Configuring 802.1X for eLux

Note:

802.1X can be configured for LAN or WLAN.The procedure differs in the location of the configuration file and in some parameters.For further information, see Configuring WPA supplicant.

1. Make sure that the eLux package WLAN drivers and the included feature package WPA supplicant are installed on the devices. This may require modifications of the image definition file on the web server via ELIAS.

2. Transfer the required certificates to the devices to /setup/cacerts by using the Scout feature Files configured for transfer.

   Note:

   The certificates of your RADIUS environment require the FQDN for the Common Name (CN).

3. Configure the file wpa.conf, and then transfer the configuration file to the devices by using the Scout feature Files configured for transfer.For further information, see Configuring WPA supplicant.
4. If you use SCEP, alternatively generate the file wpa.conf from the template wpa.conf.scep.For further information, see WPA configuration via template.
5. Only LAN: In the Scout Console, for the relevant OU, in the device configuration under Network > LAN > Advanced > IEEE 802.1X authentication, select the Activate option.

If the configuration is correct and the required certificates are rolled out, you can use devices on the 802.1X port.

Choosing Between SCEP and EST for LAN

For LAN 802.1X, a client certificate can come from either SCEP or EST. If only one is enabled, that source is used automatically. If both are enabled, PreferForLanConfig decides which one wins — a boolean in the [Certificate] section of /setup/scep/scep.ini and /setup/est/est.ini, false by default.

To use EST instead of SCEP when both are enabled, set PreferForLanConfig=true in est.ini. Setting it to true in both scep.ini and est.ini is a misconfiguration — SCEP wins and an error is logged.

Enabling or changing SCEP or EST requires a device restart.