Requirements & Dependencies

EntryPoint RADIUSaaS provides a cloud-based authentication service designed to enhance network security using 802.1X authentication methods, such as EAP-TLS and EAP-PEAP. To ensure seamless deployment and operation, the following system requirements and dependencies must be met.

#

Entra ID Integration Requirements #

To integrate EntryPoint RADIUSaaS with Microsoft Entra ID (formerly Azure AD) as the backend identity provider, the following requirements must be met:

An Application Registration in Microsoft Entra ID is Required: #

• A new App Registration must be created in Microsoft Entra ID (Azure AD).

• The following details must be provided in the EntryPoint portal:

  • Directory (Tenant) ID

  • Application (Client) ID

  • Client Secret (generated during app registration)

Required API Permissions in Microsoft Entra ID: #

• The registered application must have the following API permissions granted:

  • Group.Read.All → To retrieve user group memberships.

  • User.Read.All → To access user identity information.

• Admin Consent must be granted for these permissions.

Device Compliance Check (Optional but Recommended): #

• If device compliance enforcement is required, Microsoft Intune must be used to enforce compliance before granting access.

• Devices must meet security requirements before they are authenticated via EntryPoint.

CA Certificate Requirements EAP-TLS #

For EAP-TLS (certificate-based authentication), the following certificate requirements must be met:

A Public Key Infrastructure (PKI) or Certificates from a CA Are Required: #

• Customers must issue certificates from either:

  • An internal Microsoft PKI (Active Directory Certificate Services)

  • An external CA (e.g., DigiCert, Sectigo, GoDaddy)

• All certificates must comply with 802.1X authentication standards.

Trusted Certificate Authorities (CAs) Must Be Uploaded to EntryPoint: #

• The following CA certificates must be uploaded to the EntryPoint portal under EAP-TLS settings:

  • Root CA Certificate

  • Issuing CA Certificate

• The certificate chain must be valid and trusted across all devices.

• ✅ All uploaded certificates must be in PEM format (.pem, Base64 encoded).

A Certificate Revocation List (CRL) URL Must Be Provided: #

• A CRL URL must be specified to verify the validity of client certificates.

• Example format: http://primary-cdn.pki.azure.net/.../current.crl

• Client devices and RADIUS servers must have access to this CRL endpoint.

Client Certificates Must Be Deployed to User Devices: #

• Certificates must be distributed using Microsoft Intune, Group Policy, or an MDM solution to all managed devices.

• Client devices must match the authentication policies configured in EntryPoint.

RADIUS Server Certificate Requirements EAP-TLS & EAP-PEAP #

The RADIUS Server Certificate is essential for encrypting communication between clients and the RADIUS server. Customers must choose one of the following options:

Option 1: Bring Your Own Certificate (BYOC) #

A RADIUS Server Certificate Must Be Uploaded to EntryPoint: #

• Customers must provide a certificate issued by:

  • A public CA (e.g., GoDaddy, DigiCert, Sectigo)

  • A private/internal CA (e.g., an organization’s PKI)

The Certificate Must Meet the Following Format Requirements: #

• ✅ All RADIUS Server certificates must be in PEM format (.pem, Base64 encoded).

• The certificate chain (Root CA, Issuing CA, and Server Certificate) must be included in the uploaded file.

Client Devices Must Trust the Uploaded Certificate: #

• The Root CA and Issuing CA must be trusted by all client devices.

• Organizations must distribute these certificates using Microsoft Intune, Group Policy, or manual provisioning.

Option 2: Use the Built-in RADIUS Certificate (Optional) #

Customers May Use the Built-in RADIUS Server Certificate Provided by EntryPoint: #

• This eliminates the need to upload a custom certificate.

• The built-in certificate is automatically managed by EntryPoint.

• Client devices must trust the EntryPoint RADIUS server for authentication to work.

TLS 1.2 Is Required for Secure Communication: #

• ✅ Only TLS 1.2 is supported for RADIUS authentication.

• Older TLS versions (TLS 1.1, TLS 1.0) are not supported due to security risks.

• TLS 1.3 is not supported.

RadSec (RADIUS over TLS) Requirements #

For secure RADIUS communication over RadSec, the following requirements must be met:

RadSec Must Be Enabled in the EntryPoint Portal: #

• The RadSec option must be turned on under RADIUS Server Settings.

A Valid RadSec Server Certificate Must Be Provided: #

• Customers must upload a valid server certificate from a trusted CA (e.g., Cisco Meraki).

RadSec Certificates Must Be in PEM Format: #

• ✅ All RadSec certificates must be in PEM format (.pem, Base64 encoded).

RadSec Must Be Supported on Network Devices: #

• Wi-Fi Access Points (APs) and switches must support RadSec.

• APs must be configured to use EntryPoint as the RadSec RADIUS server.

• The trusted RadSec certificate must be uploaded to the network controller/dashboard (e.g., Cisco Meraki Dashboard).

Network Access Requirements #

For EntryPoint RADIUSaaS to function, customers must ensure network access is open for RADIUS traffic and, if applicable, RadSec (RADIUS over TLS).

Required Standard RADIUS Ports (UDP)

Optional RadSec Ports (TCP) for Encrypted RADIUS Traffic

Firewall Rules Must Allow EntryPoint Servers

• Network firewalls must allow traffic on the required ports.

• APs, switches, and other RADIUS clients must be able to reach EntryPoint RADIUS servers

Summary of Customer Responsibilities #