AMIGOPOD PowerConnect W Clearpass 100 Software User manual

RADIUS 802.1X/EAP Setup
This is a draft guide until a full technote with a walkthrough is available.
Tested with amigopod RADIUS Services 2.0.16 which is the current 2.1 release
candidate.
802.1X/EAP Configuration
First navigate to RADIUS Services > EAP & 802.1X
Now create a self-signed digital certificate for this server by clicking the Create
Server Certificate link
Complete the Create RADIUS Server Certificate form – this certificate will be used
to identify the server in EAP-TLS protocol (and derived protocols i.e. PEAP)
Click the Continue button to proceed to the Sign RADIUS Server Certificate form.
This will be filled out with defaults based on the previous page.

Modify these parameters if appropriate – note that the default CA certificate
expiration is set for 10 years. In particular, the “Common Name” of the certificate
will be used to identify it to clients installing it as a trusted CA root, so choose a
sensible name.
Click the Continue button to proceed to the summary screen.

The details of the certificates are shown. To enable these certificates for use in EAP-
TLS, EAP-TTLS and PEAP, select the Use this certificate to identify this RADIUS
server checkbox and click Apply Settings.

RADIUS server will need to be restarted to complete these changes, but don’t do this
just yet as some additional configuration options must be selected. Click the EAP
Configuration command link.
In the EAP Configuration form, select the EAP types that are to be supported.
To enable the common case of PEAPv0/MS-CHAPv2 (broadly supported by all
wireless clients that implement 802.1X), complete the form as shown below:
Click the Save Changes button. Now restart the RADIUS Server. This will apply
the configuration and make it live.
You can verify that the EAP configuration is loaded by checking for a certain startup
message on the RADIUS Server Control screen:
Tue Nov 17 01:04:05 2009 : Info: rlm_eap_tls: Loading the
certificate file as a chain
Now, the certificate authority used to issue the server’s certificate must be exported.
To do this, navigate to RADIUS Services > EAP & 802.1X and click the Export
Server Certificate command link.
In the Export Server Certificate form, select “CA issuer certificate only” and use the
default PKCS#7 container format.

Click the Download File button and a file named amigopod Certificate
Authority.p7b will be downloaded (the precise name depends on the common name
for the CA certificate).
This file must be imported as a trusted root certification authority on any client
wishing to authenticate using this RADIUS Server. The reason for this is that the
server’s identity must be established via a trusted root CA in order for authentication
to proceed. When using a well-known third party CA, this step does not need to be
performed as the necessary trust relationship already exists in most clients.
Importing a root CA in Windows Vista
See the following screenshots for guidance.
Open the .p7b file from Windows Explorer:
Select the certificate in the list. Right-click it and choose Open

Click the Install Certificate… button

Click the Browse… button to select the Trusted Root Certification Authorities store:

Make sure that the imported CA is specified as a Trusted Root Certification Authority
for the wireless network connection that is using PEAP.

Successful PEAP Authentication
Tue Nov 17 01:20:13 2009 : Auth: Login OK:
[[email protected]] (from client linksys port 21 cli
001c2603de08)
Tue Nov 17 01:20:13 2009 : Auth: Login OK:
[[email protected]] (from client localhost port 0)
Tue Nov 17 01:20:13 2009 : Info: rlm_eap_mschapv2:
Issuing Challenge
Tue Nov 17 01:20:13 2009 : Error: rlm_eap: SSL error
error:00000000:lib(0):func(0):reason(0)
Tue Nov 17 01:20:13 2009 : Error: rlm_eap: SSL error
error:00000000:lib(0):func(0):reason(0)
Tue Nov 17 01:20:13 2009 : Error: TLS_accept:error in
SSLv3 read client certificate A
Tue Nov 17 01:20:13 2009 : Info: rlm_eap_mschapv2:
Issuing Challenge
Note that the “SSL error” messages indicated are not in fact errors – there is no client
certificate in PEAP, and so these spurious error messages are generated.