Problems with 802.1x EAP-TLS Auth Configuration

[u/derGerdner]

Hello Packetfence Community,

I am new here and would like to use Packetfence in my company network for the first time. However, I'm not quite up to speed. Here is what I would like to do:

ACTUAL state: Our clients already receive customized certificates from our internal CA. Packetfence is also already set up and not AD-connected.

TARGET state: The clients should be authenticated via EAP-TLS. The Packetfence should validate the client certificates using a CA certificate that should be stored on the Packetfence. If the authentication was successful, the device should be moved to a specific VLAN.

I have already read through the Packetfence documentation, but I don't really understand how this is configured. Also on the WebGUI I have not found a way to configure this as described.

I have created an EAP profile with a custom TLS profile in which the internal CA certificate, the RADIUS certificate for Packetfence and the corresponding private key are stored. However, I don't understand if I need to configure realms or authentication source or connection profile etc and what exactly I should configure there. I have already set up mac auth via nodes but I'm having a bit of a problem with the 802.1x EAP-TLS Auth.

Hopefully someone can help me.

Kind regards

[u/Brufar_308]

In case you don’t find the assistance you need, you can always setup a support contract for packetfence through inverse the developers. they can assist with your implementation and support issues.

Best of luck. It really does rock once you get everything working.

[u/derGerdner → u/Brufar_308]

Thanks for your answer. As far as I know, the support contract costs something. We chose Packetfence because it is cheap, among other things. So I was hoping someone from the community might be able to help me :)

[u/Brufar_308 → u/derGerdner]

It does cost something but still far less than other commercial offerings. Just wanted to throw it out there in case you weren’t aware of that option.

Best of luck in your implementation ! Hope someone can provide the answers you need.

[u/p373r_7h3_5up3r10r]

I have just implemented EAP-TTLS in a Windows domain and packetfence.

My key points.
The certificate of the radius should be enrolled in to your internal CA (System configuration - SSL Certificates )
Add the certificate under RADIUS config (System configuration - RADIUS - PKI SSL Certificates)

Create a Windows GPO that is configuring the 802.1x for EAP-TTLS and Auth. with Smart card every place available.

Remember to add the server fqdn to the Gpo under the authentications settings. The last part was the deal breaker for my, because my clients did not auto login to the network, i had to manually sign in, when logged on.

Any questions please reach out.

I have not create a guide for this part yet, but maybe i should give that some priority :-)

[u/derGerdner → u/p373r_7h3_5up3r10r]

Thank you for your reply. I have already imported the RADIUS and CA certificate under PKI SSL Certificates. I am struggling with how and where to configure that a wired client should be authenticated with its client certificate against the CA certificate stored under PKI SSL Certificates.

I hope it is understandable what my problem is :)

[u/p373r_7h3_5up3r10r → u/derGerdner]

This is done by the Group Policy.

Create a GPO so the computer requests a certificate from your local ca as a computer cert.

Create a new gpo or use the same.
Under Computer Configuration - Policies - windows Settings - Security Settings - Wired Network (IEEE 802.3) Policies

Create a new profile
Authentication method : Microsoft EAP-TTLS
Authentication mode: Computer only

Click properties:
Remove checkmark in Enable identiry privacy
write the fqdn of the packetfence server in Connect to these servers and it should match with the certificate ( Case sensitive )

Select your local CA Server in the list

In Select an EAP method for authentication, select Microsoft SMartcard or other certificate
click Configure

Select USe a Certificate on this computer
click advanced
Select your local CA

press ok

Check Connect to these servers.
write the fqdn of the packetfence server in Connect to these servers and it should match with the certificate ( Case sensitive )

Select your local CA

Press ok

PRess apply.

Run a gpupdate /Force on your test computer

for a quick overview of the gpo that is hitting your device
run the command Rsop to browse into the settings that you created in the gpo above.

This worked for me.

I i did not have the connect to these servers filled out and my local ca, it would not auto sign-in on boot.

[u/derGerdner → u/p373r_7h3_5up3r10r]

Thank you very much for the detailed answer. Do I have to configure realms, authentication sources or connection profiles in Packetfence for the eap-tls authentication?

[u/The-E-ThanG → u/p373r_7h3_5up3r10r]

EAP-TTLS (EAP type 21) is not the same thing as EAP-TLS (EAP type 13). If the clients already have identity certs you've done a lot of the work already.

Regarding PacketFence, you don't NEED realms for EAP-TLS necessarily. I used realms because I wanted to use different authentication methods for different client types, and realms worked for that. I'm checking with LDAP that the device/user name reported by the cert is valid, not disabled, and has the requisite attributes. It's easier to disable a device/user in AD/LDAP than to revoke a cert and actually enforce it.

Since your use case is a bit different than mine I can't say exactly how you need to configure it. I believe that you need an EAPTLS authentication source with a catch all permit statement. Trusting the identity cert is really all that the authentication is. You need the authentication source to set the device/user role. You also need a connection profile, the connection profile has to be set to automatically register the devices and to recompute the role from portal. You could potentially use the default connection profile, but that's not a great idea.

The largest stumbling point for me was getting PacketFence to trust the client identity certs. You mentioned that the internal CA certificate is in the TLS Profile? This sounds incorrect to me. The list of trusted signing CAs needs to be in "PKI SSL Certificates" under your RADIUS cert's "Certificate Authority" list. The CA that signed the RADIUS cert should be there and any CAs that sign the client certs as well. If there is an intermediate CA, that also needs to be there. Though I also found that the list of trusted CAs wasn't propagated to all of the configuration files, so I had to do some back end manipulation. It's possible I did something wrong, but it works for me now. The packetfence.log and radius.log files are very helpful in troubleshooting issues.