172 lines
4.9 KiB
Markdown
172 lines
4.9 KiB
Markdown
# Machine Authentication 3.0 (v3.4)
|
|
|
|
Configures shop floor PCs for 802.1x/ISE Machine VLAN connectivity with support for both wired and wireless networks.
|
|
|
|
## Overview
|
|
|
|
This installer automates the configuration of 802.1x network authentication for GE Aerospace shop floor machines, enabling secure access to the Machine VLAN without requiring user credentials.
|
|
|
|
## What It Configures
|
|
|
|
| Network Type | Authentication | Server |
|
|
|--------------|----------------|--------|
|
|
| Wired | 802.1x PEAP/MS-CHAPv2 | Corporate Holdings RADIUS |
|
|
| Wireless | 802.1x EAP-TLS (certificate) | Aerospace FreeRADIUS |
|
|
|
|
## Features
|
|
|
|
- **Native Inno Setup Implementation** - All logic in Pascal script, no external batch files
|
|
- **Silent Installation Support** - Full automation for deployment tools
|
|
- **Windows 7/10/11 Support** - Auto-detects OS and uses appropriate interface names
|
|
- **Automatic Network Detection** - Identifies active interface (wired or wireless)
|
|
- **Detailed Logging** - Comprehensive log output for troubleshooting
|
|
|
|
## Usage
|
|
|
|
### Interactive Installation
|
|
|
|
1. Run `MachineAuthSetup.exe` as Administrator
|
|
2. Review the configuration summary
|
|
3. Click Install
|
|
4. View results and verify connectivity
|
|
|
|
### Silent Installation
|
|
|
|
```batch
|
|
MachineAuthSetup.exe /VERYSILENT /SUPPRESSMSGBOXES
|
|
```
|
|
|
|
With logging:
|
|
```batch
|
|
MachineAuthSetup.exe /VERYSILENT /SUPPRESSMSGBOXES /LOG="C:\ma3_install.log"
|
|
```
|
|
|
|
## Configuration Details
|
|
|
|
### Wired Network (8021x.xml)
|
|
|
|
- **EAP Type:** 25 (PEAP)
|
|
- **Inner Method:** MS-CHAPv2 (Type 26)
|
|
- **Auth Mode:** Machine
|
|
- **Credentials:** Windows logon credentials
|
|
- **Service:** dot3svc (Wired AutoConfig)
|
|
|
|
### Wireless Network (AESFMA.xml)
|
|
|
|
- **SSID:** AESFMA
|
|
- **Security:** WPA2-Enterprise, AES
|
|
- **EAP Type:** 13 (EAP-TLS)
|
|
- **Auth Mode:** Machine (certificate-based)
|
|
- **Service:** Wlansvc (WLAN AutoConfig)
|
|
|
|
## Interface Names
|
|
|
|
| Windows Version | Wired Interface | Wireless Interface |
|
|
|-----------------|-----------------|-------------------|
|
|
| Windows 7/8 | Local Area Connection | Wireless Network Connection |
|
|
| Windows 10/11 | Ethernet | Wi-Fi |
|
|
|
|
## Installation Steps
|
|
|
|
1. Stop NetworkAdapterManager service (if present)
|
|
2. Enable and start Wired AutoConfig (dot3svc)
|
|
3. Import 802.1x profile to wired interface
|
|
4. Enable and start WLAN AutoConfig (Wlansvc)
|
|
5. Import AESFMA profile to wireless interface
|
|
6. Reconnect active network interface
|
|
7. Start NetworkAdapterManager service
|
|
8. Wait 10 seconds for network stabilization
|
|
|
|
## Requirements
|
|
|
|
- Windows 7, 8, 10, or 11
|
|
- Administrator privileges
|
|
- SSL certificate for FreeRADIUS (pre-installed on managed machines)
|
|
- Standard network interface naming conventions
|
|
|
|
## Files
|
|
|
|
```
|
|
MachineAuth/
|
|
├── MachineAuth.iss # Inno Setup script
|
|
├── 8021x.xml # Wired 802.1x profile
|
|
├── AESFMA.xml # Wireless AESFMA profile
|
|
├── gea-logo.ico # Setup icon
|
|
├── banner.bmp # Wizard banner
|
|
├── banner-sm.bmp # Wizard small image
|
|
└── README.md # This file
|
|
```
|
|
|
|
## Legacy Files (Not Required)
|
|
|
|
These files are from the original batch-based installer and are not used by the Inno Setup version:
|
|
|
|
- `MA3NetworkConfigv4.bat` - Original batch script
|
|
- `ge_runasuser.exe` - Run-as-user utility
|
|
- `RebootDelay.exe` - Reboot delay utility
|
|
- `$PLUGINSDIR/` - NSIS plugin remnants
|
|
|
|
## Troubleshooting
|
|
|
|
### "Requires administrator privileges"
|
|
Right-click the installer and select "Run as administrator"
|
|
|
|
### Network doesn't reconnect after configuration
|
|
1. Manually disconnect and reconnect the network adapter
|
|
2. Check Windows Services that dot3svc and/or Wlansvc are running
|
|
3. Verify the machine has the required certificates
|
|
|
|
### AESFMA wireless doesn't connect
|
|
- Verify the FreeRADIUS SSL certificate is installed
|
|
- Check that the machine is in the correct AD group
|
|
- Ensure the wireless adapter supports WPA2-Enterprise
|
|
|
|
### Wired 802.1x authentication fails
|
|
- Verify the machine account is in the correct AD group
|
|
- Check that the switch port is configured for 802.1x
|
|
- Review the RADIUS server logs for authentication errors
|
|
|
|
### Check installed profiles
|
|
|
|
Wired profiles:
|
|
```batch
|
|
netsh lan show profiles
|
|
```
|
|
|
|
Wireless profiles:
|
|
```batch
|
|
netsh wlan show profiles
|
|
```
|
|
|
|
### Remove and reinstall profiles
|
|
|
|
Remove wired profile:
|
|
```batch
|
|
netsh lan delete profile interface="Ethernet"
|
|
```
|
|
|
|
Remove wireless profile:
|
|
```batch
|
|
netsh wlan delete profile name="AESFMA"
|
|
```
|
|
|
|
Then run the installer again.
|
|
|
|
## Building
|
|
|
|
1. Install [Inno Setup 6.x](https://jrsoftware.org/isdl.php)
|
|
2. Open `MachineAuth.iss`
|
|
3. Compile (F9)
|
|
4. Output: `Output/MachineAuthSetup_v3.4.exe`
|
|
|
|
## Technical Notes
|
|
|
|
- No reboot required
|
|
- Brief network interruption during configuration (~10-15 seconds)
|
|
- Safe to run multiple times
|
|
- Does not remove existing profiles (adds/updates)
|
|
|
|
## Author
|
|
|
|
WJDT / GE Aerospace
|