DPPSK with External Server

Zyxel_Claudia

Dynamic Personal Pre-Shared Key (DPPSK) is a powerful feature aimed at enhancing user privacy and data integrity in a wireless network by assigning unique passwords to individual clients. This ensures that each client's traffic is encrypted with a unique key, enhancing security.

Scaling DPPSK with External RADIUS Server

When dealing with networks that exceed 2048 entries, it is recommended to use an external RADIUS server for managing DPPSK.

How DPPSK with External RADIUS Server Works

1. Client Authentication:
   • A client device attempts to connect to an SSID.
   • The access point (AP) triggers a RADIUS request using MAC-based authentication to the external RADIUS server.
   • The client's MAC address serves as both the username and password for the initial authentication step.
2. RADIUS Server Response:
   • If the client’s MAC address is found in the RADIUS server database, the server responds the result (tunnel password) to access point (AP).
   • The AP stores this DPPSK and uses it to authenticate the client.
3. Client Connection:
   • The client then enters the DPPSK as the Wi-Fi password.
   • The AP authenticates the client using the provided DPPSK, ensuring a secure connection.

Configuration Steps

1. NCC Configuration:
   • In the SSID settings, select DPPSK with "My RADIUS Server".
   • Enter the RADIUS server IP, port (usually 1812), shared secret, and account format.
2. RADIUS Server Setup:
   • Ensure the RADIUS server has a list of client MAC addresses and their corresponding DPPSK passwords.
   • Configure the server to return the DPPSK in the tunnel password attribute (attribute number 69).

Troubleshooting

1. Event Logs:
   • 802.1x Authentication Timeout: Indicates no response from the RADIUS server.
   • 802.1x Authentication Fail: Indicates the server rejected the client's credentials.
   • EAPOL Process Fail: Could indicate an incorrect DPPSK, an invalid tunnel password, or missing tunnel password attributes.
2. Compatibility:
   • DPPSK with external RADIUS servers does not support Windows RADIUS and NPS servers due to a known issue with the tunnel password format.

Conclusion

DPPSK with an external RADIUS server offers a scalable and secure method to manage unique client authentication in large networks. By ensuring each client's traffic is encrypted with a unique key, it significantly enhances data integrity and privacy.