Configuring Funk Odyssey Software, Avaya AP-3 Access Point, and Avaya

Transcription

1 Configuring Funk Odyssey Software, Avaya AP-3 Access Point, and Avaya a/b Wireless Client for User Authentication (802.1x) and Data Encryption - Issue 1.0 Abstract These Application Notes describe how to configure the Funk Odyssey Server and Client software to provide user authentication (802.1x) and data encryption for the Avaya AP-3 Access Point and Avaya a/b wireless clients. The Avaya IP Softphones installed on these wireless clients register to the Avaya Communication Manager Software via this secured wireless connection. 1 of 49

2 1. Introduction One of the most widely used protocols for user authentication on wireless LANs is RADIUS. The Funk Odyssey Server is a RADIUS server. It works with the wireless access points and the Odyssey clients to control access to the network. In this configuration (Figure 1), the Avaya AP-3 functions as a RADIUS client and it uses the RADIUS protocol to query the Odyssey (RADIUS) server as to whether a user should be allowed onto the network. The Odyssey client software, which is installed on the wireless laptop, can be configured to use the 802.1x protocol to obtain authentication for the Avaya wireless clients from the Odyssey Server. If the authentication is successful, the wireless clients will be granted permission to access the network via the AP-3. The Avaya IP Softphones installed on these wireless clients can register to the Avaya Communication Manager Software via this secured wireless connection. These Application Notes describe how to configure the Odyssey Server and Odyssey Client to provide user authentication using the 802.1x protocol for the Avaya AP-3 and the Avaya wireless clients. They also outline the procedures to configure a Microsoft 2000 server to serve as a Certificate Authority. The network used for verification is depicted in Figure /24 Avaya G600 Media Gateway Avaya 8700 Media Server Avaya 4600 Series IP Telephone Wireless laptop Avaya IP Softphone 1 Odyssey Client Avaya P330 Switch Avaya AP Avaya 6400 Series Digital Telephone * Wireless clients have a/b card MS 2000 Server Odyssey Server Certificate Authority Wireless laptop Avaya IP Softphone 2 Odyssey Client Figure 1: Network Diagram 2 of 49

3 2. Equipment and Software Validated The following equipment and software were used for the sample configuration provided: Equipment Software Avaya Access Point 3 AV_AP-3 V2.0.0 (269) Avaya a/b PCMCIA Card Beta V Avaya IP Softphone Version Avaya S8700 Media Server R011x Avaya P333T Stackable Switch Version Laptop PCs with Windows 2000 installed Win2K/Service Pack 3 Funk Odyssey Server Installed on Windows 2000 PC Version Funk Odyssey Client Installed on Laptop PCs Version Configure the Funk Software Odyssey Server and Clients for User Authentication 3.1. Import the Certificate for Odyssey Server The Odyssey Server needs a certificate and an associated private key to prove its identity to the user based on its certificate. Odyssey Server certificates are standard X.509 version 3 server certificates, as defined by IETF RFC They can be created with many Public Key Infrastructure (PKI) toolkits, including the Microsoft Certification Authority. This section will describe the procedure for Microsoft Certification Authority (Windows 2000 Server Edition and above) to deploy an in-house certificate authority, from which an Odyssey Server can obtain a certificate. A Certificate Authority (CA), named as wireless, has already been set up on the Windows 2000 Advanced Server. The server uses IP address Use the Certificate Authority snap-in utility to issue the certificate. For detailed CA configuration, please refer to the Microsoft Windows 2000 Server Configuration Guide. From the machine that is running Odyssey Server: Use Internet Explorer to navigate to the Certification Authority home page at as shown in Figure 2. Select Request a certificate and click the button Next >. 3 of 49

4 Figure 2: Request a Certificate from CA 4 of 49

5 Select Advanced request and click button Next >. Figure 3: Using Advanced Request Form 5 of 49

6 Select Submit a certificate request to this CA using a form. Click button Next >. Figure 4: Select the form to submit a request 6 of 49

7 Clear out all fields that may have been initialized in the Identifying Information section. In the Name field, enter the machine s domain name as 4C_PC-9. Under Intended Purpose, select Server Authentication Certificate. Under Key Options, check Use local machine store. Leave the rest of the defaults as shown in Figure 5. Click button Submit >. Figure 5: Configure the request form 7 of 49

8 Click Install this certificate to install it on Odyssey Server as shown in Figure 6. Figure 6: Install the Certificate on Odyssey Server 8 of 49

