Recommendations

The following list of recommendations summarizes the best practices covered throughout this document:

• Most customers are expected to already have a PKI to leverage for any 802.1X EAP authentications.
  • To be able to use EAP-TTLS, customers’ IT specialists must provide:
    • The public root CA and any intermediate signing CAs in PEM format. The Mist administrator must load those into Organization > Certificates > Certificate Authorities.
    • A public and private certificate for the RADIUS server (as a TLS-Server) in PEM format. The Mist administrator must load those into Organization > Certificates > Certificate Authorities.
    • It’s expected that all customer supplicants have already learned the public root CA and any intermediate signing CA either manually or through MDM.
  • To be able to use EAP-TLS (or TEAP-TLS or PEAP-TLS) customers’ IT specialists must provide:
    • The public root-CA and any intermediate signing CA in PEM format. The Mist administrator must load those into Organization > Certificates > Certificate Authorities.
    • A public and private certificate for the RADIUS server (as a TLS-Server) in PEM format. The Mist administrator must load those into Organization > Certificates > Certificate Authorities.
    • It’s expected that all customer supplicants have already learned the public root CA and any intermediate signing CA either manually or through MDM.
    • A client certificate (signed by the PKI) for all customer supplicants. If that certificate is deployed manually or using an MDM is left up to the customer’s preference.
• It’s recommended to use the Mist PKI that is automatically generated for each organization for the purpose of:
  • Establishing the RadSec tunnels from all Juniper Mist-managed devices towards the authentication cloud.
  • EAP-TLS supplicant authentication of a Juniper AP towards the switch.
• When customers are using public IdPs, it’s best to perform the integration with Juniper Mist cloud together with the customer’s IT personnel for familiarity with the infrastructure and having the right authorization level.
• Authentication policies are executed similarly to a firewall. The evaluation execution happens top to bottom and wherever a match is found, it is executed and the policies below that one will not be evaluated. Hence, it is recommended that one positions the more specific (or exception) rules above the more generic rules.
• Use switch and WLAN templates for efficient configuration management. Configuration errors and unnecessary additional work can be avoided this way.
• When deciding how to manage switch port configurations dynamically:
  • Assigning VLANs and filters via RADIUS/NAC infrastructure is the recommended approach. Juniper Mist Access Assurance is designed to make this an easy task.
  • Using Dynamic Port Configuration is less preferred.
• Using MAC address-based authentication is only recommended when no EAP supplicant can be used on a client. MAC addresses are easy to fake by any attacker. Hence, it is suggested that those clients only get limited access to corporate resources.
• When using a Juniper Mist Campus Fabric perform the authentications via Out of Band management interfaces that are also used for Switch management towards Mist cloud. This will avoid potential issues with a too high overlay transport MTU towards a Mist-Edge as Proxy on standard MTU and EAP authentication with large certificates.