Tuesday, March 28, 2017

Using 802.1x protocol with Windows and Juniper switches

I wanted to setup a 802.1x authentication on our Juniper ethernet switches. I did not find much documentation. Here are the main steps.

  • Setup a RADIUS on a Windows server
  • Define a policy in the RADIUS to authenticate switches against AD
  • Define the RADIUS parameters in the switches

protocols {
    dot1x {
        authenticator {
            authentication-profile-name profile1;
            interface {
                ge-0/0/31.0 {
                    supplicant single;
                    mac-radius {     // because we are using VoIP phones on the same port
                        authentication-protocol pap;
                    }
                }
            }
        }
    }
access {
    radius-server {
        172.16.1.1 secret "$9$dx/9pKvEm.LdwglKYoJG.mAp0"; ## SECRET-DATA
    }
    profile profile1 {
        authentication-order radius;
        radius {
            authentication-server 172.16.1.1;
        }
    }
}
  • Add a user with the mac address and a password equals to the mac address in the AD (to authenticate VoIP phone)
  • Start Wired Autoconfig service in Windows
  • Configure the properties of the network card to authenticate against the RADIUS

No comments: