1. 802.1X Configuration Terena 802.1X workshop the Netherlands, Amsterdam, March 30 th Paul Dekkers

2. 2 Overview

3. 3 EAP

4. 4 What makes EAP flexible

5. 5 Man-in-the-Middle attack That’s why we need a good EAP mechanism!

6. 6 RADIUS proxy-ing

7. 7 RADIUS Client-Server model –Authenticator is a RADIUS client –Authentication-server is the RADIUS server –RADIUS server can be a client as well

8. 8 RADIUS – what’s in the packet UDP, ports 1645/1646 or 1812/1813 Mind the firewall! Attributes, like User-Name, User-Password, EAP-Message Shared Secret

9. 9 RADIUS and REALMS Use well-chosen realms: preferably like an e-mail address, user@institution.ccTLD Important with PROXY-ing

10. 10 Guest Access

11. 11 Traffic separation without 1x

12. 12 Traffic separation with 1x RADIUS server SURFnet office RADIUS server University X Internet Central RADIUS proxy server Authenticator (AP or switch) User DB Supplicant Guest Paul.Dekkers@surfnet.nl Students VLAN Guest VLAN Employee VLAN

13. 13 Traffic separation with 1x

14. 14 Hands-on setup

15. 15 Configuration : Radiator Linear Global configuration AuthPort 1812 AcctPort 1813 LogDir /var/log/radius DbDir /etc/radiator Clients Handlers

16. 16 Configuration : Radiator RADIUS Clients Secret 6.6obaFkm&RNs666 Identifier AP1 IdenticalClients 192.168.1.3, 192.168.1.4

17. 17 Configuration : Radiator Filename users

18. 18 Configuration : Radiator Filename users EAPType TTLS, PEAP, MSCHAP-V2 EAPTLS_CAFile root-ca.pem EAPTLS_CertificateFile server.pem EAPTLS_CertificateType PEM EAPTLS_PrivateKeyFile private.pem EAPTLS_PrivateKeyPassword secret EAPTLS_MaxFragmentSize 1024 AutoMPPEKeys

19. 19 Configuration : Radiator # Accept, and log # PAP # EAP-MSCHAPv2 # EAP-TTLS and EAP-PEAP

20. 20 Configuration : Radiator, Identifiers and Catch-all Identifier SURFNET-PROXY Host radius-proxy.surfnet.nl Secret Sdfg8WeR98r09d8fg AuthPort 1812 AcctPort 1813 AuthBy SURFNET-PROXY

21. 21 RADIUS proxy-loop Good configuration is more complex, often lacks in prevention for proxy-loops

22. 22 Configuration: Access-Point

23. 23 Cisco AP - RADIUS AP1(config)#aaa new-model aaa group server radius rad_eap server 192.87.116.63 auth-port 1812 acct-port 1813 aaa authentication login eap_methods group rad_eap aaa accounting network acct_methods start-stop group rad_acct radius-server host 192.87.116.63 auth-port 1812 acct-port 1813 key X

24. 24 Cisco AP - Wireless Interface AP1(config)#interface dot11Radio 0 AP1(config-if)#encryption mode ciphers wep40 AP1(config-if)#broadcast-key change 1800 AP1(config-if)#no ssid tsunami AP1(config-if)#ssid SURFnet AP1(config-if-ssid)#authentication open eap eap_methods AP1(config-if-ssid)#guest-mode AP1(config-if-ssid)#^Z

25. 25 Cisco switch – enable RADIUS Switch# configure terminal Switch(config)# aaa new-model Switch(config)# radius-server host 192.168.100.1x auth-port 1812 key

26. 26 Cisco switch – enable 802.1x Switch(config)# aaa authentication dot1x default group radius Switch(config)# dot1x system-auth-control Switch(config)# interface fastethernet0/1 Switch(config-if)# spanning-tree portfast Switch(config-if)# switchport mode access Switch(config-if)# switchport access vlan 10 Switch(config-if)# dot1x port-control auto Switch(config-if)# end Switch(config-if)# dot1x guest-vlan 60

27. 27 Windows and wired 802.1x

28. 28 Extra in hands-on Configuration of VLAN’s: Can you enable “roaming” with another group? Can you create an SSID for users without 802.1x?