5-29
Cisco Video Surveillance 8020/8030 IP Camera Reference Guide
Chapter 5 Configuration
Security > IEEE 802.1X
–
Range—This rule allows the user to assign a range of IP addresses to the Allow/Deny List. This
rule only applies to IPv4 addresses
Administrator IP address
•
Always allow the IP address to access this device—You can check this item and add the
Administrator’s IP address in this field to make sure the Administrator can always connect to the
device.
Security > IEEE 802.1X
Enable this function if your network environment uses IEEE 802.1x, which is a port-based network
access control. The network devices, intermediary switch/access point/hub, and RADIUS server must
support and enable 802.1x settings.
The 802.1x standard is designed to enhance the security of local area networks, which provides
authentication to network devices (clients) attached to a network port (wired or wireless). If all
certificates between client and server are verified, a point-to-point connection will be enabled; if
authentication fails, access on that port will be prohibited. 802.1x utilizes an existing protocol, the
Extensible Authentication Protocol (EAP), to facilitate communication.
The components of a protected network with 802.1x authentication include the following:
•
Supplicant—A client end user (camera), which requests authentication
•
Authenticator (an access point or a switch)—A “go between” that restricts unauthorized end users
from communicating with the authentication server
•
3. Authentication server (usually a RADIUS server)—Checks the client certificate and decides
whether to accept the end user access request.
Cameras support two types of EAP methods to perform authentication: EAPPEAP and EAP-TLS.
To enable 802.1x settings, follow these steps:
Step 1
Before connecting the camera to the protected network with 802.1x, apply a digital certificate from a
Certificate Authority (such as your network administrator) that can be validated by a RADIUS server.
Step 2
Connect the camera to a PC or notebook outside of the protected LAN. Open the configuration page of
the camera. Select EAP-PEAP or EAP-TLS as the EAP method. In the field, enter your ID and password
issued by the CA, then upload related certificate(s).
Step 3
When all settings are complete, move the camera to the protected LAN by connecting it to an 802.1x
enabled switch. The devices will then start the authentication automatically.
Note
The authentication process for 802.1x:
1. The Certificate Authority (CA) provides the required signed certificates to the camera (the supplicant)
and the RADIUS Server (the authentication server).
2. A camera requests access to the protected LAN using 802.1X via a switch (the authenticator). The
client offers its identity and client certificate, which is then forwarded by the switch to the RADIUS
