H3C Access Controllers
Local RADIUS-Based 802.1X Authentication in EAP Relay Mode
Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Contents

Introduction· 1

Prerequisites· 1

Example: Configuring local RADIUS-based 802.1X authentication in EAP relay mode  1

Network configuration· 1

Restrictions and guidelines· 2

Procedures· 2

Configuring the AC· 2

Configuring the switch· 5

Verifying the configuration· 6

Configuration files· 8

Related documentation· 10

 

Introduction

The following information provides an example of configuring 802.1X authentication in EAP relay mode when the AC acts as both the access device and RADIUS server.

Prerequisites

The following information applies to Comware-based access controllers and access points. Procedures and information in the examples might be slightly different depending on the software or hardware version of the access controllers and access points.

The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

The following information is provided based on the assumption that you have basic knowledge of WLAN access, WLAN security, WLAN access authentication, and 802.1X features.

Example: Configuring local RADIUS-based 802.1X authentication in EAP relay mode

Network configuration

As shown in Figure 1:

·     The switch acts as a DHCP server to assign IP addresses to the AP and the client.

·     The AC acts as both the access device and RADIUS server for the client.

·     When the client accesses a wireless service, it must pass 802.1X EAP-PEAP authentication and obtain the required authorization information.

Configure the AC to meet the following requirements:

·     Use the local RADIUS server to perform authentication and authorization for wireless 802.1X users.

·     Use open system authentication to authenticate the client at the data link layer. This is the default authentication method.

·     Use the 802.1X AKM mode to secure data transmission between the client and the AP.

·     Use CCMP as the cipher suite.

Figure 1 Network diagram

 

Restrictions and guidelines

Use the serial ID labeled on the AP's rear panel to specify an AP.

Procedures

Configuring the AC

1.     Install the freeradius image file.

<AC> install activate feature cfa0:/freeradius.bin slot 1

Verifying the file cfa0:/freeradius.bin on slot 1...Done.

Identifying the upgrade methods....Done.

Upgrade summary according to following table:

 

cfa0:/freeradius.bin

  Running Version             New Version

  None                        Feature 5531

 

  Slot                        Upgrade Way

  1                           Service Upgrade

Upgrading software images to compatible versions. Continue? [Y/N]:

y

This operation might take several minutes, please wait......Done.

<AC> install activate feature cfa0:/freeradius.bin slot 2

Copying file cfa0:/freeradius.bin to slot2#cfa0:/freeradius.bin...Done.

Verifying the file cfa0:/freeradius.bin on slot 2...Done.

Identifying the upgrade methods....Done.

Upgrade summary according to following table:

 

cfa0:/freeradius.bin

  Running Version             New Version

  None                        Feature 5531

 

  Slot                        Upgrade Way

  2                           Service Upgrade

Upgrading software images to compatible versions. Continue? [Y/N]:y

This operation might take several minutes, please wait......Done.

<AC> install commit

2.     Use FTP or TFTP to transfer the required certificate files to the storage media of the AC and verify that the file transfer has succeeded.

<AC> dir *.pem

Directory of cfa0:

   0 -rw-        3428 Feb 06 2018 13:46:34   ca.pem

   1 -rw-        3345 Feb 06 2018 16:42:10   client.pem

   2 -rw-        3345 Feb 06 2018 13:46:50   server.pem

3.      Configure interfaces on the AC:

# Create VLAN 100 and VLAN-interface 100, and assign an IP address to the VLAN interface. The AC will use this IP address to establish CAPWAP tunnels with the AP.

<AC> system-view

[AC] vlan 100

[AC-vlan100] quit

[AC] interface vlan-interface 100

[AC-Vlan-interface100] ip address 10.1.1.46 24

[AC-Vlan-interface100] quit

# Create VLAN 200 and VLAN-interface 200, and assign an IP address to the VLAN interface.  VLAN 200 will be used for client access.

[AC] vlan 200

[AC-vlan200] quit

[AC] interface vlan-interface 200

[AC-Vlan-interface200] ip address 10.1.2.1 24

[AC-Vlan-interface200] quit

# Configure GigabitEthernet 1/0/1 (the port connected to the switch) as a trunk port, and assign the port to VLAN 100 and VLAN 200.

[AC] interface gigabitethernet 1/0/1

[AC-GigabitEthernet1/0/1] port link-type trunk

[AC-GigabitEthernet1/0/1] port trunk permit vlan 100 200

[AC-GigabitEthernet1/0/1] quit

4.     Configure EAP relay as the method for the 802.1X module to exchange packets with the local RADIUS server.

[AC] dot1x authentication-method eap

5.     Configure a RADIUS scheme:

# Create a RADIUS scheme named 1x-local and enter its view.

[AC] radius scheme 1x-local

# Specify the server at 10.1.2.1 as the primary authentication server and set the shared key of authentication packets to 12345678 in plaintext form.

