Skip to content

Microsoft NPS & Meraki Enterprise Wireless (802.1X EAP-TLS)

This guide details the deployment of certificate-based 802.1X authentication (EAP-TLS) for domain-joined Windows endpoints connecting to Meraki wireless access points via Microsoft Network Policy Server (NPS) and Active Directory Certificate Services (AD CS).

1. AD CS & Certificate Auto-Enrollment

Certificate Template Setup

  1. Open the Certification Authority MMC (certsrv.msc).
  2. Right-click Certificate Templates and select Manage.
  3. Right-click the Computer template and select Duplicate Template.
  4. Configure template properties:
  5. General: Name the template (e.g., Domain-Computer-Wireless).
  6. Security: Grant Domain Computers permissions to Read, Enroll, and Autoenroll.
  7. Save the template, return to Certification Authority, right-click Certificate Templates -> New -> Certificate Template to Issue, and select Domain-Computer-Wireless.

Group Policy Configuration

  1. Open Group Policy Management (gpmc.msc) and edit your targeted computer GPO.
  2. Navigate to: 
    Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Public Key Policies
  3. Open Certificate Services Client – Auto-Enrollment:
  4. Set Configuration Model to Enabled.
  5. Check Renew expired certificates, update pending certificates, and remove revoked certificates.
  6. Check Update certificates that use certificate templates.

2. Network Policy Server (NPS) Configuration

RADIUS Client Setup

  1. Open Network Policy Server (nps.msc).
  2. Right-click RADIUS Clients -> New.
  3. Enter the Meraki AP IP subnet/address details and set a secure Shared Secret.

Network Policy Setup

  1. Navigate to Policies -> Network Policies and create a new policy.
  2. Set Conditions:
  3. NAS Port Type: Wireless - IEEE 802.11
  4. Windows Groups: Domain Computers
  5. Set Constraints:
  6. Uncheck all password-based authentication methods.
  7. Under EAP Types, click Add -> Microsoft: Smart Card or other certificate (EAP-TLS).
  8. Select Configure and verify the issuing CA certificate is selected.
  9. Set Settings:
  10. Encryption: Ensure Strongest encryption (MPPE 128-bit) is checked.

3. Meraki Dashboard Configuration

  1. Log in to the Meraki Dashboard and navigate to Wireless -> Access Control.
  2. Select the targeted SSID and set security to Enterprise with RADIUS.
  3. Configure WPA Encryption Mode to WPA3 Enterprise (or WPA2/WPA3 Mixed Mode for legacy compatibility).
  4. Add the NPS server under RADIUS Servers:
  5. Host: <NPS_Server_IP>
  6. Port: 1812
  7. Secret: <Configured_Shared_Secret>
  8. Set EAP Timeout to 5 seconds and configure Accounting if enabled on NPS.

4. Verification & Validation

  1. On a domain-joined endpoint, run gpupdate /force and confirm certificate issuance in certlm.msc: 
    Certificates - Local Computer -> Personal -> Certificates
  2. Connect to the Meraki SSID.
  3. Validate connection on the NPS server via Event Viewer: 
    Applications and Services Logs -> Microsoft -> Windows -> NetworkPolicyServer -> Operational
  4. Event ID 6272: Indicates successful authentication via EAP-TLS.

5. Wireless Hardening & Best Practices

  • Certificate Revocation Checking: Ensure the CRL distribution point (CDP) is reachable by the NPS server to validate client certificate status.
  • Network Segmentation: Map the authenticated wireless SSID to an isolated client VLAN at the switch/gateway layer. Never drop wireless clients directly onto server or management subnets.
  • Management Security: Enforce HTTPS/SSH for all network infrastructure management interfaces and disable legacy management protocols (HTTP, Telnet, SNMP v1/v2c).
  • Physical & Environmental Controls: Mount APs out of reach or inside tamper-resistant enclosures, and disable unused physical Ethernet drops connected to corporate VLANs.

References

  • DISA STIG: Network WLAN Access Point STIG (NET_WLAN_AP-IG_MGMT)
  • NIST SP 800-153: Guidelines for Securing Wireless Local Area Networks
  • SIMM 5300-A / NIST SP 800-53: Access Control (AC-18 Wireless Access Controls)