Overview

This knowledge base article describes the process for configuring SCEP (Simple Certificate Enrollment Protocol) and IEEE 802.1X authentication on a zTC device. The procedure outlines certificate enrollment over an unsecured network and subsequent migration to a secured, certificate-based network using EAP-TLS.

Environment Details

• SnapOS Firmware Version: 1.3.357
• Hardware: zTC (N100 TC)
• Switch Model: Netgear GS324TPv2

Prerequisites

• Access to an external DHCP server on the unsecured network
• A functional SCEP server capable of issuing device certificates
• A network supporting 802.1X with EAP-TLS authentication
• Required CA and client certificates issued via SCEP

Initial Network Connectivity (Unsecured Network)

1. Connect the zTC to the Unsecured (Red) network.
2. Verify that the device receives an IP address in the 10.50.x.x range from the external DHCP server
   (example: 10.50.1.0).

At this stage, the device uses the unsecured network only to complete certificate enrollment.

Certificate Enrollment Using SCEP

1. Access the SCEP enrollment interface on the zTC.
2. Obtain the Challenge Code from the SCEP server while connected to the unsecured network.

3. Enter the challenge code and provide the required certificate information.

4. Submit the request and confirm that the enrollment completes successfully.

Upon successful enrollment, the issued certificates are stored on the zTC at:

/etc/scep

Enabling 802.1X Authentication

1. Navigate to the Network configuration page on the zTC.
2. Enable 802.1X authentication.
3. Add the required certificates obtained via SCEP:
   • Client certificate
   • Private key
   • CA certificate
4. Apply the configuration changes.

Applying Network Changes

To ensure the 802.1X configuration is fully applied, perform one of the following actions:

• Reboot the zTC device, or
• Disable and re-enable eth0 from the Network configuration page.

Migration to Secured Network

After successful authentication:

• The eth0 interface transitions from the Unsecured Red Network (10.50.1.0) to the Secured White Network
• Example secured IP address: 172.31.2.92
• Network security status will indicate 802.1X, EAP-TLS

At this point, the zTC is fully authenticated and operating on the secured network.

Result

The zTC successfully enrolls certificates using SCEP over an unsecured network and transitions to a secured, 802.1X-enabled network using EAP-TLS authentication.

---

End of Procedure