Wi-Fi employee access – Juniper Mist

In this topic, you will learn how to configure access points managed by Juniper Mist to authenticate Wi-Fi devices with Portnox™ Cloud using 802.1X, 802.1X over RadSec, MAC-based authentication, and identity pre-shared keys (IPSK).

Important:
This guide gives general instructions for integrating Portnox Cloud with specific third-party devices. We try to provide useful examples for common models, but settings can differ between manufacturers, models, and environments. Because of this, we cannot guarantee these steps will work in every case. For questions or problems with RADIUS setup – which is an industry standard and not specific to Portnox – or with device-specific settings and troubleshooting, we recommend checking the device manufacturer’s documentation and contacting their support team. Portnox Support can help when possible, but detailed setup of third-party devices is usually best handled by the manufacturer. We also recommend updating your NAS device firmware to the latest version, as old firmware can cause issues.
Important:
All values in this configuration are examples. Make sure to adjust the configuration to your individual profile names, RADIUS server addresses, ports, and keys by replacing the values that are presented as underlined italics.
Note:
This configuration was tested on Juniper Mist with an AP36 access point running firmware 0.15.34533. The capabilities and the user interface on other versions of the platform may differ.

Create an SSID for 802.1X authentication

In this section, you will create a new SSID and configure it for WPA2 or WPA3 Enterprise authentication, using the Portnox Cloud RADIUS servers.

  1. In the left-hand side menu of the Mist Cloud, click on the following menu options: Site > WLANs.

  2. In the WLANs pane, click on the Add WLAN button in the top-right corner.

  3. In the New WLAN pane, in the SSID field, type the SSID of your new WLAN.

  4. Deactivate the Wi-Fi features that limit the available security options:
    Note:
    If the 6 GHz checkbox is active or Wi-Fi 7 is enabled, the WPA2 and Open Access options are not available in the Security section.
    1. In the Radio Band section, deactivate the 6 GHz checkbox.

    2. In the Wi-Fi Protocols section, make sure that the Disabled option is selected in the Wi-Fi 7 row.

  5. In the Security section, click on either the WPA3 or the WPA2 tile, and then click on the Enterprise (802.1X) tile below.

  6. In the Authentication Servers section, select the RADIUS option, and then in the RADIUS Authentication Servers section, click on the Add Server link.

  7. In the New Server section, enter the details of the authentication server:

    1. In the Hostname field, enter the Cloud RADIUS IP value, which you got when you created your RADIUS servers.
    2. In the Port field, replace the default value with the Authentication Port value, which you also got when you created your RADIUS servers.
    3. In the Shared Secret field, enter the Shared Secret value, which you also got when you created your RADIUS servers.
    4. Click on the  ✓  icon in the New Server header to save the server.
  8. In the RADIUS Accounting Servers section, click on the Add Server link.

  9. In the New Server section, enter the details of the accounting server:

    1. In the Hostname field, enter the Cloud RADIUS IP value, which you got when you created your RADIUS servers.
    2. In the Port field, replace the default value with the Accounting Port value, which you also got when you created your RADIUS servers.
    3. In the Shared Secret field, enter the Shared Secret value, which you also got when you created your RADIUS servers.
    4. Click on the  ✓  icon in the New Server header to save the server.
  10. Optional: Repeat the previous four steps for the other Cloud RADIUS server, if necessary, or for both Cloud RADIUS servers if you added your local RADIUS server as the primary server.

    Use the arrow icons next to the servers to change their order. The server at the top of the list is the primary server.

  11. In all other sections of the New WLAN pane, either leave the default values or configure the values as required for your WLAN environment. These fields are not related to Portnox Cloud or RADIUS authentication.
  12. Click on the Create button in the top-right corner of the New WLAN pane to create the new WLAN.

Result: You created an SSID that authenticates employee Wi-Fi devices using 802.1X and the Portnox Cloud RADIUS servers.

Optional: Create an SSID for RadSec authentication

This is an optional task. Follow this task only if you want your SSID to connect to Portnox Cloud RADIUS servers using RadSec.

Add the RadSec certificates

In this section, you will add the Cloud RADIUS root certificate to Mist, so that your access points can verify Portnox Cloud, and add the Mist certificate to Portnox Cloud, so that Portnox Cloud can verify your access points.

Before you begin, in Portnox Cloud, go to Settings > Services > CLOUD RADIUS SERVICE > Cloud RADIUS instance, select the relevant RADIUS instance, and select  ⋮  > Edit. Activate the Enable RADIUS over TLS (RadSec) option and the Validate NAS Client Certificate (RadSec) option, and click on the Save button.

Warning:
If you activate the Validate NAS Client Certificate (RadSec) option, all your NAS devices that use RadSec with the same Cloud RADIUS instance must present a client certificate that Portnox Cloud trusts.

Mist generates a certificate authority for your organization and issues certificates to your access points automatically. You do not need to create any certificates yourself.