9 3.2. Configure the Funk Odyssey Server After the Funk Odyssey Server software has been installed on Windows2000 PC, launch the program Start! Programs! Funk Software! Odyssey Server! Odyssey Server Administrator. The Server Administrator menu is shown in Figure 7. Follow the steps below to configure the Odyssey Server RADIUS settings Highlight icon Settings and click RADIUS Settings as shown in Figure 7. Figure 7: Odyssey Server Configuration Menu 9 of 49

10 By default, the Box The standard port (1812) has been checked. If not, check the box. Click the Add.. button only if additional ports are needed. Click OK when done. Figure 8: RADIUS Port Setting for Odyssey Server Access Point Defaults The Access Point Defaults settings allow configuration of default values for the access point and the secret it shares with Odyssey Server. These values will appear automatically when a new access point is added. Click Access Point Defaults from Figure 7 to configure default settings for AP-3. Select Avaya AP-3 Access Point in the Model field and click Enter shared secret as shown in Figure 9. Figure 9: Configure Default Settings for AP-3 10 of 49

11 Enter as a shared secret that will be used between the Odyssey Server and the AP-3 as shown in Figure 10. Click OK when done. Figure 10: Configure a Shared Secret on Odyssey Server Policy Defaults The Policy Defaults settings are used to configure the default policy that will be used when a new group or user is added. Click Policy Defaults from Figure 7 and verify that Allow is chosen in the Policy field as shown in Figure 11. Click OK when done. Figure 11: Configure the Policy Defaults for Users and Groups 11 of 49

12 Authentication protocols Odyssey Server supports multiple authentication protocols. Use the Authentication Settings menu to list the Authentication protocols that Odyssey Server is configured to use by default as shown in Figure 12. In these Application Notes, the TTLS is used as the preferred protocol. When authenticating a user, Odyssey Server will attempt to use the first EAP (Extensible Authentication Protocol) protocol in this list. If the client does not support that protocol, one of the other protocols may be negotiated. Click Authentication Settings from Figure 7 and verify that TTLS is on top of the preference as shown in Figure 12. Figure 12: Configure Authentication Protocols TLS/TTLS Settings The EAP-TTLS and EAP-TLS authentication methods both use the TLS (transport Layer Security) protocol as the underlying security protocol. When using EAP-TLS or EAP- TTLS, the Odyssey Server must prove its identity to the user based on its certificate. In order to use either of these protocols, the network administrator must provide each Odyssey Server with a certificate and associated private key. 12 of 49

13 Follow the steps below to configure Authentication Settings: Click TLS/TTLS Settings from Figure 7. Click tab Browse and select a certificate owned by this server and click OK as shown in Figure 13. Note: this certificate 4C2_PC-9 was created and installed from Section 3.1. Leave other settings as defaults and Click OK when done. Note: The Server certificate field identifies the certificate that this server will use to prove its identity to clients, when EAP-TLS or EAP-TTLS is in use. Figure 13: Configure Server Certificate and TLS Settings 13 of 49

14 To inspect the currently configured server certificate, click View from Figure 13 and the content of the certificate is displayed in Figure 14. Figure 14:View the Certificate 14 of 49

15 Configure User Certificate Trust Follow the steps below to add a certificate of a root or intermediate certificate authority as a top-level node of the tree on the Odyssey Server. Click User Trust from Figure 7. Click tab Add Certificate.. as shown in Figure 15. Figure 15: Add User Certificate on Server 15 of 49

16 Select tab Trusted Root Certification Authorities. Highlight wireless and click OK. Figure 16: Configure Trusted Root Certificate Authorities 16 of 49

17 Click Add Identity as shown in Figure 17 to add a user node. Figure 17: Add Identity Check the box Any user or CA certificate issued by parent and click OK as shown in Figure 18. Figure 18: Continue to Add Identity 17 of 49

18 Click OK as shown in Figure 19. Figure 19: Finish Adding Identity 18 of 49

19 Adding Access Point Follow the steps below to add an Access Point. Right-click the Access Points folder and select Add Access Point from Figure 7. Fill in Name, Description, and Address fields and use drop-down list to select Avaya AP-3 Access Point in Model field as shown in Figure 20. Click button Enter to enter as the Shared secret. Click OK when done. Note: the shared secret secures RADIUS communication between the access point and the Odyssey Server. Figure 20: Add an Access Point After the shared secret has been entered, it also can be verified by clicking the button Validate and re-entering the shared secret as pre-configured. The Odyssey Server will display the verification result. 19 of 49

