I wanted to setup a 802.1x authentication on our Juniper ethernet switches. I did not find much documentation. Here are the main steps.
- Setup a RADIUS on a Windows server
- Define a policy in the RADIUS to authenticate switches against AD
- Define the RADIUS parameters in the switches
protocols {
dot1x {
authenticator {
authentication-profile-name profile1;
interface {
ge-0/0/31.0 {
supplicant single;
mac-radius { // because we are using VoIP phones on the same port
authentication-protocol pap;
}
}
}
}
}
access {
radius-server {
172.16.1.1 secret "$9$dx/9pKvEm.LdwglKYoJG.mAp0"; ## SECRET-DATA
}
profile profile1 {
authentication-order radius;
radius {
authentication-server 172.16.1.1;
}
}
}
- Add a user with the mac address and a password equals to the mac address in the AD (to authenticate VoIP phone)
- Start Wired Autoconfig service in Windows
- Configure the properties of the network card to authenticate against the RADIUS
No comments:
Post a Comment