<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
hi<br>
<br>
yes i know they have to authenticate two times. but in my case its not
so easy. we have more than 400 pc connected to the domain (wired), so
they will be authenticated transparently through the ISA. then a lot
they arent in the domain (also wired). they are only authenticating
against the ISA because they need only to surf the internet.<br>
now we need accesspoints. what would be the best way. we need also some
filtering service (websense) which is installed on the ISA. so the new
clients (wireless) have to surf through the ISA. so it isnt possible to
omit the ISA authentication. i would omit the chilli authentication.<br>
<br>
whats the best and secure way to authenticate my wirelessclients. they
will be MacOS, *nix, Windows2000/XP<br>
EAP-TTLS/mschapv2 ???<br>
<br>
if its too difficult i would leave out the ISA, so the would
authenticate only against the AD.<br>
<br>
thx<br>
<br>
<br>
<br>
Alan DeKok schrieb:
<blockquote cite="mid20060103154004.959351712C@mail.nitros9.org"
type="cite">
<pre wrap="">Konne <a class="moz-txt-link-rfc2396E" href="mailto:bridge_stone@gmx.net"><bridge_stone@gmx.net></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Freeradius looks in the ActiveDirectory if the
user exists and has the rights to connect to the internet. if the
authentication is ok, the user must surf over a ISA because there is
installed websense.
</pre>
</blockquote>
<pre wrap=""><!---->
That's not helpful. You're saying that even though you know only
authenticated users access your net, you still make them authenticate
again?
</pre>
<blockquote type="cite">
<pre wrap=""> is it possible to have a transparent authentication
through the isa-server. i mean if the client is in the condition that he
can send the ntlm authentication, that he doestn't have to authenticate
twice times. one time on the chillispot and the second on the isa
server. is there any possibilty?
</pre>
</blockquote>
<pre wrap=""><!---->
The only way to do that is if the RADIUS server can tell the isa
that the user is OK, and they don't have to be authenticated. See the
isa docs for if this is possible, and if possible, how. Then write a
script on FreeRADIUS to send the information isa needs.
In general, what you want to do is difficult, because most people
don't do it. And most people don't do it because authenticating
people twice is pointless/
Alan DeKok.
-
List info/subscribe/unsubscribe? See <a class="moz-txt-link-freetext" href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a>
</pre>
</blockquote>
<br>
</body>
</html>