802.1x / RADIUS
802.1x / RADIUS
802.1x is a port-based authentication standard: a device connected to a switch port must prove its identity before it is allowed onto the network. PrivateLAN includes a RADIUS server that handles this authentication for your switches.
RADIUS clients
Each switch that should authenticate devices via 802.1x must be registered as a RADIUS client (also called a NAS — Network Access Server):
| Field | Description |
|---|---|
| Client name | An identifier for the switch |
| IP address | The switch's management IP address |
| Netmask | The network mask for the client (or subnet of clients) |
| NAS type | The device category, used by FreeRADIUS to interpret vendor attributes |
| Shared secret | A secret used to secure communication between the switch and the RADIUS server |
The number of RADIUS clients you can add is limited by your license. Whenever a client is added, changed or removed, the RADIUS server configuration is updated automatically.
Certificates
802.1x authentication relies on certificates issued by PrivateLAN's own Certificate Authority (CA). On the RADIUS configuration page you can set:
- CA certificate validity — how long the Certificate Authority certificate is valid (default 3650 days)
- Server certificate validity — how long the RADIUS server certificate is valid (default 3650 days)
- Client certificate validity — how long certificates issued to client devices are valid (default 3650 days)
- Certificate passwords — the CA and server passwords protect the private keys that stay on the appliance (internal use only). The client password protects the certificates handed to client devices and is the one you enter when importing a client certificate (PFX / P12) or using its key
Use Provision to (re)generate certificates and restart the RADIUS service after changing these settings.
Monitoring
The RADIUS overview page shows:
- The most recent authentication events and errors from the RADIUS log
- The status of the CA and server certificates (common name, alternative names, issue date, expiry date, and remaining validity)
- A downloadable Certificate Revocation List (CRL) listing revoked client certificates
How it fits together
Each switch that PrivateLAN manages is registered both as a switch (see Switch Management) and, for 802.1x, as a RADIUS client using the same management IP address. The switch and the RADIUS server authenticate each other using the shared secret, while devices connecting to switch ports authenticate using certificates issued by PrivateLAN's CA.
