Setup IEEE 802.1x Access Control (Authentication and Accounting)

- What is IEEE 802.1x ?

  - IEEE 802.1x Introduction

  - Authentication Port State and Authentication Control

  - Re-Authentication

  - EAPOL

- Setup 802.1x in Wireless Access Point

  - Enable 802.1x

  - Using Internal Authentication Server

  - Using External RADIUS Authentication Server

  - Using Internal RADIUS Authentication Server

- Setup 802.1x client in the Station

Configure 802.1x and WPA

- What is the WPA Functionality?
- Configuration for Access Point
- Configuration for your PC

- IEEE 802.1x Introduction

IEEE 802.1x port-based authentication is desired to prevent unauthorized devices (clients) from gaining access to the network. As LANs extend to hotels, airports, and corporate lobbies, insecure environments could be created.

802.1x port-based network access control makes use of the physical access characteristics of IEEE 802 LAN infrastructures, such as 802.3 Ethernet, 802.11 Wireless LAN and VDSL LRE (Long Reach Ethernet), in order to provide a means of authenticating and authorizing devices attached to a LAN port that has point-to-point connection characteristics, and of preventing access to that port in cases the authentication process fails.

IEEE 802.1x authentication is a client-server architecture delivered with EAPOL (Extensible Authentication Protocol over LAN). The authentication server authenticates each client connected to a Access Point (For Wireless LAN) or switch port (for Ethernet) before accessing any services offered by the Wireless AP. 802.1x contains tree major components :

1. Authenticator :

The device (i.e. Wireless AP) facilitates authentication for the supplicant (Wireless client) attached on the Wireless network.

Authenticator controls the physical access to the network based on the authentication status of the client. The authenticator acts as an intermediary (proxy) between the client and the authentication server (i.e. RADIUS server), requesting identity information from the client, verifying that information with the authentication server, and relaying a response to the client.

2. Supplicant :

The station (i.e. Wireless client) is being authenticated by an authenticator attached on the Wireless network. The supplicant

requests access to the LAN services and responds to the requests from the authenticator. The station must be running 802.1x-compliant client software such as that offered in the Microsoft Windows XP operating system, Meeting House AEGIS 802.1x client and Odyssey 802.1x client.

3. Authentication Server :

The device (i.e. RADIUS server) provides an authentication service to an authenticator. This service determines, from the credentials provided by the supplicant, whether the supplicant is authorized to access the services provided by the authenticator.

The authentication server performs the actual authentication of the client. It validates the identity of the supplicant. Because the authenticator acts as the proxy, the authentication service is transparent to the supplicant.

Some Wireless AP (i.e. ZyXEL Wireless AP) have built-in authentication server, external RADIUS authentication server is not needed. In this case, Wireless AP is acted as both authenticator and authentication server.

- Authentication Port State and Authentication Control

The port state determines whether or not the supplicant (Wireless Client) is granted access to the network behind Wireless AP. There are two authentication port state on the AP, authorized state and unauthorized state.

By default, the port starts in the unauthorized state. While in this state, the port disallows all incoming and outgoing data traffic except for 802.1x packets. When a supplicant is successfully authenticated, the port transitions to the authorized state, allowing all traffic for the client to flow normally. If a client that does not support 802.1x is connected to an unauthorized 802.1x port, the authenticator requests the client’s identity. In this situation, the client does not respond to the 802.1x request, the port remains in the unauthorized state, and the client is not granted access to the network.

When 802.1x is enabled, the authenticator controls the port authorization state by using the following control parameters. The following three authentication control parameter are applied in Wireless AP.

1. Force Authorized : Disables 802.1x and causes the port to transition to the authorized state without any authentication exchange required. The port transmits and receives normal traffic without 802.1x-based authentication of the client. This is the default port control setting. While AP is setup as Force Authorized, Wireless client (supported 802.1x client or none-802.1x client) can always access the network.

2. Force Unauthorized : Causes the port to remain in the unauthorized state, ignoring all attempts by the client to authenticate. The authenticator cannot provide authentication services to the supplicants through the port. While AP is setup as Force Unauthorized, Wireless clients (supported 802.1x client or none-802.1x client) never have the access for the network.