20 Add Users In these Application Notes, only one user is added as an example. Adding a group is an option described in the Odyssey Server Administration Guide. The user to be added to Odyssey Server must already exist in the Windows 2000 server. Only existing users from the Windows 2000 server can be added to the Odyssey Server s database. Right click the icon Users and choose Add User(s) option as shown in Figure 21. Figure 21: Add a User 20 of 49

21 Highlight user wireless client and click the button Add as shown in Figure 22. (Note: User wireless client was created from the Windows 2000 server before.) Click OK. Figure 22: Add a User ( Continued) Verify the user and the default policy applied to the user as shown in Figure of 49

22 Figure 23: Verify the User s Policy 22 of 49

23 3.3. Configure the Avaya AP-3 for RADIUS The Avaya AP-3 must be configured to use a specific RADIUS Server for client authentication. From the AP-3 configuration menu, click tabs RADIUS! RADIUS Auth as shown in Figure 24. Check the box Enable Primary RADIUS Authentication Server. Enter Odyssey Server s IP Address and as a Shared Secret. Leave the Destination Port at its default of 1812 and click OK when done. Figure 24: RADIUS Configuration for AP-3 The Avaya AP-3 supports the standard 802.1x protocol for client authentication and dynamic wireless encryption key distribution. It also supports mixed (WEP and 802.1x) mode. The mixed 23 of 49

24 mode allows automatic key distribution for 802.1x based clients while maintaining interoperability with non-802.1x based clients. In these Application Notes, the AP-3 is configured as the mixed mode (802.1x and WEP). From the AP-3 configuration menu, Click tabs Security! 802.1x as shown in Figure 25. Select Mixed as 802.1x Security Mode and 128 Bits as Encryption Key Length for both interfaces. Click OK when done. Reboot the AP-3 for the configuration to take effect. Figure 25: 802.1x Configuration for AP-3 24 of 49

25 3.4. Import the Certificate for Odyssey Client To be authenticated by the Odyssey Server, the Odyssey Client must know which server it trusts and also the Certificate Authority that issued the certificate to the Server. Use the Microsoft CA snap-in utility to export the certificate issued to the server and save this file as ws-wireless to a floppy disk. The following steps outline the procedure to import this certificate from Microsoft Internet Explorer to a client. From a wireless client laptop, right click the icon Internet Explorer, choose Properties and click tab Content as shown in Figure 26. Click Certificates. Figure 26: Configure the IE Internet Options for Certificate 25 of 49

26 Click Import as shown in Figure 27. Figure 27: Import the Certificate for Client 26 of 49

27 Select the Certificate file ms-wireless from floppy disk and click Open as shown in Figure 28. Figure 28: Open the Certificate File for Import 27 of 49

28 Click Next > as shown in Figure 29. Figure 29: Select the Certificate for Client 28 of 49

29 Select Automatically select the certificate store based on the type of certificate and click Next > as shown in Figure 30. Figure 30: Store the Certificate for Client 29 of 49

30 Click Finish as shown in Figure 31. Figure 31: Finish Importing the Certificate 30 of 49

31 3.5. Configure the Funk Odyssey Client Configure the Network Properties After the Funk Odyssey Client software has been installed on the Windows 2000 Laptop, launch the program Start! Programs! Funk Software! Odyssey Client! Odyssey Client Manager. Follow the steps below to configure the network properties on the Odyssey client. Highlight Networks and click Add as shown in Figure 32. Figure 32: Add Networks for Connection 31 of 49

32 If known, type the Network Name (SSID) into the Network Name (SSID) field, or pick the network by clicking Scan to scan all networks available for connection (Figure 33). In this example, Scan was used as shown in Figure 34. Figure 33: Select the Scan for Available Networks 32 of 49

33 From the Available Networks list, highlight the network AP-3-Channel-A and click OK as shown in Figure 34. Figure 34: Select the Network for Connection 33 of 49

34 Configure the network properties as shown in Figure 35. Click OK when done. Figure 35: Configure the Network Properties 34 of 49

35 Configure the Profile Properties The Odyssey client software has a default profile (Initial Profile) installed on the client laptop. Either add a new profile or modify this default profile to meet network needs. Follow the steps below to modify the properties of the default profile. Highlight Profiles and Initial Profile and click Properties as shown in Figure 36. Figure 36: Select the Initial Profile to Modify 35 of 49

