Configure 802.1x with SCEP

​

Introduction

This procedure explains how to configure 802.1x port-based network access control (PNAC) on nodes managed by Edge Infrastructure Services. You will create a certificate enrollment profile that defines how EVE-OS (Edge Virtualization Engine) obtains and renews device certificates via SCEP, attach that profile to a project, and mark the appropriate network adapters as 802.1x-eligible. Complete these steps before deploying nodes into enterprise network environments that require certificate-based port authentication. For background on how 802.1x and SCEP work in EVE-OS, see 802.1x Port-Based Network Access Control Overview.

​

Prerequisites

• You have the SysManager or SysAdmin role in your enterprise. See Manage Roles.
• A SCEP-compatible Certificate Authority (CA) accessible either directly from the node’s bootstrap VLAN or from Edge Infrastructure Services (via the controller SCEP proxy). You need the SCEP server URL and a challenge password.
• CA certificate bundle in PEM format (root CA and any required intermediate CAs), ready for upload.
• A project where you will add the 802.1x policy. Create the project before continuing if it does not exist.
• Nodes running EVE-OS 14.5.0-LTS or later.

​

Prepare Your Network Equipment

​

Configure the network switch

The switch connected to your node ports must be a managed switch with IEEE 802.1x support. Configure the following on each port that will connect to an EVE-OS node: Enable 802.1x port authentication. Enable IEEE 802.1x on each switch port and configure a RADIUS server as the authentication backend. The RADIUS server must be configured to validate EAP-TLS client certificates. Configure two VLANs. The switch requires two VLANs to support the certificate bootstrapping flow:

• Bootstrap VLAN (also called a guest or auth-fail VLAN): Provides limited network access. The node must be able to reach Edge Infrastructure Services and the SCEP server from this VLAN. The switch assigns this VLAN to the port when the device is not yet authenticated.
• Authenticated VLAN: Provides full network access. The switch moves the port to this VLAN after a successful 802.1x authentication.

Configure vendor class identifier recognition. Configure the switch or DHCP server to recognize the LFEDGE-EVE vendor class identifier (DHCP Option 60) and allow traffic to Edge Infrastructure Services from the bootstrap VLAN. If your switch does not support vendor class identifier-based policy, you can allow all traffic from the bootstrap VLAN to the Edge Infrastructure Services IP address.

​

Configure the SCEP server

Configure the following on your SCEP server:

• A CA certificate and private key for signing enrolled device certificates.
• A challenge password (shared secret) that devices use to authenticate their enrollment requests.
• The CA certificate used by the SCEP server must also be configured in the RADIUS server’s EAP-TLS settings as a trusted CA for client certificate validation.

​

Create a Certificate Enrollment Profile

A certificate enrollment profile defines the connection to your SCEP server and the certificate attributes EVE-OS uses when requesting device certificates. You create this profile once and attach it to one or more projects.

1. In the header, click your profile avatar.
2. Click Enterprise Settings.
3. Click the Security tab.
4. Click the Device & Network Trust sub-tab.
5. In the Certificate Enrollment Profiles section, click the Create Profile button.

​

Configure identity

1. In the Name field, enter a unique identifier for the profile. The name cannot contain spaces.
2. In the Display Title field, enter a human-readable label for the profile.
3. In the Description field, enter an optional description.

​

Configure SCEP

1. In the SCEP URL field, enter the full URL of your SCEP server endpoint (for example, https://scep.example.com/scep or https://scep.example.com:8080/scep).
2. In the Challenge Password field, enter the pre-shared challenge password configured on your SCEP server.
3. Enable the Use controller proxy toggle if your SCEP server is not directly reachable from the bootstrap VLAN. When enabled, Edge Infrastructure Services relays SCEP requests to the server on behalf of the node.

​

Configure the certificate authority

1. In the Certificate Authority section, paste your CA certificate chain in PEM format, or click Upload PEM and select the file. Upload the root CA and all required intermediate CAs.

​

Configure the CSR profile

The CSR profile section defines the certificate subject. Edge Infrastructure Services supports dynamic variable substitution so that every device receives a unique certificate. For the full list of supported system variables, see Custom Configuration for Applications.

