802.1X Network Authentication
Overview
DisplayNet devices support 802.1X port-based network access control. On a network that enforces 802.1X, the switch port does not pass traffic from a DisplayNet device until the device has authenticated with the network's RADIUS server.
DisplayNet devices authenticate using EAP-TLS, which is certificate based. Each device presents a certificate issued by your organization's certificate authority (CA), and the RADIUS server checks it before the switch opens the port.
802.1X certificates are installed using the DisplayNet API. There is currently no 802.1X page in DisplayNet Manager.
How 802.1X is enforced
802.1X is enforced by the network switch and the RADIUS server, not by DisplayNet. There is no 802.1X on/off setting in DisplayNet. Enabling 802.1X on a switch port, and the policy that decides which certificates are accepted, are configured on the switch and the RADIUS server.
The DisplayNet device's role is to hold a valid certificate and present it when the switch asks it to authenticate.
Install a valid certificate on a device before enabling 802.1X on its switch port. A device with no certificate, or with a certificate the RADIUS server rejects, will not be able to communicate on an enforcing port, and DisplayNet Server will see it as offline.
DisplayNet Server cannot see whether the switch has authorized a device's port. It can only see whether the device is online.
Switch port configuration
802.1X authentication is performed by the device's core network interface only. The device's other network hosts, including USB 2.0 and the H.26x encoder, do not authenticate on their own.
For USB 2.0 and the H.26x encoder to keep working with 802.1X enabled, the switch port must be set to multi-host authentication. In multi-host mode, the switch authenticates once per port and then allows the device's other hosts on that port.
While 802.1X is active, disable the device's 1GbE port to prevent unintended device connections.
Requirements
| Item | Requirement |
|---|---|
| Authentication method | EAP-TLS only |
| Key type | ECDSA, curve P-256 (also called secp256r1 or prime256v1). RSA keys are not supported. |
| Certificate format | X.509, PEM (Base64) |
| Private key format | PEM (Base64). The key may be password protected. The password cannot contain spaces. |
| Chain size | The complete chain (key, device certificate, and intermediates) must not exceed 4 KB |
| RADIUS server | Must use an ECDSA P-256 certificate |
DisplayNet devices do not ship with a factory 802.1X certificate. Your organization's CA must issue a certificate for each device, or a certificate shared by a group of devices, and it must be installed before the device can authenticate.
Installing a certificate
Certificates are installed with the set dot1x_certificates API command.
- Obtain the private key, the device certificate, and any intermediate certificates from your CA, in PEM format.
- Copy the files to the certificate folder on DisplayNet Server,
/opt/blueriver/. The certificate files are read from the server, not uploaded from your computer. File names in the command are relative to the certificate folder. - Send one
set dot1x_certificatescommand for the device, listing the files in this order: private key, device certificate, then intermediate certificates. If the private key is password protected, include the password.
A single command can install a certificate on one device, or the same certificate on a group of devices:
| Target | Installs on |
|---|---|
<device> | A single device |
ALL | All devices |
ALL_TX | All transmitter devices |
ALL_RX | All receiver devices |
If each device has its own certificate, send one command per device.
Renewing a certificate
Each set dot1x_certificates command replaces the certificate chain already on the device.
To renew a certificate before it expires, install the new chain the same way.
DisplayNet does not track certificate expiry. Track expiry dates with your CA, and renew certificates before they expire. An expired certificate will prevent the device from authenticating on an enforcing port.
Removing a certificate
There is no command to remove an 802.1X certificate from a device. A certificate can be replaced by installing a different one.
Checking support and status
Two values in the device object report 802.1X information:
| Value | Meaning |
|---|---|
capabilities.dot1x | true if the device supports 802.1X |
configuration.dot1x_certificate | true if an 802.1X certificate is installed on the device |
Both are returned by the get <device> settings API command.