36 Select tab User Info and enter 4C2_PC-9\wireless client in the Login name field. Check the box Permit login using password and enter in the space below the use the following password field as shown in Figure 37. Click OK when done. Figure 37: Configure the Profile User Information 36 of 49

37 Select tab Authentication and leave EAP/TTLS as its protocol. Check the box Validate server certificate. Click OK when done as shown in Figure 38. Figure 38: Configure the Profile Authentication Properties 37 of 49

38 Select tab TTLS Settings and leave all information as its default as shown in Figure 39. Click OK when done. Figure 39: Configure the Profile TTLS Settings 38 of 49

39 Configure the Trusted Servers The client must be configured to trust a specific authentication server for login. Follow the steps below to configure the trusted server. Highlight Trusted Servers and click Advanced as shown in Figure 40. Figure 40: Configure the Trusted Server 39 of 49

40 Click Add certificate as shown in Figure 41. Figure 41: Add the Certificate 40 of 49

41 Select tab Trusted Root Certification Authorities. Highlight wireless and click OK as shown in Figure 42. Figure 42: Select wireless as the Trust Root Certification Authorities 41 of 49

42 Select Add Identity as shown in Figure 43. Figure 43: Add Identity Check the box Any user or CA certificate issued by parent as shown in Figure 44. Figure 44: Add Identity for any User 42 of 49

43 Click OK in Figure 45. Figure 45: Finish Adding the Identity Add Wireless Adapters The Adapters panel offers user the option to select a wireless adapter for network connection. In this configuration, since only one adapter (802.11a/b card) has been installed on the client laptop, the client should have picked this card as its default. 43 of 49

44 Follow the steps below to verify this. Open the Adapters panel by highlighting Adapters as shown in Figure 46. The Avaya a/b should appear in the box below. If not, click button Add.. to add this adapter. Figure 46: Add Wireless Adapter for Client 44 of 49

45 Select the Network to Connect To connect the network, highlight Connection and Select Avaya a/b from the drop-down list in the Adapter field. Select AP-3-Channel-A from the drop-down list to the right of Connect to network and check the box Connect to network as shown in Figure 47. Figure 47: Configure the Network Connection The client will automatically connect to the Odyssey server for user authentication after the box Connect to network has been checked. 45 of 49

46 3.6. Configure the Avaya a/b Client After the configuration for the Odyssey client is completed, perform the a/b client configuration as follows. From the tab Configuration, select Security. Select 802.1x Security from the dropdown list. Pick My Wireless Network from the Profile List. Click OK when done as shown in Figure 48. Figure 48: Configure Security for the Avaya a/b Client 46 of 49

47 4. Verification Steps The following steps can be used to verify the a/b client works with AP-3 and Funk Software. Launch the Odyssey client from both clients and connect them to the AP-3. Verify that clients can be authenticated by Odyssey Server. Ping AP-3 from any client and ping between the Client 1 and 2. Verify that all pings are successful. Launch IP Softphone from both clients and verify they can register with S8700 Media Server. Make calls between IP SoftPhone 1 and 2, and between IP Softphone 1 and IP Telephone. Verify the call quality is good. Figure 49 shows the connection status. Note that under the Connection information, the Status shows open and authenticated. The blue color on Odyssey icon shows the client is connected and authenticated. The blue color on Key icon shows that data is encrypted using dynamic keys (802.1x). Figure 49: Odyssey Client Connection Status 47 of 49

48 The security connection can also be verified from the Avaya a/b client utility menu. The 802.1x Security has been used for its connection as shown in Figure 50. Figure 50: a/b Client Association Information 5. Conclusion The Avaya AP-3 Access Point and the Avaya a/b wireless clients can work with the Funk Odyssey software to provide a secure wireless communication. It also works with the 802.1x protocol for user authentication and data encryption. The Avaya IP Softphones installed on the wireless clients can register to the Avaya Communication Manager Software via this secured wireless connection. The real time connection status and statistics data also allow the user to monitor its performance. 48 of 49

49 Avaya and the Avaya Logo are trademarks of Avaya Inc. All trademarks identified by and are registered trademarks or trademarks, respectively, of Avaya Inc. All other trademarks are the property of their respective owners. The information provided in these Application Notes is subject to change without notice. The configurations, technical data, and recommendations provided in these Application Notes are believed to be accurate and dependable, but are presented without express or implied warranty. Users are responsible for their application of any products specified in these Application Notes. Please any questions or comments pertaining to these Application Notes along with the full title name and filename, located in the lower right corner, directly to the Avaya Solution & Interoperability Test Lab at 49 of 49