Ask the wikiAI

Port Authentication 802.1x via EAP-TLS

This setup guide describes how to configure port authentication 802.1x via EAP-TLS in the Behnke Station.

It should be noted that the intercom station must have its time synchronized so that authentication can proceed smoothly. This can be achieved, for example, by first connecting the Behnke Station without port authentication to a network with a DHCP server.

It is assumed that the Behnke-Station is already set up to the extent that access to the web interface is possible. If this is not the case, please follow the instructions provided with your base electronics (manuals) and refer to the technical manualRecently updated — within the last 72 hoursUpdated to complete the basic setup.

1. Configuring the Behnke Station

• Open your browser
• Open the web interface of the Behnke Station
• Log in

• Click the menu item Network in the sidebar

• Scroll down to the section Port authentication

• Set the first option Method to the value EAP-TLS

• The input fields required for further configuration are now displayed

• The first setting determines whether authentication is mandatory or optional. If it is set to mandatory, as in the default, the Behnke Station must authenticate itself to the RADIUS server in order to make the network available. If port authentication is switched off or the Behnke Station is operated on another port without an authentication request, the network cannot be established for security reasons:

• Then fill in the Identity field with the value you assigned when creating the certificates.

• Upload the User certificate and the certificate of the Trusted CA using the two buttons provided for each.

• If a private key (client.key) is uploaded and the password for decrypting it is entered, the Behnke Station checks this immediately and displays the result in the web front end, as shown below:

It should also be mentioned that the certificates are checked for validity immediately after upload. Below is an example of what is shown if, for instance, the validity period is not valid. The identities are also displayed immediately in the web front end (in the example user@example.org and the Example Certificate Authority):

Finally, attention should be paid to the formats: for the user certificate, .pem or .crt files are valid, the trusted CA must be in .pem format, and the private key must be in .key or .pem format.

2. FAQ