  1. Download the DigiCert Trusted Root G4 certificate in PEM format from DigiCert. Then, open the downloaded file in a text editor and copy its entire content, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.
  2. In the left-hand side menu of the Mist Cloud, click on the following menu options: Organization > Settings.

  3. In the RadSec Certificates section, click on the Add a RadSec certificate link.

  4. In the RadSec Certificate window, paste the content of the DigiCert certificate, and click on the Add button.

  5. In the Mist Certificate section, click on the View Certificate link.

  6. In the Organization Certificate window, click on the Copy button, and then click on the Close button.

  7. Paste the copied content into a text editor, and save it as a file, for example, mist_ca.pem.
  8. Click on the Save button in the top-right corner of the Organization Settings page.

  9. In Portnox Cloud, go to Settings > Services > GENERAL SETTINGS > Trusted Root Certificates, and upload the mist_ca.pem file.

Result: Your access points trust the Cloud RADIUS servers, and Portnox Cloud trusts the certificates of your access points.

Configure the SSID

In this section, you will create a new SSID for 802.1X authentication that connects to the Portnox Cloud RADIUS servers using RadSec.

  1. In the left-hand side menu of the Mist Cloud, click on the following menu options: Site > WLANs.

  2. In the WLANs pane, click on the Add WLAN button in the top-right corner.

  3. In the New WLAN pane, in the SSID field, type the SSID of your new WLAN.

  4. Deactivate the Wi-Fi features that limit the available security options:
    Note:
    If the 6 GHz checkbox is active or Wi-Fi 7 is enabled, the WPA2 and Open Access options are not available in the Security section.
    1. In the Radio Band section, deactivate the 6 GHz checkbox.

    2. In the Wi-Fi Protocols section, make sure that the Disabled option is selected in the Wi-Fi 7 row.

  5. In the Security section, click on either the WPA3 or the WPA2 tile, and then click on the Enterprise (802.1X) tile below.

  6. In the Authentication Servers section, select the RadSec option, and leave the Server Name field empty.

  7. In the Server Addresses section, click on the Add Server link.

  8. In the New Server section, enter the details of the RadSec server:

    1. In the Hostname field, enter the FQDN (fully qualified domain name) of the Portnox Cloud RADIUS server, not its IP address.
      Warning:
      If you use the IP address, this configuration will not work.

      To find the FQDN of your Cloud RADIUS server, see the following topic: What are the fully qualified domain names (FQDNs) of Cloud RADIUS servers.

    2. In the Port field, replace the default value with the Authentication Port value, which you got when you created your RADIUS servers.
    3. Click on the  ✓  icon in the New Server header to save the server.
  9. Optional: Repeat the previous two steps for the other Cloud RADIUS server, if necessary.

    Use the arrow icons next to the servers to change their order. The server at the top of the list is the primary server.

  10. In all other sections of the New WLAN pane, either leave the default values or configure the values as required for your WLAN environment. These fields are not related to Portnox Cloud or RADIUS authentication.
  11. Click on the Create button in the top-right corner of the New WLAN pane to create the new WLAN.

Result: You created an SSID that authenticates employee Wi-Fi devices using 802.1X and the Portnox Cloud RADIUS servers, over RadSec.

Optional: Create an SSID for MAC-based authentication

This is an optional task. Follow this task only if you want to authenticate devices, such as IoT devices, that do not support 802.1X, using their MAC address instead. Skip this task if you do not need MAC-based authentication.

Important:
Mist does not let you combine 802.1X and MAC-based authentication on the same SSID. If you select the Enterprise (802.1X) tile, Mist grays out the MAC address authentication by RADIUS lookup checkbox. Create a separate SSID for MAC-based authentication instead, as described in this section.
  1. In the left-hand side menu of the Mist Cloud, click on the following menu options: Site > WLANs.

  2. In the WLANs pane, click on the Add WLAN button in the top-right corner.

  3. In the New WLAN pane, in the SSID field, type the SSID of your new WLAN.

  4. Deactivate the Wi-Fi features that limit the available security options:
    Note:
    If the 6 GHz checkbox is active or Wi-Fi 7 is enabled, the WPA2 and Open Access options are not available in the Security section.
    1. In the Radio Band section, deactivate the 6 GHz checkbox.

    2. In the Wi-Fi Protocols section, make sure that the Disabled option is selected in the Wi-Fi 7 row.

  5. In the Security section, click on the Open Access tile, and then activate the MAC address authentication by RADIUS lookup checkbox.

  6. In the Authentication Servers section, select the RADIUS option, and then in the RADIUS Authentication Servers section, click on the Add Server link.

