how To configure Network Policy Server (NPS) for WPA3 Suite B authentication on a Windows Server 2022

Question

How exactly should I go about configuring the Network Policy Server (NPS) to enable WPA3 Suite B authentication on a Windows Server 2022? What are the specific steps and considerations that need to be taken into account during this configuration process? Hoe can I ensure a seamless and secure setup of the Network Policy Server (NPS) for WPA3 Suite B authentication within the Windows Server 2022 environment?

Answer 1

Dear friends,

To configure Network Policy Server (NPS) for WPA3 Suite B authentication on a Windows Server 2022, follow these steps:

1. Windows Server 2022 with NPS Role Installed: Ensure that the Network Policy and Access Services (NPAS) role is installed on your Windows Server 2022.
2. Client Device: Samsung S23 (or any WPA3 capable device).
3. Digital Certificates: Ensure you have the necessary certificates for PEAP (Protected Extensible Authentication Protocol) and smart card authentication.

Step 1: Install and Configure NPS Role

1. Open Server Manager and select Add Roles and Features.
2. Install the Network Policy and Access Services role.
3. Configure NPS as a RADIUS server.

Step 2: Configure Certificates for PEAP and Smart Card Authentication

1. Obtain and Install Certificates:
   • Ensure you have a server certificate installed on the NPS server. This certificate must be trusted by client devices.
   • Smart card certificates should also be configured and trusted.
2. Register NPS in Active Directory:
   • Open NPS console.
   • Right-click NPS (Local), select Register server in Active Directory.

Step 3: Configure Network Policy for WPA3 Suite B Authentication

1. Open NPS Console:
   • Go to Start > Administrative Tools > Network Policy Server.
2. Create a New Network Policy:
   • Right-click Network Policies, select New.
   • Name the policy, e.g., WPA3 Suite B Policy.
3. Specify Conditions:
   • Click Add under Conditions.
   • Add conditions such as User Groups, Client IPv4 Address, Windows Groups, etc.
   • For WPA3 Suite B, add PEAP and Smart Card or other certificate under conditions.
4. Specify Constraints:
   • Under Constraints, configure Authentication Methods.
   • Ensure Microsoft: Protected EAP (PEAP) is selected.
   • Configure PEAP settings by clicking Edit:
     • Select the server certificate.
     • Enable Smart Card or other certificate.
     • Optionally, configure Fast Reconnect and PEAP-TLV.
5. Configure EAP Types:
   • In the EAP Types section, ensure that Smart Card or other certificate is added and configured.
6. Specify Settings:
   • Under Settings, configure Encryption and Vendor Specific settings if required.
   • For WPA3, ensure strong encryption methods are selected.
7. Finalize and Apply Policy:
   • Review the settings and click Finish to create the policy.

Step 4: Configure Wireless Access Points (WAPs)

1. Access WAP Configuration:
   • Login to your Wireless Access Point management interface.
2. Configure SSID for WPA3:
   • Set the SSID to broadcast using WPA3 encryption.
   • Configure the security settings to match the NPS policy (e.g., PEAP and Smart Card authentication).
3. Apply Changes:
   • Save the configuration changes on the WAP.
4. Connect to the SSID:
   • On your Samsung S23, navigate to Wi-Fi settings.
   • Select the SSID configured for WPA3.
5. Enter Credentials:
   • Enter the required credentials (ID and domain).
   • If the save option is not available, ensure that all necessary fields are correctly filled and certificates are installed on the device.
6. Save and Connect:
   • Save the settings and attempt to connect to the network.
7. Check Certificates: Ensure all certificates are properly installed and trusted on both the server and client devices.
8. Verify Network Policy: Double-check the NPS network policy settings for any misconfigurations.
9. Consult Logs: Use the Event Viewer and NPS logs to identify any errors or issues during the authentication process.

• Microsoft Documentation on NPS
• Red Hat Documentation on WPA3

By following these steps, you should be able to configure your NPS server for WPA3 Suite B authentication. If you encounter any issues, please provide additional details for further assistance.If you find the answer helpful, please mark it as the accepted answer.

Best regards,

Rosy