3. Auto : Enables 802.1x and causes the port to begin in the unauthorized state, allowing only EAPOL frames to be sent and received through the port. The authentication process begins when the link state of the port transitions from down to up, or when an EAPOL-start frame is received requests the identity of the client and begins relaying authentication messages between supplicant and the authentication server. Each supplicant attempting to access the network is uniquely identified by the authenticator by using the client’s MAC address. While AP is setup as Auto, only Wireless client supported 802.1x client can access the network.

- Re-Authentication

The administrator can enable periodic 802.1x client re-authentication and specify how often it occurs. When re-authentication time out, Authenticator will send EAP-Request/ Identity to reinitiate authentication process.
In ZyXEL Wireless AP 802.1x implementation, if you do not specify a time period before enabling re-authentication, the number of seconds between re-authentication attempts is 1800 seconds (30 minutes).

- EAPOL (Extensible Authentication Protocol over LAN)

Authenticators and supplicants communicate with one another by using the Extensible Authentication Protocol (EAP, RFC-2284). EAP was originally designed to run over PPP and to authenticate dial-in users, but 802.1x defines an encapsulation method for passing EAP packets over Ethernet frames. This method is referred to as EAP over LANs, or EAPOL. Ethernet type of EAPOL is 88-8E , two octets in length. EAPOL encapsulations are described for IEEE 802 compliant environment, such as 802.3 Ethernet, 802.11 Wireless LAN and Token Ring/FDDI.

The EAP protocol can support multiple authentication mechanisms, such as MD5-challenge, One-Time Passwords, Generic Token Card, TLS and TTLS etc. Typically, the authenticator will send an initial Identity Request followed by one or more Requests for authentication information. When supplicant receive the EAP request, it will reply associated EAP response. So far, ZyXEL Wireless AP only supports MD-5 challenge authentication mechanism, but will support TLS and TTLS in the future.

EAPOL Exchange between 802.1x Authenticator and Supplicant

The authenticator or the supplicant can initiate authentication. If you enable 802.1x authentication on the Wireless AP, the authenticator must initiate authentication when it determines that the Wireless link state transitions from down to up. It then sends an EAP-request/identity frame to the 802.1x client to request its identity (typically, the authenticator sends an initial identity/request frame followed by one or more requests for authentication information). Upon receipt of the frame, the supplicant responds with an EAP-response/identity frame.

However, if during bootup, the supplicant does not receive an EAP-request/identity frame from the Wireless AP, the client can initiate authentication by sending an EAPOL-Start frame, which prompts the switch to request the supplicant’s identity. In above case, authenticator co-locate with authentication server. When the supplicant supplies its identity, the authenticator directly exchanges EAPOL to the supplicant until authentication succeeds or fails. If the authentication succeeds, the port becomes authorized. If the authentication fails, the port becomes unauthorized. When the supplicant does not need Wireless access any more, it sends EAPOL-Logoff packet to terminate its 802.1x session, the port state will become unauthorized. The following figure shows the EAPOL exchange ping-pong chart.

The EAPOL packet contains the following fields: protocol version, packet type, packet body length and packet body. Most of the fields are obvious. The packet type can have four different values, and these values are described below:

- EAP-Packet : Both the supplicant and the authenticator send this packet when authentication is taking place. This is the packet that contains either the MD5-Challenge or TLS information required for authentication.
- EAPOL-Start : This supplicant sends this packet when it wants to initiate the authentication process.
- EAPOL-Logoff : The supplicant sends this packet when it wants to terminate its 802.1x session.
- EAPOL-Key : This is used for TLS authentication method. The Wireless AP uses this packet to send the calculated WEP key to the supplicant after TLS negotiation has completed between the supplicant and the RADIUS server.

IEEE 802.1x Configuration in ZyXEL Wireless Access Point

- Enable 802.1x in AP

When the IEEE 802.1x authentication is enabled, the wireless client must be authenticated by the ZyXEL AP before it can communicate on your network through ZyXEL AP. By default, the 802.1x function is disabled (Authentication Control= Force Authorized) to allow all wireless client. You can use SMT or Web Configuration to configure it.

