Wiki source code of RangeeOS - Netzwerkverbindung mit 802.1x Authentifizierung
Last modified by Tobias Wintrich on 2026/08/07 12:09
Hide last authors
| author | version | line-number | content |
|---|---|---|---|
 |
5.1 | 1 | With RangeeOS, you can easily establish a connection to an 802.1x-secured network. The general setup of the 802.1x connection is described in our manual under [[LAN Profile>>doc:Handbuecher.Rangee Thin Client Admin Guide 13\.00.Kapitel 2 - Kommbox.2\.F Anschlüsse.2\.F\.B Netzwerk.2\.F\.B\.A Profil LAN.WebHome]] and [[WLAN Profile>>doc:Handbuecher.Rangee Thin Client Admin Guide 13\.00.Kapitel 2 - Kommbox.2\.F Anschlüsse.2\.F\.B Netzwerk.2\.F\.B\.D WLAN-Profil.WebHome]]. This article explains additional options and possibilities for practical setup. |
| |
4.1 | 2 | |
| |
3.1 | 3 | {{toc/}} |
| |
4.1 | 4 | |
| |
3.1 | 5 | [[image:1786095913113-409.png||height="445" width="800"]] |
| |
4.1 | 6 | |
| |
5.1 | 7 | = Certificates = |
| |
4.1 | 8 | |
| |
5.1 | 9 | An 802.1x connection is usually secured by a certificate. These certificates can be transferred to the device with RangeeOS in different ways. |
| |
3.1 | 10 | |
| |
5.1 | 11 | == Automatically via SCEP == |
| |
3.1 | 12 | |
| |
5.1 | 13 | Instructions for automatic retrieval via SCEP (Simple Certificate Enrollment Protocol) can be found in our KnowledgeBase in the following HowTo: |
| 14 | [[RangeeOS - Obtaining a computer user certificate with SCEP>>doc:HowTos.RangeeOS - Mit SCEP ein Computer-Benutzerzertifikat beziehen.WebHome]] | ||
| |
3.1 | 15 | |
| |
5.1 | 16 | == Manual certificate upload == |
| |
3.1 | 17 | |
| |
5.1 | 18 | Externally created certificates can also be installed manually on the client via **System** -> **Certificates**: |
| 19 | [[Rangee Thin Client Admin Guide 13.00 - Certificates>>doc:Handbuecher.Rangee Thin Client Admin Guide 13\.00.Kapitel 2 - Kommbox.2\.C System.2\.C\.E Zertifikate.WebHome]] | ||
| |
4.1 | 20 | |
| |
5.1 | 21 | = Network profiles = |
| |
3.1 | 22 | |
| |
5.1 | 23 | == Distribute profile within a TCMS group == |
| |
4.1 | 24 | |
| |
5.1 | 25 | A profile for an 802.1x connection created on a client can also be transferred to other devices via a TCMS configuration. The following options should be set accordingly in the LAN profile: |
| |
3.1 | 26 | |
| |
5.1 | 27 | * **Connection name:** Choose a meaningful name for the network profile, e.g. "**Authenticated**". |
| 28 | * **Preferred device:** Make sure that "*" is selected here in any case. Only then can the profile work on other devices. | ||
| 29 | * **Automatically connect with priority:** Assign a priority with which the client should connect to this network. The higher the value set here, the earlier this profile is used (empty = 0). | ||
| 30 | * **Distribute profile via TCMS:** With this option you enable distribution via TCMS group configuration. | ||
| |
3.1 | 31 | |
| |
5.1 | 32 | Afterwards, the configuration of this client must be dragged into the TCMS group. |
| |
3.1 | 33 | |
| |
5.1 | 34 | == Fallback profile == |
| |
3.1 | 35 | |
| |
5.1 | 36 | As a rule, it is desirable or, for the initial retrieval of a SCEP certificate, even mandatory that a client can also use a network connection without 802.1x enabled. This can be achieved via an additional network profile. |
| 37 | To do this, set up an additional profile with this data: | ||
| |
3.1 | 38 | |
| |
5.1 | 39 | * **Connection name:** Choose a meaningful name for the network profile, e.g. "**Unauthenticated**". |
| 40 | * **Preferred device:** Make sure that "*" is selected here in any case. Only then can the profile work on other devices. | ||
| 41 | * **Automatically connect with priority:** Assign a priority with which the client should connect to this network. **The higher** the value set here, **the earlier** this profile is used (empty = 0). | ||
| 42 | * **Distribute profile via TCMS:** With this option you enable distribution via TCMS group configuration. | ||
| 43 | If you set **Automatically connect with priority** lower than in the **Authenticated** profile, the **Unauthenticated** profile is only loaded if the connection to the 802.1x network has previously failed. With the default settings, it can take between 2 and 3 minutes after booting until an automatic fallback to the **Unauthenticated** profile is performed. You can shorten the time until the profile is loaded by additionally configuring these options in the **Authenticated** profile: | ||
| 44 | * **Number of authentication attempts:** Specify the number of attempts the client should make to authenticate. | ||
| 45 | * **Authentication timeout:** Define how long the client should wait in seconds until a new attempt is started. | ||
| |
3.1 | 46 | |
| |
5.1 | 47 | With a number of **2** and a timeout of **30**, it takes at most only 60 seconds until the fallback becomes active. Depending on the network environment and authentication speed, significantly lower values are also possible here. |