[AC-radius-1x-local] primary authentication 10.1.2.1

[AC-radius-1x-local] key authentication simple 12345678

# Exclude the domain name from the usernames sent to the RADIUS server.

[AC-radius-1x-local] user-name-format without-domain

[AC-radius-1x-local] quit

6.     Configure an authentication domain:

# Create an ISP domain named 1x-local and enter its view.

[AC] domain 1x-local

# Configure the ISP domain to use RADIUS scheme 1x-local for LAN user authentication and authorization and to not perform accounting for LAN users.

[AC-isp-1x-local] authentication lan-access radius-scheme 1x-local

[AC-isp-1x-local] authorization lan-access radius-scheme 1x-local

[AC-isp-1x-local] accounting lan-access none

[AC-isp-1x-local] quit

7.     Configure a RADIUS user:

# Create a network access user named dot1x and enter its view.

[AC] local-user dot1x class network

# Set the user password to 123456 in plaintext form.

[AC-luser-network-dot1x] password simple 123456

# Allow the user to use the LAN access service.

[AC-luser-network-dot1x] service-type lan-access

# Assign the network-operator user role to the user.

[AC-luser-network-dot1x] authorization-attribute user-role network-operator

[AC-luser-network-dot1x] quit

8.     Configure EAP authentication on the RADIUS server:

# Set the EAP authentication method to peap-mschapv2.

[AC] eap-profile dot1x

[AC-eap-profile-dot1x] method peap-mschapv2

# Specify a CA certificate for EAP authentication.

[AC-eap-profile-dot1x] ca-file ca.pem

# Specify a local certificate for EAP authentication.

[AC-eap-profile-dot1x] certificate-file server.pem

# Specify the private key file of the local certificate for EAP authentication.

[AC-eap-profile-dot1x] private-key-file server.pem

# Configure the private key password of the local certificate.

[AC-eap-profile-dot1x] private-key-password simple whatever

[AC-eap-profile-dot1x] quit

# Specify an EAP profile for the local RADIUS server.

[AC] radius-server eap-profile dot1x

9.     Specify the RADIUS client at 10.1.2.1 and set the shared key to 12345678 in plaintext form for secure communication with the client.

[AC] radius-server client ip 10.1.2.1 key simple 12345678

10.     Restart the RADIUS server and activate the RADIUS server settings.

[AC] radius-server activate

11.     Configure a service template:

# Create a service template named 1x-local and enter its view.

[AC] wlan service-template 1x-local

# Set the SSID of the service template to dot1x-local.

[AC-wlan-st-1x-local] ssid dot1x-local

# Assign clients coming online through the service template to VLAN 200.

[AC-wlan-st-1x-local] vlan 200

# Set the AKM mode to 802.1X.

[AC-wlan-st-1x-local] akm mode dot1x

# Set the cipher suite to CCMP.

[AC-wlan-st-1x-local] cipher-suite ccmp

# Enable the RSN IE in beacon and probe responses.

[AC-wlan-st-1x-local] security-ie rsn

# Set the authentication mode to 802.1X.

[AC-wlan-st-1x-local] client-security authentication-mode dot1x

# Specify ISP domain 1x-local for authenticating 802.1X clients.

[AC-wlan-st-1x-local] dot1x domain 1x-local

# Enable the AC to forward client data traffic. If the AC forwards client data traffic by default, skip this step.

[AC-wlan-st-1x-local] client forwarding-location ac

# Enable the service template.

[AC-wlan-st-1x-local] service-template enable

[AC-wlan-st-1x-local] quit

12.     Configure AP settings:

 

IMPORTANT: In a large-scale network, configure AP groups as a best practice.

