AXIS FA51 Main Unit
The device interface
•
Create certificate signing request
: Create a certificate signing request to send to a registration authority to apply
for a digital identity certificate.
IEEE 802.1x
IEEE 802.1x is an IEEE standard for port-based network admission control providing secure authentication of wired and wireless
network devices. IEEE 802.1x is based on EAP (Extensible Authentication Protocol).
To access a network protected by IEEE 802.1x, network devices must authenticate themselves. The authentication is performed by
an authentication server, typically a RADIUS server (for example FreeRADIUS and Microsoft Internet Authentication Server).
Certificates
When configured without a CA certificate, server certificate validation is disabled and the device tries to authenticate itself
regardless of what network it is connected to.
When using a certificate, in Axis' implementation, the device and the authentication server authenticate themselves with digital
certificates using EAP-TLS (Extensible Authentication Protocol - Transport Layer Security).
To allow the device to access a network protected through certificates, a signed client certificate must be installed on the device.
Client certificate
: Select a client certificate to use IEEE 802.1x. The authentication server uses the certificate to validate the
client’s identity.
CA certificate
: Select a CA certificate to validate the authentication server’s identity. When no certificate is selected, the device
tries to authenticate itself regardless of what network it is connected to.
EAP identity
: Enter the user identity associated with the client certificate.
EAPOL version
: Select the EAPOL version that is used in the network switch.
Use IEEE 802.1x
: Select to use the IEEE 802.1x protocol.
Prevent brute-force attacks
Blocking
: Turn on to block brute-force attacks. A brute-force attack uses trial-and-error to guess login info or encryption keys.
Blocking period
: Enter the number of seconds to block a brute-force attack.
Blocking conditions
: Enter the number of authentication failures allowed per second before the block starts. You can set the
number of failures allowed both on page level and device level.
IP address filter
Use filter
: Select to filter which IP addresses that are allowed to access the device.
Policy
: Choose whether to
Allow
access or
Deny
access for certain IP addresses.
Addresses
: Enter the IP numbers that are either allowed or denied access to the device. You can also use the CIDR format.
Custom-signed firmware certificate
To install test firmware or other custom firmware from Axis on the device, you need a custom-signed firmware certificate. The
certificate verifies that the firmware is approved by both the device owner and Axis. The firmware can only run on a specific
device which is identified by its unique serial number and chip ID. Custom-signed firmware certificates can only be created
by Axis, since Axis holds the key to sign them.
Click
Install
to install the certificate. You need to install the certificate before you install the firmware.
25