Enter SMT Menu 23.4 to setup the 802.1x authentication control.

`` Menu 23.4 - System Security - IEEE802.1X Wireless Port Control= No Access Allowed/No Authentication Required/ Authentication Required ReAuthentication Timer (in second)= 1800 Idle Timeout (in second)= 3600 Key Management Protocol= 802.1x/WPA/WPA-PSK

Key Settings :

Option | Descriptions
Wireless Port Control | To control wireless clients access to the wired network, select a control method from the drop-down list box. Choose from No Authentication Required, Authentication Required and No Access Allowed. No Authentication Required allows all wireless stations access to the wired network without entering usernames and passwords. This is the default setting. Authentication Required means that all wireless stations have to enter usernames and passwords before access to the wired network is allowed. No Access Allowed blocks all wireless stations access to the wired network. Select Authentication Required to configure Key Management Protocol and other related fields.
Key Management Protocol | Choose 802.1x from the drop-down list.

If you use WEB Configuration,

1. From the Web Configurator main menu, go to Main Menu->WIRELESS->802.1x/WPA.
2. In the Wireless Port Control, select Authentication Required option.
3. In the Key Management Protocol, select 802.1x to enable 802.1x authentication function.
4. Click Apply to make your setting work.

After 802.1x authentication function is enabled, you have to setup the authentication server, you may use internal authentication server inside ZyXEL wireless AP or E xternal RADIUS authentication server or Internal RADIUS authentication server.

- Using Internal Authentication Server

ZyXEL Wireless Access Point has an internal authentication server for authenticating the wireless 802.1x client users. It builds total 32-users database and allows up to 32 authorized users to login to the Wireless AP simultaneously. When you use internal authentication server, ZyXEL wireless AP is acted as Authenticator and Authentication Server.

By storing wireless 802.1x client profiles locally, your ZyXEL AP is able to authenticate wireless client without interacting with a extra network RADIUS server. Follow the steps to add user accounts on your ZyXEL AP.

1. From the SMT main menu, enter 14 to display Menu 14 Dial-in User Setup

`` Menu 14 - Dial-in User Setup 1. support 9. ________ 17. ________ 25. ________ 2. ________ 10. ________ 18. ________ 26. ________ 3. ________ 11. ________ 19. ________ 27. ________ 4. ________ 12. ________ 20. ________ 28. ________ 5. ________ 13. ________ 21. ________ 29. ________ 6. ________ 14. ________ 22. ________ 30. ________ 7. ________ 15. ________ 23. ________ 31. ________ 8. ________ 16. ________ 24. ________ 32. ________ Enter Menu Selection Number:

2. Type a number and press [Enter] to edit the wireless 802.1x client profile

`` Menu 14.1 - Edit Dial-in User User Name= support Active= Yes Password= ******** Press ENTER to Confirm or ESC to Cancel:

Key settings :

Option | Descriptions
User Name | Enter a username up to 31 alphanumeric characters long.
Active | Press [SPACE BAR] to select Yes and press [Enter] to activate this 802.1x client profile.
Password | Enter a password up to 31 characters long.

If you use WEB Configurator,

1. From the Web Configurator main menu, go to Main Menu->AUTH. SERVER->Trusted Users.
2. Select one of the profile and fill in the User Name and Password, then click Apply to make your setting work.

- Using External RADIUS Authentication Server

In addition to the internal authentication server inside ZyXEL AP, you can use external RADIUS authentication server to centrally manage the user account profile. RADIUS is based on a client-server model that supports authentication, authorization and accounting. The wireless AP is the client and the server is the RADIUS server.

The authenticator includes the RADIUS client, which is responsible for encapsulating and decapsulating the Extensible Authentication Protocol (EAP) frames and interacting with the authentication server. When the authenticator receives EAPOL frames and relays them to the authentication server, the Ethernet header is stripped and the remaining EAP frame is re-encapsulated in the RADIUS format. The EAP frames are not modified or examined during encapsulation, and the authentication server must support EAP within the native frame format. When the authenticator receives frames from the authentication server, the server’s frame header is removed, leaving the EAP frame, which is then encapsulated for Ethernet and sent to the supplicant.