 

# Create a manual AP named aptest and enter its view.

[AC] wlan ap aptest model WA6320

# Specify the serial ID of the AP.

[AC-wlan-ap-aptest] serial-id 219801A28N819CE0002T

[AC-wlan-ap-aptest] quit

# Create AP group group1 and create an AP grouping rule by AP names to add AP aptest to AP group group1.

[AC] wlan ap-group group1

[AC-wlan-ap-group-group1] ap aptest

# Bind service template 1x-local to radio 1 in AP group group1, and enable radio 1.

[AC-wlan-ap-group-group1] ap-model WA6320

[AC-wlan-ap-group-group1-ap-model-WA6320] radio 1

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-1] service-template 1x-local

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-1] radio enable

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-1] quit

# Bind service template 1x-local to radio 2 in AP group group1, and enable radio 2.

[AC-wlan-ap-group-group1-ap-model-WA6320] radio 2

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-2] service-template 1x-local

[AC-wlan-ap-group-group1-ap-model-WA6320-radio-2] radio enable

[AC-wlan-ap-group-group1-ap-model-WA6320] quit

[AC-wlan-ap-group-group1] quit

Configuring the switch

# Create VLAN 100. The switch will use this VLAN to forward the traffic on the CAPWAP tunnels between the AC and AP.

<Switch> system-view

[Switch] vlan 100

[Switch-vlan100] quit

# Create VLAN 200. The switch will use this VLAN to forward packets for wireless clients.

[Switch] vlan 200

[Switch-vlan200] quit

# Set the link type of GigabitEthernet 1/0/1 (the port connected to the AC) to trunk, and assign the trunk port to VLAN 100 and VLAN 200.

[Switch] interface gigabitethernet 1/0/1

[Switch-GigabitEthernet1/0/1] port link-type trunk

[Switch-GigabitEthernet1/0/1] port trunk permit vlan 100 200

[Switch-GigabitEthernet1/0/1] quit

# Set the link type of GigabitEthernet 1/0/2 (the port connected to the AP) to access, and assign the access port to VLAN 100.

[Switch] interface gigabitethernet 1/0/2

[Switch-GigabitEthernet1/0/2] port link-type access

[Switch-GigabitEthernet1/0/2] port access vlan 100

# Enable PoE on GigabitEthernet 1/0/2.

[Switch-GigabitEthernet1/0/2] poe enable

[Switch-GigabitEthernet1/0/2] quit

# Create VLAN-interface 100 and assign an IP address to the VLAN interface.

[Switch] interface vlan-interface 100

[Switch-Vlan-interface100] ip address 10.1.1.2 24

[Switch-Vlan-interface100] quit

# Create VLAN-interface 200 and assign an IP address to the VLAN interface.

[Switch] interface vlan-interface 200

[Switch-Vlan-interface200] ip address 10.1.2.2 24

[Switch-Vlan-interface200] quit

# Create a DHCP address pool named 100, and specify a subnet and a gateway IP address in the DHCP address pool. The IP address of the AP is assigned from this pool.

[Switch] dhcp server ip-pool 100

[Switch-dhcp-pool-100] network 10.1.1.0 mask 255.255.255.0

[Switch-dhcp-pool-100] gateway-list 10.1.1.2

[Switch-dhcp-pool-100] quit

# Create a DHCP address pool named 200, and specify a subnet, a gateway IP address, and a DNS server in the DHCP address pool. In this example, the address of the DNS server is 10.1.2.2. You must replace it with the actual address of the DNS server on your network. The IP address of the client is assigned from this pool.

[Switch] dhcp server ip-pool 200

[Switch-dhcp-pool-200] network 10.1.2.0 mask 255.255.255.0

[Switch-dhcp-pool-200] gateway-list 10.1.2.1

[Switch-dhcp-pool-200] dns-list 10.1.2.2

[Switch-dhcp-pool-200] quit

# Enable DHCP.

[Switch] dhcp enable

Verifying the configuration

1.     On the client, verify that the client can pass 802.1X authentication, associate with the AP, and access the wireless network after you enter the correct username and password. (Details not shown.)

2.     On the AC, perform the following tasks to verify that the client has passed authentication and come online:

# Display detailed WLAN client information.

[AC] display wlan client verbose

Total number of clients: 1

 

