Configuring WinXP Dell wireless client for TTLS+PAP (v3.0, 27th Feb 2014)

Described here are the steps involved in configuring the Dell wireless client under Windows XP to use eduroam, authenticating via TTLS+PAP. Your home site will be able to tell you whether TTLS+PAP is the appropriate authenticiation method that you should use.

Wherever you see the icon in the instructions below you can click on the text beside it to display further information and click on it again to hide the detailed text once more. Click on an image to open a larger version in a new browser window.

Information you will need

To complete these instructions you'll need some information specific to your home site/organisation, plus your own credentials, as listed below. If any of the details in your wifi profile are incorrect then your authentication will fail and you will not gain wifi access via eduroam. The IT department of your home site will be able to provide you with these details:

Information required	Sample string in the instructions below
Your home site's domain name as would appear in, for example, your e-mail address e.g. ucd.ie	mysite.ie
[OPTIONAL] The name of the CA certificate used by your home site for eduroam. You will not require this if your site is using a public CA which is already defined within your wireless client.	GTE CyberTrust Global Root
[OPTIONAL] A file containing the actual CA certificate used by your site for eduroam. You will not require this if your site is using a public CA which is already defined within your wireless client.	cacert.crt
The name on the SSL certificate presented by the authentication server at your home site e.g. tweedledum.ucd.ie	certname.mysite.ie
The username you use to authenticate against your home account. Note the inclusion of your domain name e.g. jsoap@ucd.ie	myname@mysite.ie
The password you use to authenticate against your home account.	mypassword

Notes on the Dell wireless client under WinXP

Configuration instructions

Follow these steps to configure your wireless client:

1. If your home site has provided you with a file containing a CA certificate then you will need to install it here, otherwise skip to the next step.

   Installing the CA certificate

   Installing the CA Certificate

   Download/copy the certificate file, cacert.crt, to your computer.
   Double-click the file, and click Install Certificate...
   Follow the Certificate Import Wizard steps - usually the correct option to choose is to have the wizard automatically select the certificate store in which to save the certificate.

   You can verify that the certificate is installed by running MMC (mmc.exe), adding the "Certificates" snap-in, and browsing to the appropriate certificate store (e.g. "Trusted Root Certification Authorities"->"Certificates") to see if your site's CA certificate is listed there.

   Further info on CA certificate

   CA Certificate

   As described in a later step, you must supply the details of the SSL certificate of your home authentication server as part of the eduroam profile. These details include the identity of the Certificate Authority (CA) that signed the server certificate. The Dell wireless client comes with a list of public CA's already installed and if your site's certificate is signed by one of those CA's then you don't need to install a CA certificate yourself. However, if you wish to explicitly identify an intermediate CA, or your server's certificate is signed by a private root CA, then you must install that intermediate/root CA's certificate before proceeding.

2. Click on the application icon in the tray.
   Select the Wireless Networks tab.
   Click Add.
   
3. Click Manually connect to and advanced network.
   
4. Define the profile details:
   

   Network name (SSID): eduroam Remove after: Select Never Network authentication: Select WPA-Enterprise EAP method: Select TTLS Inner EAP method: Select PAP Un-select Prompt for user name and password Domain\User Name: myname@mysite.ie Password: mypassword

   Further info on credential settings

   Credential Settings

   Your credentials consist of your username, in a form much like an e-mail address, and your password. In this example the option to cache credentials is chosen (by un-selecting the option to prompt for user name and password) but you should consider for yourself whether this option is appropriate for you and if in doubt then opt to not have your credentials cached. If your credentials are not cached then you will be prompted for them each time you use eduroam wifi.

5. Select the Client Identity tab.
   Define your client identity:
   

   Logon or identity: anonymous@mysite.ie

   Further info on Client Identity

   Client Identity

   Your Client Identity, also referred to as your outer identity, hides your real identity/username from eduroam sites that you visit. For personal privacy reasons it is recommended that you configure your client to hide your identity as shown.

6. Select the Server Identity tab.
   Define your server identity details:
   

   Select Validate server certificate Issuer: Click Select..., and select the CA for your home site from either the "Root Certificates" or "Intermediate Certificates" list as appropriate. Select Server name must match exactly Server name: certname.mysite.ie

   Further info on server identity

   Server Identity

   When your client connects to eduroam, it will try to verify the identity of your home authentication server before it passes your credentials to the server for validation. The wireless client relies upon the SSL certificate presented by your home authentication server in order to carry out this verification. Defining the SSL certificate details here allows the client to complete this verification without any intervention required by you, and provides the greatest level of protection of your credentials.

   Click OK

7. You can make eduroam your preferred network by highlighting the eduroam entry and using the Up button to move it to the top of the list of preferred networks.
   Click Apply
   Click OK
   

Your wireless client is now configured to avail of eduroam and should automatically connect when at a site where the eduroam service is available.