picture, "Configure User Certificate Autoenrollment", but it still not working.
I suspected that there's something wrong with my GPO, Here is picture about my Group Policy Management, can you tell me which wrong is it.
BTW, i can see administrator cert under Certificates -Current User in Server
Thank you very much
Anthony
-
Friday, September 14, 2012 2:24 AMModerator
Hi Anthony,
1. User certificate autoenrollment requires three steps, please double check autoenroll permission on the certificate templates
http://technet.microsoft.com/en-us/library/dd379539(WS.10).aspx
2. Run rsop.msc on your client to verify if the GPO is applied successful
3. Other idea is to manual click task--request new certificate via MMC console. You will see the user certificate template if you have correct permission in the wizard
4. Try to enable GP Certificate Services Client - Certificate Enrollment Policy. Here is a thread which user resolve the issue in this way.
http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/38499c50-d706-4afc-a8b7-4d9bcd614bfbGood Luck!
Regards
Rick Tan
TechNet Community Support
-
Friday, September 14, 2012 3:17 AM
Hi Anthony,
Sorry for the late reply. I am on the road this week and quite busy. I am glad Rick was able to jump in.
In addition, I would also suggest that you make sure the Autoenroll is checked in the certificate permissions. Look at my previous screenshot. Highlight Authenticated Users, and make sure Autoenroll is checked.
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/This post is provided AS-IS with no warranties or guarantees and confers no rights.
-
Friday, September 14, 2012 8:12 AM
Hi Rick,
Thank you for you reply
I configured it according to the follow website you gived me
http://technet.microsoft.com/en-us/library/dd379539(WS.10).aspx
But when i ran step there--Configure an enterprise CA, there is somthing wrong about it, i couldn't fould Certificate Template to Issue option under the Certificate Templates
Here is the picture about this issue. How can i fix it.
Thank you
Anthony
-
Friday, September 14, 2012 8:35 AMModerator
Hi Anthony,
The previous article have already guided it.
http://blogs.technet.com/b/askds/archive/2010/05/27/designing-and-implementing-a-pki-part-iii-certificate-templates.aspxRegards
Rick Tan
TechNet Community Support
-
Monday, September 17, 2012 6:56 AM
Hi Rick
Thanks for you reply
I found Certificate Template to Issue option and selected certificate template which i wanna enrollment
After that, i run rosp.msc on the client, and there's Resultant Set of Policy pop up, but i still counld't see any user certificate under the Certificates-Current User--Personal--Certificates. how can i figure out it works or not
Thank you
Anthony
-
Monday, September 17, 2012 7:29 AMModerator
-
Monday, September 17, 2012 8:02 AM
Hi Rick
How can i check if autoenrollment policy enabled in resultant set of policy?
User comfiguration--security settings--public key policies--certificate services client-auto-enrollment?
Anthony
-
Monday, September 17, 2012 10:35 PM
Hi Rick
How can i check if autoenrollment policy enabled in resultant set of policy?
User comfiguration--security settings--public key policies--certificate services client-auto-enrollment?
Anthony
You should see the GPO show up in the list of GPOs when you run the RSOP. You can simply run gpresult /R to see the list of GPOs on the client, too. Also check the Computer certificate section in the Certificates snap-in on the client machine.
.
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/This post is provided AS-IS with no warranties or guarantees and confers no rights.
-
Wednesday, September 19, 2012 6:31 AM
Hi Ace
I can get certificates under the Computer certificate section
-
Wednesday, September 19, 2012 6:44 AM
Hi Ace,
I ran gpresult /r on the client, but i suspected that there's something wrong with GPO
Here are two pics about Gpresult /r and Group Policy Management, pls help me point out mistakes
Thank you
Anthony
-
Wednesday, September 19, 2012 3:55 PM
Why isn't the Default Dpomain Policy being applied? Please click on Enforce for the Default Domain Policy, then re-run gpupdate.
I still think it's something in the GPO for the cert.
But your machine is getting a cert, which is a good thing, but not the user. On the properties of the certificate template, I assume you selected the AD Group that you are allowing to obtain a certificated, and the user account, John Lennon is in the group?
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/This post is provided AS-IS with no warranties or guarantees and confers no rights.
-
Thursday, September 20, 2012 3:31 AM
Hi
I enforced the Default Domain Policy and re-run it
Here are two pics about certificate template and Group Policy management
Thank you
Anthony
-
Thursday, September 20, 2012 3:44 AM
Your GPMC shows the cert GPO is the "For All Users" GPO. Correct?
But the gpresult /R you ran shows the "For All Users" GPO is not being applied, and is Denied (Security):
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/This post is provided AS-IS with no warranties or guarantees and confers no rights.
-
Thursday, September 20, 2012 5:50 AM
Yes, For All User is Certificate GPO
I realized that For All User is not being applied, but this GPO's setting is same as For Administrator except Security Filtering, i have no idea why
This pic is result of gpresult /r up to date
Thank you
Anthony
-
Friday, September 21, 2012 2:34 AMModerator
Hi Anthony,
In your For All user policy security filtering list Certificate group.
Please verify the user account is the member of Certificate group or use Authenticated users group instead.By default, the policy security filtering set to Authenticated users group which include domain computers and users.
If the policy is computer based policy, set the security filtering to computer group.
If the policy is user based policy, set the security filtering to computer group.Regards
Rick Tan
TechNet Community Support
-
Friday, September 21, 2012 7:13 AM
Hi Rick
Thank you for your reply
I added Authenticated Users in For All User policy Security Filtering list, but it still have no user certificate on the client
I ran gpresult /r on client, and the result show that For All Users GPO was applied
Thank you
Anthony
- Edited by Anthony Fu Friday, September 21, 2012 7:16 AM
-
Monday, September 24, 2012 11:55 PM
You're doing something fundamentally wrong. For starters, see if this helps. I have a 170 page document on how I did it in the past, however, it took me weeks to perfect it, and I got Cisco Support to assist me with it, but I did most of the work on my own from researching Microsoft's Technet documentation, because believe it or not, you will find all the step by steps in Microsoft's Technet articles, and from the documentation that I posted, as well as Rick. I assume you've been reading through the documentation, instead of just trying this or trying that from our suggestions?
I suggest if this is for a company solution, the best bet, and I *assume* you're using a Cisco AP, to get Cisco involved, because they will help you from start to finish.
In the meantime, I will be putting together a multi-part blog from my documentation. However, until I'm ready to publish it, because remember, it will take me time because it's about 170 pages, and I'm doing this in my spare time from work (I am a trainer and a consultant, and no, I do not work for Microsoft).
For starters, see if this portion helps. I couldn't post the associated screenshots due to the vast number of them. This is only part of it. But as I said, if you have a Cisco unit and a support contract, Cisco will assist you with it. If not, you will need to research some of this stuff on your own, because each device is different.
.
Late Edit:
I created a multi-part, Parts 1 to 9, blog post on how to do this from start to finish. Here's Part 1. You'll see links on the bottom for the remaining 8 parts. Let me know if it doesn't populate.
802.1x Wireless Implementation: Part 1 – Setting up an Offline CA Root
http://blogs.msmvps.com/acefekay/2012/09/25/802-1x-wireless-implementation-part-1-setting-up-an-offline-ca-root/
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/This post is provided AS-IS with no warranties or guarantees and confers no rights.
- Edited by Ace Fekay [MCT]MVP Tuesday, September 25, 2012 5:41 AM

