Skip to Content
Last modified by Tobias Wintrich on 2026/08/07 12:09
Show last authors
1 With RangeeOS, you can easily establish a connection to an 802.1x-secured network. The general setup of the 802.1x connection is described in our manual under [[LAN Profile>>doc:Handbuecher.Rangee Thin Client Admin Guide 13\.00.Kapitel 2 - Kommbox.2\.F Anschlüsse.2\.F\.B Netzwerk.2\.F\.B\.A Profil LAN.WebHome]] and [[WLAN Profile>>doc:Handbuecher.Rangee Thin Client Admin Guide 13\.00.Kapitel 2 - Kommbox.2\.F Anschlüsse.2\.F\.B Netzwerk.2\.F\.B\.D WLAN-Profil.WebHome]]. This article explains additional options and possibilities for practical setup.
2
3 {{toc/}}
4
5 [[image:1786095913113-409.png||height="445" width="800"]]
6
7 = Certificates =
8
9 An 802.1x connection is usually secured by a certificate. These certificates can be transferred to the device with RangeeOS in different ways.
10
11 == Automatically via SCEP ==
12
13 Instructions for automatic retrieval via SCEP (Simple Certificate Enrollment Protocol) can be found in our KnowledgeBase in the following HowTo:
14 [[RangeeOS - Obtaining a computer user certificate with SCEP>>doc:HowTos.RangeeOS - Mit SCEP ein Computer-Benutzerzertifikat beziehen.WebHome]]
15
16 == Manual certificate upload ==
17
18 Externally created certificates can also be installed manually on the client via **System** -> **Certificates**:
19 [[Rangee Thin Client Admin Guide 13.00 - Certificates>>doc:Handbuecher.Rangee Thin Client Admin Guide 13\.00.Kapitel 2 - Kommbox.2\.C System.2\.C\.E Zertifikate.WebHome]]
20
21 = Network profiles =
22
23 == Distribute profile within a TCMS group ==
24
25 A profile for an 802.1x connection created on a client can also be transferred to other devices via a TCMS configuration. The following options should be set accordingly in the LAN profile:
26
27 * **Connection name:** Choose a meaningful name for the network profile, e.g. "**Authenticated**".
28 * **Preferred device:** Make sure that "*" is selected here in any case. Only then can the profile work on other devices.
29 * **Automatically connect with priority:** Assign a priority with which the client should connect to this network. The higher the value set here, the earlier this profile is used (empty = 0).
30 * **Distribute profile via TCMS:** With this option you enable distribution via TCMS group configuration.
31
32 Afterwards, the configuration of this client must be dragged into the TCMS group.
33
34 == Fallback profile ==
35
36 As a rule, it is desirable or, for the initial retrieval of a SCEP certificate, even mandatory that a client can also use a network connection without 802.1x enabled. This can be achieved via an additional network profile.
37 To do this, set up an additional profile with this data:
38
39 * **Connection name:** Choose a meaningful name for the network profile, e.g. "**Unauthenticated**".
40 * **Preferred device:** Make sure that "*" is selected here in any case. Only then can the profile work on other devices.
41 * **Automatically connect with priority:** Assign a priority with which the client should connect to this network. **The higher** the value set here, **the earlier** this profile is used (empty = 0).
42 * **Distribute profile via TCMS:** With this option you enable distribution via TCMS group configuration.
43 If you set **Automatically connect with priority** lower than in the **Authenticated** profile, the **Unauthenticated** profile is only loaded if the connection to the 802.1x network has previously failed. With the default settings, it can take between 2 and 3 minutes after booting until an automatic fallback to the **Unauthenticated** profile is performed. You can shorten the time until the profile is loaded by additionally configuring these options in the **Authenticated** profile:
44 * **Number of authentication attempts:** Specify the number of attempts the client should make to authenticate.
45 * **Authentication timeout:** Define how long the client should wait in seconds until a new attempt is started.
46
47 With a number of **2** and a timeout of **30**, it takes at most only 60 seconds until the fallback becomes active. Depending on the network environment and authentication speed, significantly lower values are also possible here.