If you look at the "Step by step" document it also shows that you must configure the client-side environment. (You've performed everything up to page 27?).
(Note, I'm not sure what steps you've performed on the switch - but you need to configure it to use Radius and 802.1x of course)
You *can* use a manually configured client, but in my previous tests I found a got more consistent results (during boot of clients) in the test by configuring the client by using Group Policy Objects.
Create a Wired Policy using "Microsoft: Protected EAP" and customize it to your needs.
Here's one we are using;
| Security Settings |
| - Enable use of IEEE 802.1X authentication for network access Enabled |
| - Enforce use of IEEE 802.1X authentication for network access Disabled |
| |
| IEEE 802.1X Settings |
| - Cache user information for subsequent connections to this network Disabled |
| - Computer Authentication Computer only |
| - EAPOL Start Message Transmit per IEEE 802.1X |
| - Maximum Authentication Failures 2 |
| - Maximum EAPOL-Start Messages Sent 3 |
| - Held Period (seconds) 1 |
| - Start Period (seconds) 5 |
| - Authentication Period (seconds) 18 |
| |
| |
You need to set the correct certificate settings, which means you should select "Smart card or other certificate" as auth method within the "Protected EAP" properties.
Enable "Fast Reconnect" and "Quarantine Checks" in the same properties as well.
(PKI infrastructure, automatic user/computer certificate deployment is a "must", this goes without a further explanation).
For testing purposes you can turn of the "validate server certificate", but for production I recommend you keep it on.
The same goes for the Smartcard configuration.
Then add the required "System Services" startup mode;
* Network Access Protection = Automatic
* Wired Autoconfig = Automatic
* Background Intelligent Transfer Service = Automatic
(Not 100% sure that BITS need to be kickstarted like this, but we had issues in our lab test without it).
Lastly add the "Network Access Protection" configuration to the policy;
* EAP Quarantine Enforcement Client
After the policy is applied you might to a reboot then to check the clientside settings do the following;
netsh nap client>
show grouppolicy
A final recomendation is to enable the NPS Accounting logs, all the options - and start reading. :-)
Sincerly, Jon E. Carlsen