1. In the Common Name Template field, enter a value or variable:
   • To use the node’s system-generated ID: $zri.system.edge-node.id
   • To use the node’s name: $zri.system.edge-node.name
   • To use the hardware serial number: $zri.system.edge-node.serial
2. Optionally, complete the Organization, Organizational Unit, Country, State, and Locality fields.
3. In the SAN URI field, enter a URI value or variable, for example URN:Serial:$zri.system.edge-node.serial.
4. Optionally, enter a SAN Email if your CA policy requires one.

​

Configure key and renewal settings

1. Under Key Family, RSA is the supported key family for this release.
2. Select the RSA Key Size from the dropdown.
3. Select the Hash Algorithm from the dropdown.
4. In the Renewal Period (%) field, enter a percentage. Edge Infrastructure Services starts renewing the certificate after this percentage of its validity period has elapsed. For example, entering 50 triggers renewal when 50% of the certificate’s lifetime has passed. Coordinate this value with your CA administrator based on certificate validity length and expected device offline periods.
5. Click Create Profile.

​

Enable 802.1x in the Project Node Policy

​

On a new project

The Policies step is available for Standard and Deployment project types. Azure IoT projects do not include a Policies step; use the existing project flow instead.

1. Open Infrastructure > Fleet > Projects.
2. Click the Add button (floating button in the lower right of the page).
3. Select Standard or Deployment as the project type.
4. Complete the Identity step and click Next.
5. On the Policies step, locate the Node Policy card and enable its toggle.
6. Inside the Node Policy card, toggle on 802.1X Port-Based Network Access Control.
7. The EAP Method field shows TLS and cannot be changed. TLS is the only supported method for this release.
8. In the EAP Identity field, enter an optional identity string to send during the EAP handshake. If left blank, EVE-OS uses the device certificate identity.
9. From the Certificate Enrollment Profile dropdown, select the profile you created.
10. Click Next to proceed to the Review step, then click Create Project.

​

On an existing project

1. Open Infrastructure > Fleet > Projects.
2. Click the name of the project you want to configure.
3. Click the Configure (gear) button in the upper right of the page.
4. Click the Policies tab.
5. Click Node Policy.
6. Toggle on 802.1X Port-Based Network Access Control.
7. The EAP Method field shows TLS and cannot be changed. TLS is the only supported method for this release.
8. In the EAP Identity field, enter an optional identity string to send during the EAP handshake. If left blank, EVE-OS uses the device certificate identity.
9. From the Certificate Enrollment Profile dropdown, select the profile you created.
10. Click Save Changes.

​

Enable 802.1x on a New Node During Onboarding

1. Log into Edge Infrastructure Services.
2. Begin the standard node onboarding flow.
3. In the Network Adapters section, locate each adapter that connects to an 802.1x-protected switch port.
4. Enable the Enable 802.1x toggle for each of those adapter rows.
5. Set the Interface Usage for each adapter as appropriate.
6. Click Save & Add to complete onboarding.

​

Enable 802.1x on an Existing Node

1. Log into Edge Infrastructure Services.
2. Open Infrastructure > Fleet > Nodes.
3. Click the name of the node you want to configure.
4. Click the Adapters tab.
5. Locate the adapter that connects to the 802.1x-protected switch port.
6. In the expanded adapter row, locate the Enable 802.1x toggle.
7. Toggle Enable 802.1x to enable it.
8. Repeat for any additional adapters.
9. Click Save.

​

Verify the Configuration

On the Nodes list page, the Certificate Status column shows the enrollment state for each node. Expected status values include:

• Valid: The device has successfully obtained a certificate from the SCEP server and is authenticated to the network.
• Pending: The SCEP server returned a pending status, meaning the certificate request requires manual approval.
• Enrollment Failed: The enrollment request was submitted but the SCEP server returned a failure.
• Renewal Failed: The most recent renewal attempt failed. The existing certificate may still be valid and active.
• Renewal Pending: A renewal request has been submitted and is awaiting completion.
• Expired: The certificate’s validity period has ended.
• Invalid Configuration: The certificate configuration is malformed or missing required fields.

If Certificate Status shows Enrollment Failed, verify that the SCEP server URL is reachable from the bootstrap VLAN and that the challenge password is correct. If the Enable 802.1x toggle is unavailable on an adapter, confirm that Enable 802.1x is toggled on in the project’s Node Policy. If the device appears stuck in the quarantine VLAN after certificate installation, verify that the RADIUS server is receiving the re-authentication request and that the certificate’s DN or SAN matches the policy configured on the PNAC backend.

​

Next Steps