When the client supplies its identity, the authenticator begins its role as the intermediary, passing EAP frames between the supplicant and the authentication server until authentication succeeds or fails. If the authentication succeeds, the switch port becomes authorized. The specific exchange of EAP frames depends on the authentication method being used. The figure below shows a message exchange initiated by the client using the MD5 Challenge authentication method with a RADIUS server.

1. From the SMT main menu, enter Menu 23.2 to setup System Security - RADIUS Server to setup the External RADIUS authentication server.

`` Menu 23.2 - System Security - RADIUS Server Authentication Server: Active= Yes Server Address= 220.130.46.196 Port #= 1812 Shared Secret= ******** Accounting Server: Active= No Server Address= 0.0.0.0 Port #= 1813 Shared Secret= ****** Press ENTER to Confirm or ESC to Cancel:

Option | Descriptions
Active | Press [SPACE BAR] to select Yes and press [Enter] to enable 802.1x user authentication through an external RADIUS authentication server. Select No to enable authentication using ZyXEL AP internal authentication server.
Server Address | Enter the IP address of the external RADIUS authentication server.
Port | The default port of RADIUS server for authentication is 1812. You need not change this value unless your network administrator instructs you to do so.
Shared Secret | Specify a password (up to 31 characters) as the key to be shared between external RADIUS authentication server and ZyXEL AP (RADIUS client). The key is not send to the network. This key must be the same on the external RADIUS authentication server and ZyXEL AP.

2. If accounting is required, you must setup the external RADIUS accounting server. Normally, RADIUS authentication server and RADIUS accounting server are put in the same machine. However, they own separated UDP port and shared secret, you can separate authentication and accounting service in two different RADIUS servers. You can refer to RADIUS authentication configuration.

If you use WEB Configuration,

1. From the Web Configurator main menu, go to Main Menu->WIRELESS->802.1x/WPA.
2. click External RADIUS Server option, and click Active.
3. After you've done the settings, click Apply to make your setting work.

Key settings for External Authentication Server:

Field | Description

External RADIUS Server | Select the radio button to use an External RADIUS Server to authenticate the ZyAIR’s wireless clients.
Authentication Server
Active | Select the check box to enable user authentication through an external authentication server.
Server IP Address | Type the IP address of the external authentication server in dotted decimal notation.
Port Number | Type the port number of the external authentication server. The default port number is 1812. You need not change this value unless your network administrator instructs you to do so with additional information.
Shared Secret | Type a password (up to 31 alphanumeric characters) as the key to be shared between the external authentication server and the ZyAIR. The key must be the same on the external authentication server and your ZyAIR. The key is not sent over the network.
Alternate Authentication Server | If the ZyAIR cannot authenticate wireless users using the Authentication Server, the Alternate Authentication Server is used. The ZyAIR will attempt to authenticate three times before using the Alternate Authentication Server. Requests can be issued from the client interface to use the alternate authentication server. The length of time for each authentication is decided by the wireless client or based on the configuration of the ReAuthentication Timer field in the 802.1x/WPA screen.

- Using Internal RADIUS Authentication Server

1. From the SMT main menu, enter Menu 23.2 to setup System Security - RADIUS Server to setup the Internal RADIUS authentication server.

`` Menu 23.2 - System Security - RADIUS Server Authentication Server: Active= Yes Server Address= 127.0.0.1 Port #= 1812 Shared Secret= ***** Accounting Server: Active= Yes Server Address= 192.168.1.100 Port #= 1813 Shared Secret= ****** Press ENTER to Confirm or ESC to Cancel:

Key settings for authentication server:

Option | Descriptions
Active | Press [SPACE BAR] to select Yes and press [Enter] to enable 802.1x user authentication through an external RADIUS authentication server. Select No to enable authentication using ZyXEL AP internal authentication server.
Server Address | You must enter 127.0.0.1 IP address to enable the Internal RADIUS Server option.
Port | If you use Internal RADIUS Server , you should set the default port of the RADIUS server.
Shared Secret | If you use Internal RADIUS Server , keep the default settings in it.

