Configuring IEEE 802.1X Authentication
IEEE 802.1X is an authentication function that can be used with both wired and wireless networks. Authentication is performed by the authentication server (RADIUS server).
You can select 4 types of EAP authentication method: EAP-TLS, LEAP, EAP-TTLS and PEAP. Note that each EAP authentication method has different configuration settings and authentication procedures.
Types and requirements of certificates are as follows:
EAP type |
Required certificates |
|---|---|
|
EAP-TLS |
Root certificate, Device certificate (IEEE 802.1X Client Certificate) |
|
LEAP |
- |
|
EAP-TTLS |
Root certificate |
|
PEAP |
Root certificate |
|
PEAP (Phase 2 is for TLS only) |
Root certificate, Device certificate (IEEE 802.1X Client Certificate) |
Install a root certificate (root CA certificate) for verifying the reliability of the authentication server. You need to have at least a certificate issued by the certificate authority who signed the server certificate or a certificate from a higher certificate authority.
Only PEM (Base64-encoded X.509) root certificates can be imported.
Log in as the network administrator from Web Image Monitor.
For details on how to log in, see User Guide of your device.Point to [Device Management], and then click [Configuration].
Click [Root Certificate] under "Security".
Click [Browse] for "Root Certificate to Import", and then select the CA certificate you obtained.
Click [Open].
Click [Import].
Check that the imported certificate's [Status] shows "Trustworthy".
If [Root Certificate Check] shows [Active], and the [Status] of the certificate shows [Untrustworthy], communication might not be possible.Click [OK].
Log out.
Select the certificate you want to use under IEEE 802.1X from among the device certificates created and installed in advance on the machine. For details about creating and installing a device certificate, see User Guide of your device.
Log in as the network administrator from Web Image Monitor.
For details on how to log in, see User Guide of your device.Point to [Device Management], and then click [Configuration].
Click [Device Certificate] under "Security".
Select the certificate to be used for IEEE 802.1X from the drop-down list box in "IEEE 802.1X" under "Certification".
Click [OK].
Updating... appears. Wait for about 1 or 2 minutes, and then click [OK].
If the previous screen does not appear again after you click [OK], wait for a while, and then click the web browser's refresh button.Log out.
Log in as the network administrator from Web Image Monitor.
For details on how to log in, see User Guide of your device.Point to [Device Management], and then click [Configuration].
Click [IEEE 802.1X] under "Security".
In "User Name", enter the user name set in the RADIUS server.
Enter the domain name in "Domain Name".
Select "EAP Type". Configurations differ according to the EAP Type.
EAP-TLS
Make the following settings according to the operating system you are using:
Select [On] or [Off] in "Authenticate Server Certificate".
Select [On] or [Off] in "Trust Intermediate Certificate Authority".
Enter the host name of the RADIUS server on "Server ID".
Select [On] or [Off] in "Permit Sub-domain".
Click [Change] in "Password", and then enter the password set in the RADIUS server.
Click [Change] in "Password", and then enter the password set in the RADIUS server.
Click [Change] in "Phase 2 User Name", and then enter the user name set in the RADIUS server.
Select [CHAP], [MSCHAP], [MSCHAPv2], [PAP], or [MD5] in "Phase 2 Method".
Certain methods might not be available, depending on the RADIUS server you want to use.Make the following settings according to the operating system you are using:
Select [On] or [Off] in "Authenticate Server Certificate".
Select [On] or [Off] in "Trust Intermediate Certificate Authority".
Enter the host name of the RADIUS server in "Server ID".
Select [On] or [Off] in "Permit Sub-domain".
Click [Change] in "Password", and then enter the password set in the RADIUS server.
If [TLS] is selected for "Phase 2 Method", you do not need to specify a password.Click [Change] on "Phase 2 User Name", and then enter the user name set in the RADIUS server.
Select [MSCHAPv2] or [TLS] in "Phase 2 Method".
When you select [TLS], you must install "IEEE 802.1X Client Certificate".Make the following settings according to the operating system you are using:
Select [On] or [Off] in "Authenticate Server Certificate".
Select [On] or [Off] in "Trust Intermediate Certificate Authority".
Enter the host name of the RADIUS server on "Server ID".
Select [On] or [Off] in "Permit Sub-domain".
Click [OK].
Updating... appears. Wait for about 1 or 2 minutes, and then click [OK].
