エンタープライズ無線：802.1XとRADIUS

エンタープライズ無線に802.1Xが必要な理由

802.1Xの構成要素：Supplicant、Authenticator、AS

# 802.1X authentication flow:
# Supplicant (client) <--> Authenticator (AP/switch) <--> RADIUS Server
#
# 1. Client connects to AP
# 2. AP blocks all traffic except EAP (port controlled)
# 3. AP forwards EAP messages to RADIUS via RADIUS protocol
# 4. RADIUS validates credentials
# 5. RADIUS sends Access-Accept + VLAN assignment
# 6. AP opens port for client traffic

RADIUSプロトコルの基礎

# RADIUS message types:
# Access-Request:  client credentials sent from AP to RADIUS
# Access-Challenge: RADIUS asks for more information (EAP)
# Access-Accept:  credentials valid; may include VLAN assignment
# Access-Reject:  credentials invalid; AP blocks access
# Accounting-Start/Stop: usage tracking

# FreeRADIUS test:
radtest john password localhost 0 testing123

無線認証のEAP方式

# EAP method comparison:
# EAP-TLS:    Mutual certs (client + server); most secure; complex PKI
# PEAP:       Server cert only; client uses username/password inside TLS
# EAP-TTLS:   Server cert; any inner auth method (PAP, CHAP, MS-CHAPv2)
# EAP-FAST:   Cisco; PAC file for tunnel; no cert needed
# LEAP:       Deprecated; vulnerable to offline MS-CHAPv2 cracking
# EAP-MD5:    Deprecated; no mutual auth; no encryption

証明書ベースの認証（EAP-TLS）

# EAP-TLS wpa_supplicant.conf:
# network={
#   ssid='CorporateWiFi'
#   key_mgmt=WPA-EAP
#   eap=TLS
#   identity='user@company.com'
#   ca_cert='/etc/ssl/corp-ca.pem'    # validates RADIUS server cert
#   client_cert='/etc/ssl/user.pem'   # client identity cert
#   private_key='/etc/ssl/user.key'
#   private_key_passwd='keypassword'
# }

RADIUSのVLAN割り当てと動的ポリシー

# FreeRADIUS: dynamic VLAN assignment in users file:
# john   Cleartext-Password := 'SecurePass'
#         Tunnel-Type = VLAN,
#         Tunnel-Medium-Type = IEEE-802,
#         Tunnel-Private-Group-ID = '10'
#
# guest  Cleartext-Password := 'GuestPass'
#         Tunnel-Private-Group-ID = '20'
#
# Result: john gets VLAN 10, guest gets VLAN 20 from same SSID

RADIUSアカウンティングと監査証跡

# RADIUS Accounting-Start attributes logged:
# NAS-IP-Address: 10.1.1.1 (AP IP)
# Called-Station-Id: AA:BB:CC:DD:EE:FF:CorporateWiFi
# Calling-Station-Id: 11:22:33:44:55:66 (client MAC)
# User-Name: john@company.com
# Acct-Session-Id: unique session identifier
# Acct-Status-Type: Start
# Framed-IP-Address: 10.10.10.50 (assigned to client)

NPS（Network Policy Server）との統合

# NPS wireless policy logic:
# Connection Request Policy: match RADIUS clients (APs)
# Network Policy 1:
#   Conditions: AD Group = 'CorpWireless-Users'
#   Settings: VLAN 10, EAP-PEAP allowed
# Network Policy 2:
#   Conditions: AD Group = 'Guests'
#   Settings: VLAN 20, access hours restricted
# Default: DENY (fall-through if no policy matches)

IoTデバイスとヘッドレスデバイスの認証

# MAC Authentication Bypass (MAB) on Cisco switch:
interface FastEthernet0/5
  dot1x pae authenticator
  authentication port-control auto
  mab              <- falls back to MAC auth if EAP fails
  switchport access vlan 40   <- IoT VLAN if MAB succeeds

# FreeRADIUS: authorize by MAC
# 001122334455  Auth-Type := Accept
#               Tunnel-Private-Group-ID = '40'

RADIUSの高可用性とセキュリティ

# FreeRADIUS clients.conf: configure AP with strong shared secret
# client 10.1.1.1 {
#   secret     = 'xK9#mP2@vL5$nQ8!rT4^wY'
#   shortname  = floor3-ap-01
#   nas_type   = other
# }

# AP config: primary and secondary RADIUS
# radius-server host 10.2.2.1 key xK9#mP2@vL5$nQ8!rT4^wY
# radius-server host 10.2.2.2 key xK9#mP2@vL5$nQ8!rT4^wY

有線ネットワークでの802.1X

# 802.1X on a Cisco wired switch port:
interface FastEthernet0/10
  description 'Conference Room Drop'
  switchport mode access
  switchport access vlan 999     <- default quarantine until auth
  dot1x pae authenticator
  authentication port-control auto
  authentication event fail action authorize vlan 20  <- guest VLAN

クイックチェック

レッスンのまとめ