Possible to user authenticate and machine authenticate at the same time?

[MIFA]

Hi

I would like to use 802.1x and a NPS server to authenticate users on my wireless network, but I also would like to machine authenticate as well. User and machine are domain joined, but may run into machines that are not domain joined.
So user password should be validated on the domain server via NPS, and I will also make sure the machine is the correct one via a certificate. 

All the how to guides are using User Auth or Machine Auth, not both. Have I misunderstood something?

Regards
Michael

[DarrenOC]

Hi @MIFA , you should be able to do both.  Below is helpful 

https://www.google.co.uk/amp/s/shabiryusuf.wordpress.com/2012/12/24/meraki-network-policy-server-nps...

[MIFA]

Hi @DarrenOC 

Thanks for the link, however I think it's only for filling one of the purposes. User authentication, not machine authentication, or am I wrong?

Br
Michael

[Bruce]

You’re correct, what @DarrenOC provided is for authenticating a user with username and password for a user. You can use the same approach to authenticate a machine with the machine username and password (assuming it’s domain jointed) by checking against the Domain Computers group rather than the Domain Users. You’ll also need to change the Windows supplicant to use the Computer credentials rather than the User credentials.

If you want to use a certificate then the approach is similar, you just need to change the authentication method to Certificate or Smart Card. This Meraki document provides the details here,https://documentation.meraki.com/MR/Encryption_and_Authentication/Creating_a_Policy_in_NPS_to_suppor...

[Bruce]

To do authentication based on two credentials passed using EAP you need EAP chaining, and to support EAP chaining you need both a supplicant (on the client) and authentication infrastructure that supports it (generally the RADIUS server). Although Windows 10 can now do EAP chaining through support of EAP-TEAP, Microsoft NPS doesn’t support it so far as I’m aware, so you only have half the solution.

You could get it to work if you use a different RADIUS server that supports TEAP - Cisco ISE is one example, not sure if there are any more at the moment. (TEAP is the ‘standardised’ version of Cisco’s EAP-FAST which has been able to do EAP chaining for sometime with the Cisco AnyConnect client).