What is 802.1X?
Devices attempting to connect to a LAN or WLAN require an authentication mechanism. IEEE 802.1X, an IEEE Standard for Port-Based Network Access Control (PNAC), provides protected authentication for secure network access. An 802.1X network is different from home networks in one major way; it has an authentication server. These servers are called RADIUS or AAA servers (Authentication, Authorization and Accounting). RADIUS servers can be thought of as security guards for network access. They check a user’s credentials to see if they are an active member of the organization, and depending on the network policies, grant users varying levels of access to the network.
802.1X EAP Extensions |
Authentication |
Security |
Directory Support |
User Experience |
| EAP-TLS | Certificate-Based | Strong | OAuth/LDAP/MFA Servers | Best |
| PEAP-MSCHAPV2 | Credential-Based | Weaker | Active Directory | Acceptable |
| TTLS-PAP | Credential-Based | Weakest | Non-AD LDAP Servers | Poor |
802.1X is Difficult
to Setup and Manage.
802.1X can be a difficult protocol to configure and manage, especially for end users. When key network settings are omitted in the configuration process, which they commonly are, devices lose the security benefits of 802.1X and put their network at serious risk. Here is a video of how to manually setup 802.1X on a Windows device. The process takes 14 steps and is the only operating system that can be configured properly without software.
How to Do 802.1X Right
Offer Technology for Easy Configuration
While utilizing onboarding/configuration technology can minimize risks for over-the-air credential theft, they are not foolproof since users can choose not to utilize them. Using certificate-driven security guarantees that users go through an enrollment process that ensures their devices are properly configured, and organizations can rest assured that privacy is protected.
Use EAP-TLS, Certificate-Based Authentication
An area of vulnerability for over-the-air credential theft is when users manually configure their devices for 802.1X. When users omit a few difficult-to-configure settings, such as RADIUS certificate installation, they lose all the security benefits of 802.1X and are susceptible to over-the-air credential theft. Providing onboarding/configuration technology to network users not only creates a better user experience, but it also significantly reduces the risk of over-the-air credential theft.
802.1X with SecureW2
The Benefits of Network Configuration and Management Software
Reduce Support Expenditures
-
Customers reduce Wi-Fi connectivity related support tickets by 10-50% when they switch to SecureW2.
-
JoinNow can reports issues to the helpdesk, like outdated drivers, that may impede network configuration.
-
Enable certificate-based Wi-Fi, and set and forget devices for 8+ years.
Prevent Over-the-Air Credential Theft
-
When devices are misconfigured for 802.1X, they are at risk for over-the-air credential theft.
-
Our best-in-class configuration software allows end users to easily configure themselves to 802.1X networks.
-
JoinNow Connector offers powerful PKI services to enable world-class certificate-hardened network security.
A Better User Experience
-
The average college student has up to 7 internet connected devices.
-
Password change policies force users to change their password every 30-60 days on every device.
-
SecureW2 eliminates the need for password-change policies and password-related disconnects.
Having a cloud-based certificate authentication solution provided better reliability and security for our wireless infrastructure. Implementation, ease of use and onboarding is now a breeze compared to our old way of managing our users' accounts and passwords. SecureW2 support has been phenomenal and they were great to work with. We’re just very fortunate and thankful to have found SecureW2, a service solution that truly fits our needs in providing a reliable, easy to use and highly secure wireless access for our organization.
Configuration Client
Starting with a great end user experience, the JoinNow Suite provides customizable and adaptable onboarding clients that set up devices for Wi-Fi, VPN, Web and SSL Inspection security. JoinNow takes the frustration out of delivering secure networks by delivering all turnkey backend services for device enrollment, authentication and management. In an age where BYOD, IoT, and managed devices reign, our technology provides the answers by leveraging the components you currently own.
Key Features
PKI Services
-
Pair our onboarding client with our PKI (hardened with HSM) and have devices set up to authenticate with certificates for Wi-Fi, VPN, Web Applications and SSL Inspection security.
Onboarding Clients
-
Best-in-class Onboarding Clients for every operating system gets every device correctly configured for secure 802.1X Wi-Fi authentication.
Managed Device Certificate Auto-Enrollment
-
Use our advanced gateway to auto-enroll devices managed by JAMF, Airwatch, G-Suite and any other MDM. Enable AD-Domain joined devices to auto-enroll using simple GPO settings. In one fell swoop, all managed devices will be ready for certificate-driven network security.
Powerful RADIUS Server
-
JoinNow comes with a built-in, world-class RADIUS server for powerful, policy-driven 802.1X authentication. Our Managed PKI also integrates with any RADIUS server vendor, so you can leverage existing infrastructure.