If the previous screen does not appear again after you click [OK], wait for a while, and then click the web browser's refresh button.Click [Interface Settings] under "Interface".
Select [Active] in "Ethernet Security".
Click [OK].
Updating... appears. Wait for about 1 or 2 minutes, and then click [OK].
If the previous screen does not reappear after you click [OK], wait for a while, and then click the web browser's refresh button.Log out.
If there is a problem with settings, you might not be able to communicate with the machine. In such cases, access the following items on the control panel, and then print the network summary to check the status.
Settings screen type: Standard
[Network/Interface]
[Print List]Settings screen type: Classic
[Interface Settings] [Print List]
If you cannot identify the problem, execute the following item on the control panel, and then repeat the procedure.
Settings screen type: Standard
[Network/Interface] [IEEE 802.1X Authentication] [Restore IEEE 802.1X Authentication to Defaults]Settings screen type: Classic
[Interface Settings] [Network] [Restore IEEE 802.1X Authentication to Defaults]
Log in as the network administrator from Web Image Monitor.
For details on how to log in, see User Guide of your device.Point to [Device Management], and then click [Configuration].
Click [IEEE 802.1X] under "Security".
In "User Name", enter the user name set in the RADIUS server.
Enter the domain name in "Domain Name".
Select "EAP Type". Configurations differ according to the EAP Type.
EAP-TLS
Make the following settings according to the operating system you are using:
Select [On] or [Off] in "Authenticate Server Certificate".
Select [On] or [Off] in "Trust Intermediate Certificate Authority".
Enter the host name of the RADIUS server on "Server ID".
Select [On] or [Off] in "Permit Sub-domain".
Click [Change] in "Password", and then enter the password set in the RADIUS server.
Click [Change] in "Password", and then enter the password set in the RADIUS server.
Click [Change] in "Phase 2 User Name", and then enter the user name set in the RADIUS server.
Select [CHAP], [MSCHAP], [MSCHAPv2], [PAP], or [MD5] in "Phase 2 Method".
Certain methods might not be available, depending on the RADIUS server you want to use.Make the following settings according to the operating system you are using:
Select [On] or [Off] in "Authenticate Server Certificate".
Select [On] or [Off] in "Trust Intermediate Certificate Authority".
Enter the host name of the RADIUS server in "Server ID".
Select [On] or [Off] in "Permit Sub-domain".
Click [Change] in "Password", and then enter the password set in the RADIUS server.
If [TLS] is selected for "Phase 2 Method", you do not need to specify a password.Click [Change] on "Phase 2 User Name", and then enter the user name set in the RADIUS server.
Select [MSCHAPv2] or [TLS] in "Phase 2 Method".
When you select [TLS], you must install "IEEE 802.1X Client Certificate".Make the following settings according to the operating system you are using:
Select [On] or [Off] in "Authenticate Server Certificate".
Select [On] or [Off] in "Trust Intermediate Certificate Authority".
Enter the host name of the RADIUS server on "Server ID".
Select [On] or [Off] in "Permit Sub-domain".
Click [OK].
Updating... appears. Wait for about 1 or 2 minutes, and then click [OK].
If the previous screen does not appear again after you click [OK], wait for a while, and then click the web browser's refresh button.Click [Wireless LAN Settings] under "Interface".
Select [Wireless LAN] in "LAN Type".
Select [Infrastructure Mode] in "Communication Mode".
Enter the alphanumeric characters (a-z, A-Z, or 0-9) in [SSID] according to the access point you want to use.
Select [WPA2] in "Security Method".
Select [WPA2] in "WPA2 Authentication Method".
Click [OK].
Updating... appears. Wait for about 1 or 2 minutes, and then click [OK].
If the previous screen does not appear again after you click [OK], wait for a while, and then click the web browser's refresh button.Log out.
If there is a problem with settings, you might not be able to communicate with the machine. In such cases, access the following items on the control panel, and then print the network summary to check the status.
Settings screen type: Standard
[Network/Interface] [Print List]Settings screen type: Classic
[Interface Settings] [Print List]
If you cannot identify the problem, execute the following item on the control panel, and then repeat the procedure.
Settings screen type: Standard
[Network/Interface] [IEEE 802.1X Authentication] [Restore IEEE 802.1X Authentication to Defaults]Settings screen type: Classic
[Interface Settings] [Network] [Restore IEEE 802.1X Authentication to Defaults]