IT Service Status

IT Project: Campus Data Network Authentication Deployment

Project Status

August 2026: Authentication to the Northwestern eduroam network through username and password credentials was disabled on August 12. All devices must use the device-specific, credential-based authentication method to connect to the network. Find instructions on how to install a certificate on each device you plan to connect to eduroam in the Northwestern IT Knowledge Base.

Technical support for help with adding an authentication certificate to mobile devices is available through local technology teams across the University and through the IT Service Desk.

Background

As Northwestern faces new security threats and additional compliance/regulatory requirements concerning information security, applying role-based network access control (RBAC) to the wired and wireless networks is critical for meeting our obligations and securing our community, data, and research. There is additional urgency to begin implementing foundational elements for role-based network access control, as our current network authentication method for the wireless network will become more challenging for our users to manage in the fall of 2024, and new research security requirements are arriving in the summer of 2025. To best secure network access at Northwestern and maximize our future ability to enable RBAC at the network level, Northwestern IT will implement a vendor-supported EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) device certificate-based authentication solution. Many higher education peers have already deployed or plan to deploy the same technology.

Benefits to the Northwestern Community

Implementing wired network authentication and standardizing the security protocol for wired and wireless access will increase the University's security posture and meet internally identified standards set by the Information Security Office (ISO). A uniform onboarding process for both managed and personal devices will also reduce troubleshooting and support efforts.

Goals and Objectives

Improve the campus network's overall security posture by enabling Network Authentication on wired ports.
Standardize EAP-TLS as the security protocol for both wired and wireless network authentication.
Deploy a vendor-managed Public Key Infrastructure (PKI) service for device certificate management.

Approach

The project will be delivered over an 18-month period. During the initial phase, the project team will:

Test and document steps needed for connecting using EAP-TLS on both wired and wireless networks.
Determine how certificates will be issued for both managed and non-managed devices and shared and personal devices.
Configure the infrastructure and provide documentation to support devices that do not support EAP-TLS.
Document the support requirements and process for schools and units to transition devices to the new authentication method.

Project Timeline

Project Timeline
Date	Description	Status
Spring 2024	Build EAP-TLS authentication environment	Complete
Summer 2024	Renew EAP-PEAP certificate for one year Begin testing/documenting EAP-TLS authentication Begin planning wired authentication rollout	Complete
Fall 2024	Begin public communication Enable EAP-TLS to run in parallel with EAP-PEAP on eduroam	Complete
Spring 2025	Release BYOD wireless onboarding Continue work with managed environments for PKI integration	Complete
Winter 2026	General deployment for managed wireless devices Begin targeted deployments of wired authentication	Complete
Summer 2026	Disable EAP-PEAP on eduroam.	Complete