XIQ SE and Windows 11 Authentication EAP TLS

[Asifi]

Hello Community,

We have upgraded from Win 10 to Win 11 and are currently using EAP PEAP as the 802.1x authentication method.  I was told this would no longer work with Win 11 and we would need to implement EAP TLS.  I understand EAP TLS is not available for the version of XIQ SE we have - 23.4.12.3.

However, I believe later version of XIQ SE support EAP TLS.  If this is not the case please let me know. Could anyone let me know which minimum version of XIQ SE supports EAP TLS for XIQ SE and will I need a root certificate to be installed on XIQ SE and the NAC devices?

Is there a guide or similar I could use to Implement EAP TLS?

Currently, we use the built in 802.1x authentication via a LDAP server.  This I believe supports MsCHAP, PEAP and EAP-MsCHAPV2 only.

Many Thanks,

[SebBinet]

As mentioned by others, any XIQ-SE/NAC version support EAP-TLS.
You'll need server certificate issued by your CA for the NAC appliance/VM but not for XIQ-SE.

Only NAC appliance are RADIUS Server and will use server certificate to be validated by your Windows 11 devices.

Even if Windows 11 still support PEAP (with Credential Guard disabled), never know if it'll be the case tomorrow because PEAP is deprecated because of security issues.

[Markus_Nikulski]

PEAP-MSCAP is still supported with Windows 11. More and more customer moving to EntraID replacing the classical Active Directory we know since many years. Using EAP-TLS is a good alternative if you know how to deal with client certificates in regards auto enrollment and live cycle management. Just make sure the client have certificate with "enhance key usage" = "Client Authentication" and select the certificates in the Windows 11 plus the corresponding root CA certificate to be able to validate the incoming Radius server certificate like you should have already with PEAP-xxx.

[Asifi]

Hi All, will I need a pfx or cer certificate for the NAC's?

Thanks,

[Markus_Nikulski]

the pfx extension indicate is a PLCS12 formatted data. Yes it can be used to deploy the certificate for the Radius server.

[Asifi]

@Markus_Nikulski - Thanks Marcus, we use an LDAP server for user and machine authentication.  PFX still ok?

Thanks,