Security

 View Only

  • 1.  802.1x with bosch camera FLEXIDOME ip3000i

    Posted Mar 20, 2025 07:03 AM
      |   view attached

    hello, someone have experience to setup the 802.1x EAP-MD% in the bsch videocamera  FLEXIDOME ip3000i ?

    I have configured but at the clearpass arrive the EAP-TLS request and clearpass block access because he don't find the righe certificate.

    the target is to authenticate the Videocamera with username and password, not certificate.

    the configuration of the camera is simple but I didn't find how disable the EAP-TLS



    ------------------------------
    ACMP ACSP ACCP ACEP ACDP
    ------------------------------


  • 2.  RE: 802.1x with bosch camera FLEXIDOME ip3000i

    Posted Mar 20, 2025 09:58 AM

    I'm curious, if the camera is already attempting EAP-TLS, why would you intentionally go for something less secure?  Just setup the certificate trust for the camera and go with that.



    ------------------------------
    Carson Hulcher, ACEX#110
    ------------------------------



  • 3.  RE: 802.1x with bosch camera FLEXIDOME ip3000i

    Posted Mar 20, 2025 11:24 AM

    it's a customer policy



    ------------------------------
    ACMP ACSP ACCP ACEP ACDP
    ------------------------------

    Original Message


  • 4.  RE: 802.1x with bosch camera FLEXIDOME ip3000i

    Posted Mar 20, 2025 11:30 AM

    Then your best bet is probably going to be Bosch support for how to configure that device.



    ------------------------------
    Carson Hulcher, ACEX#110
    ------------------------------

    Original Message


  • 5.  RE: 802.1x with bosch camera FLEXIDOME ip3000i

    Posted Mar 20, 2025 11:40 AM

    agree



    ------------------------------
    ACMP ACSP ACCP ACEP ACDP
    ------------------------------

    Original Message


  • 6.  RE: 802.1x with bosch camera FLEXIDOME ip3000i

    Posted Mar 21, 2025 05:55 AM

    It's a bad and insecure policy in that case. EAP-MD5's security is broken.

    I'd check in the dropdown for 802.1X Authentication, where it now says 'On'; if there may be an option to select EAP-MD5 / EAP-TLS / or none to see if you can disable EAP-TLS; but in general it's the device (camera in this case) that determines which authentication method to use. ClearPass should support the one used in it's service.



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your HPE Aruba Networking partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact HPE Aruba Networking TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or HPE Aruba Networking.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------

    Original Message


  • 7.  RE: 802.1x with bosch camera FLEXIDOME ip3000i

    Posted 16 days ago

    Putting first EAP MD5 in the list of Authentication methods in clearpass it works fine.



    ------------------------------
    ..........................................Dario......................................
    ...........ACMP ACSP ACCP ACEP ACDP..........
    Just an Aruba enthusiast and contributor
    --------------------------------------------------
    ------------------------------

    Original Message


  • 8.  RE: 802.1x with bosch camera FLEXIDOME ip3000i

    Posted 15 days ago

    If you have more then 1 authentication method in the service.  It will allow any NAD that uses that service to have access to all methods in the list. The processing engine that clearpass uses; it's normally intelligent enough to determine the method based on the attributes submitted on the radius request. I can make some guesses on what happened when the client was being processed by EAP-TLS, although I would prefer having debugs before doing so. 

    Personally I would not deploy services for a customer by mixing multiple methods in a service. Something with EAP-PEAP vs EAP-TLS is much easier to couple in a service vs something like EAP-TLS and EAP-MD5. I would find a way to create another service and only use EAP-MD5 as the authentication method. You're NAD may not support different properties on different ports {ie.. nas-identifier}. To match a more specific service; you can use the client mac prefix, endpoint attributes, or even regex parsing on the username. Any of these items can also be used in a service classification rule. I suspect you only have a small handfull of EAP-MD5 devices. I would probably use a custom endpoint attribute, as you can use this on the service to check if this value is here. {ie.. Endpoint: EAP-MD5 = true}. Clients that dont have that attribute will never hit that service. 

    To make things easier you can even use the same role mapping and enforcement policy in multiple services. I would just separate the logic for auth methods in different services to make life easier for the future. 


    Original Message


Related Content