SmartZone WLAN and Authentication Setup with NPS and RADIUS

Feature Overview

IEEE 802.1X is a network access control protocol used for securing wired and wireless networks by authenticating devices and users using RADIUS. It works by using an authentication server (like the Network Policy Server) to verify credentials against a database (like Active Directory), before granting access to the network. The components involved in IEEE 802.1X authentication are the supplicant (the client device, such as a smartphone or laptop), the authenticator (the network device, such as switches or wireless access points, and wireless controllers) and the authentication server (the RADIUS server).

In broad terms, this is how the authentication process happens:

1. The supplicant (your laptop) attempts to connect to the wireless network through the authenticator (for example, the controller).
   1. The controller sends an identity request to the laptop.
   2. The laptop responds with credentials.
   3. The controller forwards the laptop’s credentials to the authentication server (the NPS).
2. The NPS verifies the credentials against a database.
   1. If authentication is successful, the NPS informs controller to allow network access and apply the defined network policies.
   2. If authentication fails, access is denied.

IEEE 802.1X Components and Packet Exchange

Proxy and Non-Proxy Authentication

Typically, in wireless networks, the AP receiving the connection request forwards the client’s credentials to the wireless controller. The controller then contacts the RADIUS server for authentication. This process is known as proxy authentication. Alternatively, each AP can contact the RADIUS server directly for the authentication process, which is known as non-proxy authentication.

Proxy (Simplistic Packet Exchange Representation)

Non-Proxy Authentication (Simplistic Packet Exchange Representation)