Configuring Windows7 built-in wireless client for TTLS+PAP using SecureW2 (v3.0, 27th Feb 2014)

Described here are the steps involved in configuring the built-in wireless client under Windows 7 to use eduroam, authenticating via TTLS+PAP using the SecureW2 third-party supplicant software. Your home site will be able to tell you whether TTLS+PAP is the appropriate authenticiation method that you should use.

!!! Please Note (Mar 2010) !!!: Under the current licensing of SecureW2, recent versions of the software are no longer available for free and instead an individual or site license must now be purchased. For further information, including license costs, see www.securew2.com.

Wherever you see the icon in the instructions below you can click on the text beside it to display further information and click on it again to hide the detailed text once more. Click on an image to open a larger version in a new browser window.

Information you will need

To complete these instructions you'll need some information specific to your home site/organisation, plus your own credentials, as listed below. If any of the details in your wifi profile are incorrect then your authentication will fail and you will not gain wifi access via eduroam. The IT department of your home site will be able to provide you with these details:

Information requiredSample string in the instructions below
Your home site's domain name as would appear in, for example, your e-mail address e.g. ucd.iemysite.ie
[OPTIONAL] The name of the CA certificate used by your home site for eduroam. You will not require this if your site is using a public CA which is already defined within your wireless client.GTE CyberTrust Global Root
[OPTIONAL] A file containing the actual CA certificate used by your site for eduroam. You will not require this if your site is using a public CA which is already defined within your wireless client.cacert.crt
The name on the SSL certificate presented by the authentication server at your home site e.g. tweedledum.ucd.ie certname.mysite.ie
The username you use to authenticate against your home account. Note the inclusion of your domain name e.g. jsoap@ucd.iemyname@mysite.ie
The password you use to authenticate against your home account.mypassword

Configuration instructions

Follow these steps to configure your wireless client:

  1. First, install SecureW2. This is commercial third-party supplicant software (see note above), available from www.securew2.com. The SecureW2 website contains the software and installation instructions. Follow the instructions to install the software with the TTLS component.
  2. If your home site has provided you with a file containing a CA certificate then you will need to install it here, otherwise skip to the next step.

    Installing the CA certificate

    Further info on CA certificate

  3. Left-click on the application icon in the tray.
    Click Open Network and Sharing Center.
  4. Click Manage wireless networks.
  5. Click Add
  6. Select Manually create a network profile
  7. Define the profile general details:
    Network name: eduroam
    Security type: WPA2-Enterprise
    Encryption type: AES
    Select Start this connection automatically
    Select Connect even if the network is not broadcasting

    Click Next

  8. Click Change connection settings
  9. Click on the Security tab.
  10. Define the authentication method:
    Security type: WPA2-Enterprise
    Encryption type: AES
    Choose a network authentication method: SecureW2: SecureW2 EAP-TTLS
    Un-select Remember my credentials for this connection each time I'm logged on

    Click Settings

  11. You have now entered the SecureW2 configuration utility.
    Click New
  12. Name the new profile:
    Profile: eduroam

    Click OK

  13. Define your outer/anonymised identity:
    Select Use alternative outer identity:
    Select Specify outer identity:anonymous@mysite.ie

    Further info on outer identity

    Click on Certificates tab.

  14. Define your home server certificate details:
    Select Verify server certificate
    Trusted Root CA:Click on Add CA and select the appropriate CA entry for your home site from the list.
    Select Verify server name:certname.mysite.ie

    Further info on server identity

    Click on Authentication tab.

  15. Define your authentication method:
    Select Authentication Method:PAP

    Click on User account tab.

  16. Provide your credentials:
    Un-select Prompt for user credentials
    Username: myname@mysite.ie
    Password: mypassword
    Logon domain: Leave blank

    Further info on credential settings

    Click OK

  17. Click OK to complete the profile creation.

    Click Advanced settings in the next window.

  18. Define your authentication mode:
    Select Specify authentication mode:User authentication

    Click OK
    Click OK on subsequent windows until you are back at the Manage Wireless Networks window.

  19. You can make eduroam your preferred network by highlighting the eduroam entry and using the Move Up button to move it to the top of the list of preferred networks.

    Close the window.

  20. Your wireless client is now configured to avail of eduroam and should connect automatically when at a site where the eduroam service is available.