  7. In the New Server section, enter the details of the authentication server:

    1. In the Hostname field, enter the Cloud RADIUS IP value, which you got when you created your RADIUS servers.
    2. In the Port field, replace the default value with the Authentication Port value, which you also got when you created your RADIUS servers.
    3. In the Shared Secret field, enter the Shared Secret value, which you also got when you created your RADIUS servers.
    4. Click on the  ✓  icon in the New Server header to save the server.
  8. In the RADIUS Accounting Servers section, click on the Add Server link.

  9. In the New Server section, enter the details of the accounting server:

    1. In the Hostname field, enter the Cloud RADIUS IP value, which you got when you created your RADIUS servers.
    2. In the Port field, replace the default value with the Accounting Port value, which you also got when you created your RADIUS servers.
    3. In the Shared Secret field, enter the Shared Secret value, which you also got when you created your RADIUS servers.
    4. Click on the  ✓  icon in the New Server header to save the server.
  10. Optional: Repeat the previous four steps for the other Cloud RADIUS server, if necessary, or for both Cloud RADIUS servers if you added your local RADIUS server as the primary server.

    Use the arrow icons next to the servers to change their order. The server at the top of the list is the primary server.

  11. In all other sections of the New WLAN pane, either leave the default values or configure the values as required for your WLAN environment. These fields are not related to Portnox Cloud or RADIUS authentication.
  12. Click on the Create button in the top-right corner of the New WLAN pane to create the new WLAN.

Result: You created a separate SSID that authenticates IoT devices by their MAC address using the Portnox Cloud RADIUS servers on the basis of MAC-based accounts.

Optional: Create an SSID for IPSK authentication

This is an optional task. Follow this task only if you want to authenticate devices using RADIUS-based identity pre-shared keys (IPSK). Juniper Mist calls this feature RADIUS PSK. Skip this task if you do not need IPSK authentication.

Warning:
At the moment, we are experiencing problems with how Juniper Mist handles IPSK. In our tests, Portnox Cloud returned the correct key to the access point, but the access point rejected the connection with a PSK mismatch error. The configuration below may not work in some circumstances. Test it with a single device before you deploy it to all your devices.
Important:
You cannot use the same SSID for both WPA2/WPA3 Enterprise authentication and IPSK authentication. Create a separate SSID for IPSK, as described in this section.

For more information about IPSK in Portnox Cloud, see the following topic: Create a MAC-based account.

  1. In the left-hand side menu of the Mist Cloud, click on the following menu options: Site > WLANs.

  2. In the WLANs pane, click on the Add WLAN button in the top-right corner.

  3. In the New WLAN pane, in the SSID field, type the SSID of your new WLAN.

  4. Deactivate the Wi-Fi features that limit the available security options:
    Note:
    If the 6 GHz checkbox is active or Wi-Fi 7 is enabled, the WPA2 and Open Access options are not available in the Security section.
    1. In the Radio Band section, deactivate the 6 GHz checkbox.

    2. In the Wi-Fi Protocols section, make sure that the Disabled option is selected in the Wi-Fi 7 row.

  5. In the Security section, click on the WPA2 tile, then click on the Personal (PSK) tile below, then select the Multiple passphrases option, and select the RADIUS PSK option. Leave the Default PSK and Default VLAN ID fields empty.

    If you enter a default PSK, devices without an IPSK from Portnox Cloud can connect using that key.

  6. In the Authentication Servers section, select the RADIUS option, and then in the RADIUS Authentication Servers section, click on the Add Server link.

  7. In the New Server section, enter the details of the authentication server:

    1. In the Hostname field, enter the Cloud RADIUS IP value, which you got when you created your RADIUS servers.
    2. In the Port field, replace the default value with the Authentication Port value, which you also got when you created your RADIUS servers.
    3. In the Shared Secret field, enter the Shared Secret value, which you also got when you created your RADIUS servers.
    4. Click on the  ✓  icon in the New Server header to save the server.
  8. In the RADIUS Accounting Servers section, click on the Add Server link.

  9. In the New Server section, enter the details of the accounting server:

    1. In the Hostname field, enter the Cloud RADIUS IP value, which you got when you created your RADIUS servers.
    2. In the Port field, replace the default value with the Accounting Port value, which you also got when you created your RADIUS servers.
    3. In the Shared Secret field, enter the Shared Secret value, which you also got when you created your RADIUS servers.
    4. Click on the  ✓  icon in the New Server header to save the server.
  10. Optional: Repeat the previous four steps for the other Cloud RADIUS server, if necessary, or for both Cloud RADIUS servers if you added your local RADIUS server as the primary server.

    Use the arrow icons next to the servers to change their order. The server at the top of the list is the primary server.

  11. In all other sections of the New WLAN pane, either leave the default values or configure the values as required for your WLAN environment. These fields are not related to Portnox Cloud or RADIUS authentication.
  12. Click on the Create button in the top-right corner of the New WLAN pane to create the new WLAN.

Result: You created a separate SSID that authenticates devices using identity pre-shared keys from Portnox Cloud.