From on version 11 innovaphone devices offer support[1] for wired port access authentication by means of 802.1X with EAP-TLS.
This article foccusses on FreeRadius. FreeRadius is an open source RADIUS server suitable to be utilized as an authentication server in terms of 802.1X.
Two different certificate handling methods will be outlined below:
The innovaphone CA certificate is going to be downloaded from a single device. It is going to be added to the list of trusted CA certificates.
An own PKI is build from scratch. The resulting certificates must be deployed onto innovaphone devices.
Security/Management Security/Server Configuration Global Radius Server Configuration
The server address is the one of the Linux AP, 192.168.178.34
The secret must be the one from above, i.e. testing123
Security/Port Authentication/Basic/802.1X Configuration Set Port Based Authentication State to enable
Security/Port Authentication/Advanced/Port Authentication For all 802.1X-restricted ports set Port Control to Auto
Set non-restricted ports(e.g. for management) to Authorized
Global Radius Server ConfigurationPort Based AuthenticationPort Control
Design Considerations
The NetGear switch GS110TP does not support 802.1X single-host authentication. The switch's port can only be authenticated as a whole - it behaves alike a Cisco port in multi-host mode(see below). It is therefore a considerable decision to permanently disable an IP phone's PC-port, in order to prevent traffic from unauthenticated stations.
Cisco
A Catalyst switch 3750-24p with IOS version 12.2(55) served as a test switch. Cisco offers four so-called host-modes in 802.1X.
single-host
A single network peer can authenticate. No other peers are allowed to communicate
multi-host
As in single-host mode, a single network peer can authenticate. After that, all succeeding peers will be granted access without any authentication.
multi-domain
One peer can authenticate within the VOICE domain and one peer can authenticate within the DATA domain. Each peer joins a dedicated VLAN.
multi-auth
Similar to multi-domain this host-mode allows for multiple DATA devices and one VOICE device.
A simple testbed with one protected port is sketched as follows:
The single port fastEthernet 1/0/11 is protected by 802.1X means.
The authentication host-mode is set to multi-domain. This allows two devices, one phone and one PC to be authenticated.
The Radius server's ip is 192.168.178.34:1812.
The shared secret between the switch and FreeRADIUS server be testing123.
A syslog server at 192.168.178.27 collects debugging/tracing info.
The switch's ip address for management purposes is 192.168.178.32
The testbed's configuration excerpt illustrating 802.1X-specific parameters follows:
Switch#show running-config
Building configuration...
Current configuration : 3792 bytes
!
version 12.2
...
!
aaa new-model
!
!
aaa authentication dot1x default group radius
aaa authorization network default group group group radius
!
!
!
aaa session-id common
!
!
dot1x system-auth-control
!
...
!
vlan internal allocation policy ascending
lldp run
!
!
!
interface FastEthernet1/0/1
!
...
!
interface FastEthernet1/0/11
A successful authentication of the VOICE peer and the DATA peer shows up by means of the command show authentication interface ... Watch out for the column entitled Domain.
Switch#show authentication interface fastethernet 1/0/11
Client list:
Interface MAC Address Method Domain Status Session ID
As can be seen in the command output the innovaphone device with the MAC address 00-90-33-26-00-b6 was assigned into the VOICE domain. In order to achieve this, a Cisco-specific RADIUS-attribute cisco-avpair must be passed from the FreeRADIUS server back to the Catalyst switch. The required FreeRADIUS configuration can be supplied by editing the file /etc/freeradius/sites-enabled/default. A simple detection for innovaphone MAC address prefixes ensures that the cisco-avpair attribute gets returned within the Radius Access-Accept Message. The lines to be added to the default file's post-auth section follow:
This section isn't necessary for a successful deployment of 802.1X EAP-TLS with innovaphone devices. It just serves as a memory aid thereby sketching the required steps for a PKI based on an own private CA. The CA will be used in turn to sign a server certificate and one or more client certificates.
Creation Of A Self-Signed CA Certificate
Change into FreeRadius' certificates directory
cd /etc/feeradius/certs
Generate the CA's pair of public and private key
openssl genrsa -out ca.key 1024
Note: For an encrypted ca.key file the -des3 option is required
Prepare and generate a certificate signing request for the actual CA certificate
Firstly a small configuration file ca.conf needs to be created/edited
[ req_DN ]
countryName = "1. Country Name (2 letter code)"
countryName_default = DE
countryName_min = 2
countryName_max = 2
stateOrProvinceName = "2. State or Province Name (full name) "
stateOrProvinceName_default =
localityName = "3. Locality Name (eg, city) "
localityName_default = Berlin
0.organizationName = "4. Organization Name (eg, company) "
0.organizationName_default = Mustermann
organizationalUnitName = "5. Organizational Unit Name (eg, section) "
organizationalUnitName_default = Server
commonName = "6. Common Name (eg, CA name) "
commonName_max = 64
commonName_default = www.mustermann.de
emailAddress = "7. Email Address (eg, name@FQDN)"
emailAddress_max = 40
emailAddress_default = webmaster@mustermann.de
Some certificate extensions can be specified in server.ext
[ req_DN ]
countryName = "1. Country Name (2 letter code)"
countryName_default = DE
countryName_min = 2
countryName_max = 2
stateOrProvinceName = "2. State or Province Name (full name) "
stateOrProvinceName_default = Berlin
localityName = "3. Locality Name (eg, city) "
localityName_default = Berlin
0.organizationName = "4. Organization Name (eg, company) "
0.organizationName_default = Mustermann
organizationalUnitName = "5. Organizational Unit Name (eg, section) "
organizationalUnitName_default =
commonName = "6. Common Name (eg, CA name) "
commonName_max = 64
commonName_default = Max Mustermann
emailAddress = "7. Email Address (eg, name@FQDN)"
emailAddress_max = 40
emailAddress_default = max@mustermann.de
