Roll out 802.1x in WPA3-Enterprise

Wi-Fi Protected Access 3 (WPA3) has brought vital security enhancements to Wi-Fi networks, significantly WPA-3Enterprise, which incorporates tweaks to make authenticating to the network more secure. one among these has got to do with 802.1x authentication that’s used to verify whether or not Wi-Fi clients will be granted access to the enterprise network.

The enterprise mode of WPA has continuously allowed you to convey every user distinctive username/password to login to the Wi-Fi or to utilize unique digital certificates for every user to install on devices for even more security. Currently with WPA3-Enterprise, the protection is magnified as clients are currently needed to be certain it’s communicating with the real authentication server before sending login credentials. That verification was elective with the sooner 2 versions of WPA.

There also are enhancements to the encryption strength with WPA3-Enterprise. However, in most cases the enhancements aren’t a major distinction to pay resources in upgrading all of your hardware quickly to support WPA3. thus WPA2-Enterprise remains actually an honest secure choice lately.

Here’s a glance at the way to roll out 802.1x in WPA3-Enterprise.

Providing RADIUS

Enterprise WPA 802.1x needs a RADIUS server to authenticate Wi-Fi clients making an attempt to realize network access, and there are many choices for providing one, as follows:

• Built-in to the wireless controller or access points (AP): Some controller platforms, as well as cloud-based ones, and APs have an integrated RADIUS servers and user directories in order that they’re going to perform the authentication. However, the practicality is restricted, and you will not be able to utilize a third-party user directory like Active Directory for the login credentials. however it’s going to give a simple and low-cost way to enable authentication.
• Router, Firewall, a unified threat management appliance, or network access server : Some network devices give an integrated RADIUS server. almost like those provided by wireless controllers or APs, they could not provide full RADIUS functionality however some do support third-party user directories. thus take a glance at existing main network gear to check if it offers RADIUS features and which of them.
• Existing Servers: See whether or not existing servers include RADIUS server as a feature. for example, on Windows Servers you’ll be able to get a RADIUS server via the Network Policy Server role an utilize Active Directory for the Wi-Fi login credentials.
• Cloud-hosted RADIUS services: this feature provides a simple method use RADIUS while not deploying your own hardware. this is often also helpful if you’ve got multiple locations wherever you wish to use it because you merely ought to manage it within the cloud instead of in every location. moreover, some cloud services enable you to attach third-party user directories.
• Setup a separate RADIUS server: A final possibility is to deploy a separate full RADIUS server on either dedicated hardware or a virtual platform. There are industrial options for the RADIUS server software package, however FreeRADIUS is open source and extremely widespread.

Setting up RADIUS

The difficulty of fitting a RADIUS server varies based on what resolution you decide on, and it’s typically efficient if using a wireless controller or APs. If using AN external server, you always have to be compelled to enter the IP address of the wireless controller or every AP and specify a shared secret that you just later input within the controller settings or every AP. For traditional RADIUS servers, these are typically entered within the Network Access Server (NAS) list.

On the RADIUS server you furthermore may have to be compelled to configure user credentials either with usernames and passwords in an exceedingly local database or external database/directory, or by generating digital certificates that you just later install on devices.

Some RADIUS servers support elective attributes you’ll be able to apply to individual users or teams of users that become a part of the policy applied to individual clients. Common attributes that RADIUS servers support include: login-time, permitting you to define the precise days and times they’ll login; called-station-ID to specify that APs they’ll connect through; and calling-station-ID to specify that shopper devices they’ll connect from.

Some RADIUS servers support optional dynamic VLAN assignments further. instead of assigning an SSID to one VLAN, you’ll be able to have the VLAN assignments outlined within the RADIUS server based mostly upon the user, and their specific VLAN ID are applied once connecting to the Wi-Fi throughout the 802.1x authentication.

Configuring APs for enterprise security

When configuring wireless APs you’ll enter the RADIUS server ip address and port and therefore the shared secret you such that earlier if using an external RADIUS server. If the APs support multiple enterprise authentication protocols (EAP) you’ll even have to pick out that one you’re using, like protected EAP (PEAP) for usernames/passwords or EAP-TLS for digital certificates. EAP permits the language between the client and therefore the RADIUS server as proxied through the AP.

If your APs support WPA3 you’ll seemingly even have the flexibility to choose one amongst 3 WPA options: WPA2-Enterprise only, WPA3-Enterprise only, or WPA2/WPA3-Enterprise. The third choice is presumably selection till all of your client devices are upgraded to support WPA3.

Most wireless controllers and APs additionally support RADIUS accounting, wherever they’re going to send usage details back to the RADIUS server therefore you’ll be able to keep affiliation logs. For external RADIUS servers, you’ll have to enter your RADIUS server ip address and accounting port and therefore the shared secret you specified earlier.

Connecting to the Enterprise Security

If you selected to utilize usernames and passwords, like PEAP, users merely choose the SSID on the their devices, and it’ll prompt them to login. or you can push predefined settings out to their devices and use single sign-on practicality wherever the user may not have to be compelled to give any credentials themselves.

If you’re using digital certificates (like with EAP-TLS), every user’s certificate must be put in on every end-use device. additionally to doing this manually, there are several solutions to deploy these to assist automatize the method. check with your RADIUS server or cloud service to ascertain what they provide.