Note : If you use SMT menu to do the settings, you can't choose authentication type and Dynamic WEP Key Exchange settings, you can only use the default settings.

If you use WEB Configuration,

1. From the Web Configurator main menu, go to Main Menu->WIRELESS->802.1x/WPA.
2. click Internal RADIUS Server option, and choose the settings which you want.
3. After you've done the settings, click Apply to make your setting work.

Key settings for External Authentication Server:

Field | Description

Dynamic WEP Key Exchange | This field is activated only when you select Authentication Required in the Wireless Port Control field. Also set the Authentication Databases field to External RADIUS Server. Local user database may not be used. Select Disable to allow wireless stations to communicate with the access points without using dynamic WEP key exchange. Select 64-bit WEP or 128-bit WEP to enable data encryption. Up to 32 stations can access the ZyAIR when you configure dynamic WEP key exchange.
Internal RADIUS Server | Select this radio button to use the ZyAIR’s Internal RADIUS Server. Select the MD5 radio buttion to use this EAP authentication type to authenticate other AP’s or wireless clients in other wireless networks. Select the PEAP radio button to use this EAP authentication type to authenticate other AP’s or wireless clients in other wireless networks. Use the drop-down list box to select Disable, 64-bit WEP or 128-bit WEP for Dynamic WEP Exchange. Note: EAP-MD5 cannot be used with Dynamic WEP Key Exchange.

Configure 802.1x and WPA

- Introduction

What is WPA Functionality?

Wi-Fi Protected Access (WPA) is a subset of the IEEE 802.11i security specification draft. Key differences between WAP and WEP are user authentication and improved data encryption WAP applies IEEE 802.1x Extensible Authentication Protocol (EAP) to authenticate wireless clients using an external RADIUS database. You can not use the ZyAIR's local user database for WPA authentication purpose since the local user database uses MD5 EAP which can not to generate keys.

WPA improves data encryption by using Temporal Key Integrity Protocol (TKIP), Message Integrity Check and IEEE 802.1x. Temporal Key Integrity Protocol uses 128-bits keys that are dynamically generated and distributed by the authentication server. It includes a per-packet key mixing function, a Message Integrity Check (MIC) named Michael, an extend initialization vector (IV) with sequencing rules and a re-keying mechanism.

If you do not have an external RADIUS, server, you should use WPA-PSK (WPA Pre-Share Key) that only requires a single (identical) password entered into each access point, wireless gateway and wireless client. As long as the password match, a client will be granted access to a WLAN.

Here comes WPA-PSK Application example for your reference.

- Configuration for Access point

The IEEE 802.1x standard outlines enhanced security methods for both the authentication of wireless stations and encryption key management. Authentication cabn be done using local user database internal to the ZyAIR (authenticate up to 32 users) or an external RADIUS server for an unlimited number of users.

1. To change your ZyAIR's authentication settings, click the wireless Wireless link under Advanced.

2. Select 802.1x/WPA tab.

3. choose Authentication Required from the Wireless Port Control.

4. Select the WAP-PSK in the Key Management Protocol field.

5. Type the Pre Shared Key in the Pre-Shared Key field.

6. Click Apply to finish.

- Configuration for your PC

1. Double click on your wireless utility icon(here is the Centrion on Windows XP) in your windows task bar the utility will pop up on your windows screen.

2. Select the wireless card that you want to configure.

3. Select on from the Switch Radio.

4. choose Network option.

5. Add a new wireless profile.

6. Type the Profile Name and Network Name (SSID) in the field.

7. Click Next button.

8. Select WPA-PSK from the Network Authentication field.

9. Select TKIP from the Data Encryption field.

10. Type the Pre Share Key (8-63 character) in the Pass phrase field.

11. Click Finish to exit the Profile Wizard screen.

12. After you finished the profile settings, choose the profile you configured. Then, click Connect button to associate with the Access Point.

13. Click the General option, we will see the following information, that means the PC associated and authenticated with AP successfully.