How to Set Up EAP-TLS Authenticated Wi-Fi Network with Aerohive

SecureW2’s PKI services allow you to set up certificate-based EAP-TLS network authentication seamlessly, which far outweighs the security of credential-based authentication. Certificates eliminate over-the-air credential theft and password-related disconnects. No longer will the IT department have to worry about support tickets due to disconnects from password change policies, and hackers will no longer be able to farm network credentials over-the-air.

Since SecureW2 can work with any Wi-Fi infrastructure, integrating with Aerohive to set up EAP-TLS, certificate-based Wi-Fi authentication for 802.1x, has never been easier. Not only will security be immensely enhanced, but authentication management will be more streamlined as you can discover any connection issues remotely using our best-in-class device onboarding software. The guide below shows how you can integrate Aerohive with SecureW2 in just a matter of hours.

1. Configure SecureW2’s PKI Services
   • Configuring and managing a PKI is not a simple task, so SecureW2 provides a cloud PKI to streamline the process. Our turnkey PKI services includes all the necessary tools to secure and distribute certificates to 802.1x network users.
2. Configure a Secure SSID as a WPA2-Enterprise EAP-TLS
   • Configuring and managing EAP-TLS was historically mislabeled as more work than it’s worth. Today, SecureW2’s PKI and Device Onboarding solutions simplify the process so you can set up the certificate-based authentication on your network in a few short hours.
3. Add the SecureW2 RADIUS Server to the Secure SSID
   • SecureW2’s PKI Services integrate with all major RADIUS vendors, but our Cloud RADIUS is perfect for those that do not have the existing infrastructure.
4. Configure the Onboarding SSID and Landing Page
   • Users must navigate to the SecureW2 Onboarding Solution to have their devices enrolled and configured for certificates. A common solution is the use of an onboarding SSID. Once connected, users will be redirected to a customizable landing page that guides them through the onboarding process.

To complete this setup, you will need to have configured:

• A SecureW2 RADIUS Server
• A SecureW2 Network Profile
• An Identity Provider

1. In the Aerohive dashboard, click Configure > Network Policies > Edit (the edit symbol pertaining to the SecureW2 Policy).
2. Click the Wireless Networks tab and click Add > All other Networks (Standard).
3. In the Name (SSID) and Broadcast Name fields, enter a name for the network.
4. In the SSID Usage section, ensure that Enterprise WPA/WPA2 802.1X is the selected SSID Authentication.
   • Key Management should be set to WPA2-(WPA2 Enterprise)-802.1X.
   • Encryption Method should be set to CCMP (AES).
   • Enable Captive Web Portal should be set to OFF.
     

1. Next to Default RADIUS Server Group, click the + symbol to add a RADIUS server.
2. Enter a Name (and Description, if desired), click Add, and select External RADIUS Server.
3. Enter a Name.
   • This is where we will connect the SecureW2 RADIUS.
4. Navigate to JoinNow Management Portal and click AAA Configuration in the AAA Management Section.
5. Copy the Primary IP Address and navigate back to the Aerohive dashboard where we were configuring the RADIUS.
6. In the IP/Host Name field, click the + symbol and select IP Address.
7. Enter a Name and paste the Primary IP Address in the IP Address field, and click SAVE IP.
8. Navigate to JoinNow Management Portal and copy the Port, then paste the Port in the Authentication Port field.
   • Ensure that the Authentication Port is checked and the Accounting Port is unchecked.
9. Do the same for the Shared Secret in the JoinNow Management Portal.
10. Click SAVE EXTERNAL RADIUS, and you will be directed back to the Configure RADIUS Servers window.
    
11. Click Add and select External RADIUS Server.
12. Enter a new name in the Name field and repeat steps 4-10, copy and paste the Secondary IP Address in the IP Address field instead of Primary IP Address.
13. In the Configure RADIUS Servers window, click Save RADIUS.
    • In the Authenticate via RADIUS Server section, you will see both RADIUS servers that were configured.
14. Click SAVE.
15. Click the Deploy Policy tab and select the checkbox for the device listed and navigate to Upload > Perform Update.
    

This setup for a certificated-based authentication network can be completed in as little as hours. If you’d like to try out SecureW2, or have any questions about how we integrate with Aerohive, drop us a line!

We have affordable solutions for organizations of all sizes. Check out our pricing page to see how you can bring your 802.1x WPA2-Enterprise network to the next level.

Aerohive is either registered trademarks or trademarks of Aerohive Networks in the United States and/or other countries. Other trademarks, logos and service marks used in this site are the property of SecureW2 or other third parties.