802.1X AUTHENTICATION IN ACKSYS BRIDGES AND ACCESS POINTS

Transcription

1 APPLICATION NOTE Ref APNUS004 rev. A-0, March 08, X AUTHENTICATION IN ACKSYS BRIDGES AND ACCESS POINTS Why? In addition to MAC address filtering, ACKSYS products support a more reliable authentication method, called 802.1x, which builds on clients authentication. This method is now part of the new i norm (the last version is also known as WPA2). Authentication brings together several pieces: - The client, also known as supplicant or Wireless Node (WN), is the entity that asks to be identified in order to gain access to network resources. - The WiFi wireless access point also known as the authenticator. - The authentication server (IAS), usually a RADIUS (Remote Authentication Dial-In User Service) server. For information, a RADIUS server is provided in Windows 2003 Server and is available in Linux. - The authentication method. There are several available, which offer varying levels of security, depending on the authentication mechanisms (login/password or certificate) installed on both server and client sides. List of ACKSYS products concerned: WLg-ABOARD/N WLg-LINK WLg-LINK-OEM Page 1 of 6

2 Functions available in the ACKSYS products: - The authenticator function (which obviously requires the product to be set in Access Point mode), is supported. - The supplicant function (which obviously requires the product to be set in Bridge mode) is not supported yet. How does it work? The first step is for the client to associate itself with the access point (path 1 on the picture). This step is of course a prerequisite to the 802.1x authentication step. As long as it is not authenticated, the client has no access to the network behind the access point, the access point will only relay to the authentication server the client frames concerning the authentication process (path 2 on the picture). Once the client is authenticated, its traffic is no more stopped by the access point (path 3 on the picture) and the client gains access to network resources. It must be recalled that 802.1x also offers a mechanism to exchange keys which will be used to encipher communications and check their integrity. Page 2 of 6

3 The authentication methods All kinds of methods build on the same protocol named EAP (Extensible Authentication Protocol) The four mainly used methods are: - EAP-MD5 : no mutual authentication between the client and the RADIUS server, the client authenticates itself with a password; - EAP-TLS : mutual authentication between the client and the RADIUS server using certificates (on both client and server sides); - EAP-TTLS et EAP-PEAP : mutual authentication between the client and the RADIUS server using a certificate on the server side, but the client can use a login/password pair identifier; Recall that the access point needs not to know the actual method used, only the supplicant and the authentication server use it. The choice of one out of several methods depends, on one hand, on the methods available to both the supplicant and the server; and on another hand, on the required level of security. For example, a Windows XP SP2 supplicant routinely handles: - PEAP with login and password authentication (also known as MSCHAP Version 2) and also authentication using certificates. In other words, an access point handles any method, as do the ACKSYS access points. In the following picture, we describe the EAP (802.1x) menu which contains all the parameters required for 802.1x setup, when the ACKSYS product is setup as an AUTHENTICATOR-enabled access point. Conversely, if the ACKSYS product is setup as a client (understand it is in bridge mode), it does not support 802.1x authentication directly. Hence it is not possible to implement the supplicant function in an ACKSYS bridge. Page 3 of 6

4 The EAP (802.1x) menu Prerequisites Be warned that, per definition, only the WPA ENTERPRISE mode allows use of the 802.1x authentication. The WPA-PSK mode is a degenerated, authentication-less mode. It can only encipher data. In addition you are reminded that 802.1x authentication is available only in ACCESS POINT mode, through the AUTHENTICATOR function. The 802.1x SUPPLICANT function in BRIDGE mode is not as yet supported. The EAP (802.1x) menu is thus available only in ACCESS POINT mode, and only if the WPA-ENTERPRISE mode was chosen. This menu sets up the access point in order to allow a supplicant to authenticate itself against a RADIUS. A button allows you to define the parameters for a second RADIUS server, only the authentication timeout being common to both. Page 4 of 6

5 authentication timeout field As soon as the delay (indicated in this field as a number of minutes) ends, the client must re-authenticate. RADIUS SERVER IP ADDRESS field This field contains the IP address of the RADIUS server. Conversely, on the RADIUS server you must install the address of the RADIUS client, which is the IP address of the access point. RADIUS SERVER SHARED SECRET field This field is a string used as a password between the access point (the RADIUS client) and the RADIUS server. The shared secrets are used to check that the RADIUS messages, with the exception of the access request message, are sent by a RADIUScompatible device configured with the same shared secret. The shared secrets are also used to control that the RADIUS messages were not changed during transit (message integrity check). The shared secrets are also used to encipher several RADIUS attributes, like the User- Password and the Tunnel-Password. While creating and using a shared secret: you must use the same shared secret, case-sensitive, on both RADIUS devices; you must use a different shared secret for every RADIUS server RADIUS client pair; you can specify up to 64 characters in the shared secret. In order to protect your IAS server and your RADIUS clients against brute force attacks, use long shared secrets (over 22 characters); the shared secret must be changed frequently, and must be made of a random sequence of letters, numbers and punctuation, in order to protect your IAS server and your RADIUS clients against dictionary attacks. Page 5 of 6

6 RADIUS SERVER PORT field The RADIUS client uses this UDP port to target the RADIUS server when it issues authentication requests. The value 1812 is the standard RADIUS port defined in RFC However many access servers use the obsolete port 1645 for authentication requests. Whichever number you choose, check that the IAS service and your access point are configured with the same value. MAC ADDRESS AUTHENTIFICATION field If this box is checked, the supplicant MAC address control is added to the authentication. In other words the supplicant must always connect to the same access point. Page 6 of 6