802.1x Authentication with custom device Certificat

[Anonymous]

Hello all,

I am trying to setup 802.1x Auhentication with custom device Certificat. We have our own PKI ( Microsoft OS), the 802.1x  Authentication should be done with device certificate from own PKI against a radius server (Microsoft OS) in the same network.

The ethernet switch is a Cisco Catalyst, the phone is a Polycom vvx1500 uc-software version 4.0.1.13681.

Any ideas how to install the device certificate on the phone ? it is possible to use device certificate from own PKI ?

Thank you

[SteffenBaierUK]

Hello nb,

there are plenty of posts within the community regarding certificates.

The UCS 4.0.1 Admin Guide describes the 802.1x functionality.

Best Regards

Steffen Baier

[Anonymous]

nb,

i just did this last week. for some reason my authenticator could not validate the factory installed device certificate on my polycom phones. so i ended up exporting a domain user certificate, with private key, to a pem format. then import the file to the custom device credential using the phone menu.

tj

[Anonymous]

Hi TonyJ

Do you mind sharing the steps you used to accomplish this?

Thanks

Brian

[Anonymous]

Hi Steffen,

Refering to Feature Profile 37148 for Device Certificates on Polycom Phones, it states that device certificates are designed for use for 802.1X authentication. 

Questions:

1.  We have over 200 Polycom phones in our environment.  Would using device certificates require an individual certificate for each phone?  What is best practice for that many phones?

2.  When I attempt to use a CA Certificate, I see "unknown CA" in Wireshark logs.  Troubleshooting notes indicate that we are using an incorrect or missing certificate.  What is the method for using a certificate where the CA is known?  Is there an intermediary root CA that I need?

Thank you for any info you could provide.

[SteffenBaierUK]

Hello nkutchins,

welcome to the Polycom Community.

Each phone would use the same certificate. Simply have a provisioning server and pending on your requirements use the 000000000000.cfg or individual <mac>.cfg

The FAQ contains:

Mar 08, 2013 Question: What files does my phone download or upload and why?

Resolution: Please check => here <=

Oct 7, 2011 Question: Can I use substitutions when I provisioning my Phones?

Resolution: Please check => here <=

An unsupported script to roll this out can be found => here <=

Not knowing your details or you configuration I suggest you work with a Polycom reseller to receive support.

If this is some sort of an Internet discounter please post either your phone's MAC address or your Polycom devices serial so I can look up who would be able to support you.

Please ensure to provide some feedback if this reply has helped you so other users can profit from your experience.

Best Regards

Steffen Baier

Polycom Global Services