 | This is part 2 of the previous blog post on how to deploy 802.1x EAP-TLS authentication on Polycom VVX phones using Cisco 2960X switch and Windows Server 2012 R2 NPS RADUIS. In this post, we continue to configure and obtain certificates for the VVX and connect the phone to the 802.1x enabled port on the switch to get EAP-TLS authentication and having been allowed, proceed to obtain an IP address from the Windows DHCP server. It's worthwhile to review the previous post before continue reading this post. |
The first step is to create an AD user account that is part of the dot1x group allowed by the NAP policy configured in Part 1. In our lab this is simply "[email protected]" but note than in the XML cfg file that we'll configure later, we do not need to specify the full UPN, just the account name will do. Remeber to add this account into the Windows Group scecifed in the NPS policy in Part 1, which was "UCSkypelab\dot1x" in our example
Next, we need to configure the Certificate Authority to issue certificates using the certificate template "User Signature". This is simple done by starting the CA MMC, right-click to "Certificate Templates" on the left pane and select New->Certificate Template to Issue" as shown below:
Next, we need to configure the Certificate Authority to issue certificates using the certificate template "User Signature". This is simple done by starting the CA MMC, right-click to "Certificate Templates" on the left pane and select New->Certificate Template to Issue" as shown below:
From the available templates we select "User Signature Only" which will be the template used when we request certificates for the phones:
Next on the VVX phone, we need to generate a CSR from the phone's menu. Note that the provisioning server is already configured on the VVX using FTP. This step must be done so that the phone will upload the CSR to the provisioning server along with the private key. Before generating the CSR, we need to configure a parameter on the VVX that will upload the private key as a .pem file to the provisioning server. The sample xml file containing this parameter is shown below:
<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<!--Description: Phone will ignore software update notifications for software uploaded through Skype Control Panel. Phone will only upgrade through Provisioning Server or Web Admin Utility.-->
<PHONE_CONFIG>
<ALL sec.uploadDevice.privateKey="1" />
</PHONE_CONFIG>
<!--Description: Phone will ignore software update notifications for software uploaded through Skype Control Panel. Phone will only upgrade through Provisioning Server or Web Admin Utility.-->
<PHONE_CONFIG>
<ALL sec.uploadDevice.privateKey="1" />
</PHONE_CONFIG>
Next we proceed to generate a CSR using the phone's menu interface. This is found under Settings->Advanced->Administration Settings->Generate CSR. We enter the full UPN of the AD account that will be used for 802.1x authentication. in our example this is [email protected]:
After pressing the "Generate" button, the CSR along with the private Key .pem file in Base64 format will be uploaded to the provisioning server. We copy the contents of the CSR using Notepad and open a browser to our CA server to request a certificate at the URL http://<CAServer>/certsrv. Important: when prompted for credentials login as the user account created for the phone earlier. On the home page click on "Request a Certificate"->"Advanced Certificate Request". Here we past the contents of the CSR file into the box and specify template "User Signature":
After submitting the request, the CA will issue a certificate for the phone and we need to download the certificate as Base-64 format. With this certificate and the private key .pem file on the provisioning server, we can now create a configuration XML file to upload to the phone. Below is picture of the .cfg XML file and a sample .cfg is uploaded at the end of this blog post for easy reference:
Finally we can now plug in the VVX phone into one of the 802.1x enabled ports on the switch and the NPS server should now authenticate the VVX and allow full network access, which will then allow the VVX phone to obtain an IP from the DHCP server. If authentication fails, the phone will not be able to obtain any IP address. To see a successful 802.1x authentication server, we can look for Event 6278 in the Event Viewer:
The most common issue faced is that the certificate subject name or common name did not match the UPN of the AD user account created for 802.1x authentication for the phone, which was [email protected] in our lab, or the credentials used to login to request for the certificate was not this user account. Another common failure would is due to the certificate template was something other than "User Signature Only". A failed authentication will typically result in a Event 6273 as shown below:
Its always good to check the event viewer details especially under "Reason" to understand what could be the cause of the failure. This concludes the 2 part blog post on depoying 802.1x EAP-TLS on Polycom VVX phones using Windows NPS RADIUS server. I hope this post has been helpful and feel free to leave comments below. As mentioned, attached below is the sample XML cfg file.
| vvxeaptls.cfg |
RSS Feed