OIT Public Knowledge - Encrypted Network Communication EPS Control for macOS with eduroam

This article provides instructions as a guide to join a participating institution’s eduroam network if you are using the eduroam device certificate deployed by your IT support unit. All eduroam information and processes can also be found on the primary service page for eduroam at NC State.

Information
Escalation
Related Documentation

Information

In order to build NCSU’s cybersecurity practices and adhere to policies, this process and continued use of the eduroam network enhances endpoint compliance for with RUL 08.00.18 – Endpoint Protection Standard requirements for use of encrypted networks on Macintosh laptops in the OIT Managed Desktop Service environment.

See EPS Security Controls

Requirements

The device must have been 1.) configured by your IT support staff to receive the eduroam trusted device-based secure certificates which will auto-enroll you into eduroam or 2.) must have been enrolled in eduroam by you on the NC State campus using your user credentials. Consult your service desk or technical support for assistance with these registration processes if you are unsure if your device has been prepared to participate.

eduroam Device Certificate User Experience

Once your macOS computer receives the eduroam (Device) configuration profile from our Configuration Management System (CMS), and if Wi-Fi is enabled, your computer will automatically authenticate and connect to the eduroam wireless network if in range. macOS provides a few different graphical ways to confirm you are connected and verify correct configurations if troubleshooting is required.

Am I connected?

System Preferences -> Profiles preference pane -> EDUROAM (Device)

Note: The "EDUROAM (Device)" configuration must exist on your macOS computer in order to connect to the eduroam using the device-based profile. If you do not see this configuration profile, please contact the helpdesk.

Make sure the wireless funnel has √ eduroam

Network preference pane showing the client connected to the network.

Configuration Information

System Preferences -> Network -> Advanced -> 802.1X

System Preferences -> Network -> Advanced -> Wi-Fi

FAQ

1. Will it cause problems if I already enrolled myself in eduroam?

No - If you are already enrolled in eduroam, no need to worry, the additional configuration profile on your macOS computer will not cause any issues. Check out the screenshots below.

System Preferences -> Profiles (user-based eduroam configuration profile)

System Preferences -> Profiles (device-based eduroam configuration profile)

2. How do I know if I am connected using the user-based profile or the device-based profile?

After the device-based eduroam profile is installed and the computer is restarted, your computer should connect to eduroam using the device-based profile. The first two images let you know if the user-based profile is being used. The last two images indicate your computer is connected with the device-based profile.

System Preferences -> Network (user-based eduroam configuration)

System Preferences -> Network -> Advanced -> 802.1X (user-based eduroam configuration)

System Preferences -> Network (device-based eduroam configuration)

System Preferences -> Network -> Advanced -> 802.1X (device-based eduroam configuration)

3. I see that i am connected to the user-based eduroam, and both configurations are installed. How do I make it switch?

Restart your computer

Troubleshooting

As the end user, there are a few of things that you can do troubleshoot.

Verify that you have the device-based eduroam profile and ensure your connection is based on that configuration.
Toggle Wi-Fi off /on
Restart your computer

Escalation

Any questions on process or content contained in this document should be escalated through the NCSU Help desk and a have an incident assigned to the OIT_DESKTOP_SUPPORT team.

Encrypted Network Communication EPS Control for macOS with eduroam

Table of Contents