 MAC address                       : 1044-0037-2e9f

 IPv4 address                      : 10.1.2.3

 IPv6 address                      : N/A

 Username                          : dot1x

 AID                               : 1

 AP ID                             : 20

 AP name                           : aptest

 Radio ID                          : 1

 SSID                              : 15209_local_1x_eap_peap_5560h

 BSSID                             : d461-fe62-1537

 VLAN ID                           : 200

 Sleep count                       : 0

 Wireless mode                     : 802.11ac

 Channel bandwidth                 : 80MHz

 SM power save                     : Disabled

 Short GI for 20MHz                : Supported

 Short GI for 40MHz                : Supported

 Short GI for 80MHz                : Supported

 Short GI for 160/80+80MHz         : Not supported

 STBC RX capability                : Supported

 STBC TX capability                : Not supported

 LDPC RX capability                : Supported

 Beamformee STS capability         : 1

 Number of Sounding Dimensions     : 0

 SU beamformee capability          : Supported

 MU beamformee capability          : Supported

 Block Ack                         : N/A

 Supported VHT-MCS set             : NSS1 0, 1, 2, 3, 4, 5, 6, 7, 8, 9

 Supported HT MCS set              : 0, 1, 2, 3, 4, 5, 6, 7

 Supported rates                   : 6, 9, 12, 18, 24, 36,

                                     48, 54 Mbps

 QoS mode                          : WMM

 Listen interval                   : 3

 RSSI                              : 0

 Rx/Tx rate                        : 0/0 Mbps

 Speed                             : N/A

 Authentication method             : Open system

 Security mode                     : RSN

 AKM mode                          : 802.1X

 Cipher suite                      : CCMP

 User authentication mode          : 802.1X

 WPA3 status                       : Disabled

 Authorization CAR                 : N/A

 Authorization ACL ID              : N/A

 Authorization user profile        : N/A

 Roam status                       : N/A

 Key derivation                    : SHA1

 PMF status                        : N/A

 Forwarding policy name            : Not configured

 Online time                       : 0days 0hours 0minutes 6seconds

 FT status                         : Inactive

# Display online 802.1X client information.

[AC] display dot1x connection

Total connections: 1

User MAC address                   : 1044-0037-2e9f

AP name                            : aptest

Radio ID                           : 1

SSID                               : dot1x-local

BSSID                              : d461-fe62-1537

Username                           : dot1x

Authentication domain              : hk-local

IPv4 address                       : 10.1.2.3

Authentication method              : EAP

Initial VLAN                       : 200

Authorization VLAN                 : 200

Authorization ACL number           : N/A

Authorization user profile         : N/A

Authorization CAR                  : N/A

Termination action                 : N/A

Session timeout last from          : N/A

Session timeout period             : N/A

Online from                        : 2020/05/22 11:54:58

Online duration                    : 0h 0m 20s

Configuration files

·     AC:

#

 dot1x authentication-method eap

#

vlan 100

#

vlan 200

#

wlan service-template 1x-local

 ssid dot1x-local

 vlan 200

 client forwarding-location ac

 akm mode dot1x

 cipher-suite ccmp

 security-ie rsn

 client-security authentication-mode dot1x

 dot1x domain 1x-local

 service-template enable

#

interface Vlan-interface100

 ip address 10.1.1.46 255.255.255.0

#

interface Vlan-interface200

 ip address 10.1.2.1 255.255.255.0

#

interface GigabitEthernet1/0/1

 port link-mode bridge

 port link-type trunk

 port trunk permit vlan 1 100 200

#

eap-profile dot1x

 method peap-mschapv2

 ca-file ca.pem

 certificate-file server.pem

 private-key-file server.pem

 private-key-password simple whatever

#

radius-server eap-profile 1x

#

radius-server client ip 10.1.2.1 key simple 12345678

#

local-user dot1x class network

 password simple 12345678

 service-type lan-access

 authorization-attribute user-role network-operator

#

radius scheme 1x-local

 primary authentication 10.1.2.1

 key authentication simple 12345678

 user-name-format without-domain

#

domain 1x-local

 authentication lan-access radius-scheme 1x-local

 authorization lan-access radius-scheme 1x-local

 accounting lan-access none

#

wlan ap-group group1

 ap aptest

 ap-model WA6320

  radio 1

   radio enable

   service-template 1x-local

  radio 2

   radio enable

   service-template 1x-local

  gigabitethernet 1

#

wlan ap aptest model WA6320

 serial-id 219801A28N819CE0002T

#

·     Switch:

#

dhcp enable

#

vlan 100

#

vlan 200

#

dhcp server ip-pool 100

 gateway-list 10.1.1.2

 network 10.1.1.0 mask 255.255.255.0

#

dhcp server ip-pool 200

 gateway-list 10.1.2.1

 network 10.1.2.0 mask 255.255.255.0

 dns-list 10.1.2.2

#

interface Vlan-interface100

 ip address 10.1.1.2 255.255.255.0

#

interface Vlan-interface200

 ip address 10.1.2.2 255.255.255.0

#

interface GigabitEthernet1/0/1

 port link-type trunk

 port trunk permit vlan 1 100 200

#

interface GigabitEthernet1/0/2

 port link-type access

 port access vlan 100

 poe enable

#

Related documentation

·     User Access and Authentication Configuration Guide in H3C Access Controllers Configuration Guides

·     User Access and Authentication Command Reference in H3C Access Controllers Command References

·     WLAN Access Configuration Guide in H3C Access Controllers Configuration Guides

·     WLAN Access Command Reference in H3C Access Controllers Command References