802.1X - Radius Assigned VLAN - Anybus Defender + N-Tron 5000

APPLICABLE PRODUCTS 

Anybus Defender series 4000, 6000

PRE-REQUISITES

A switch capable of 802.1x authentication and has RADIUS capability.

RADIUS Configuration

Download FreeRADIUS. System -> Package Manager -> Available Packages and search for “freeradius” and download it.

Once installed go to Status -> Services and make sure radiusd has a green checkmark otherwise press the Start Service button, if it won’t start you will need to download the configuration file for the Defender under System -> Backup & Restore and “Download configuration as XML”, open it with notepad and search for <starts_on_sync/> and remove it, then upload the configuration file at Restore Backup, choose the file and then press the “Restore Configuration” button, the Defender will restart under the process.

Services -> FreeRADIUS -> NAS/Clients, here we will add the switch.

Client IP Address: IP of the switch, in this case 192.168.200.201
Client Shortname: To make it easier to identify
Client Shared Secret: This will be used to connect to the RADIUS server.
Client Protocol: UDP

And save.

Under Services -> FreeRADIUS ->Users we will add the MAC addresses of the clients here. Press Add and you will see this screen:

In Username write the MAC address of the client in this way “b4-1a-62-11-bf-1b” then in Password write the same as in Username, Password Encryption should be Cleartext-Password.

Further down you will find VLAN Configuration:

Here write the VLAN ID the client should have and then save at the bottom.

Now you will need to create the VLANs, go to Interfaces -> Assignments -> VLANs and press Add. Parent Interface should be where the clients will connect and VLAN Tag should be the number you want the VLAN to have. Save.

Go to Interfaces -> Assignments and at Available network ports you can choose ex. “VLAN 10 on igb1 – lan”, press Add and you will create an interface for the VLAN.

Press the name of the new Interface and this will show:

Enable the Interface, change the Description to VLAN10 for example, change IPv4 Configuration Type from None to Static IPv4 and give it an IP.

Firewall -> Rules -> VLAN10 (or the name you used) and create the rules you want to have.

N-Tron Switch

To make Radius work with the switch first you need to enable 802.1x ports and make the VLANs on the switch.

Go to Redundancy -> CIST ports and disable CIST on the ports you plan to use for Radius.

Then go to Security -> 802.1x Ports -> Config and toggle Enabled.

Make sure Re-authentication and RADIUS-Assigned VLAN are Enabled.

Then go to Ports and on the ports you plan to use Radius with change the Admin State from Force Authorized to Port-Based 802.1x and toggle VLAN under Radius-Assigned.

Then press RADIUS at the top, go to Servers and the big + (called Add new RADIUS server) in the upper right.

Host: IP of the interface connected to the switch.
Auth Port: 1812
Acct Port: 1813
Secret Key: What you wrote in Client Shared Secret above

Then go to Ports and VLANs -> VLANs and press the big + (called Add a new VLAN Group when hovered over) in the upper right.

Give it the same ID as the ones you created on the Defender.

Make sure that the port connected to the Defender is Tagged (filled in) and that the ports you plan to use are considered Untagged (Thick border)

Install FreeRADIUS certificate on Windows or Kali.

Note: While this guide is for Kali it should be very similar for other Linux OS.

Step 1 — Place the CA Certificate

1. Open a terminal and create a folder for RADIUS certificates:

sudo mkdir -p /etc/ssl/radius

1. Copy your CA certificate into it:

sudo cp Freeradius+CA.crt /etc/ssl/radius/
sudo chmod 644 /etc/ssl/radius/Freeradius+CA.crt

This ensures NetworkManager can access the certificate.

Step 2 — Open Advanced Network Configuration

1. Open the Application/Apps menu and search for “Advanced Network Configuration”.
2. In the window, you’ll see a list of network connections (Ethernet, Wi-Fi, etc.).

Step 3 — Edit or Create a Wired Connection

1. Select your Ethernet interface (e.g., eth0 or Wired connection 1)
2. Click Edit or + to create a new connection
3. Go to the Security / 802.1X tab

Step 4 — Configure 802.1X Authentication

1. Check Use 802.1X for this connection
2. Set Authentication method:
3. PEAP
4. CA Certificate:
5. Click Browse → select /etc/ssl/radius/Freeradius+CA.crt
6. Select MSCHAPv2
7. Enter your username
8. Enter your password

Step 5 — Configure IP Settings (Optional)

1. Go to the IPv4 Settings tab
2. Choose:
3. Automatic (DHCP) → if DHCP server is available
4. Manual → to enter a static IP
5. Apply changes.

Step 6 — Activate the Connection

1. Click Save
2. Disconnect/reconnect the Ethernet cable or toggle the interface
3. Open a terminal and monitor logs:

journalctl -f

Look for (It may look different):

EAP: Starting PEAP authentication
EAP-MSCHAPV2: Authentication succeeded
CTRL-EVENT-EAP-SUCCESS

This confirms the device authenticated successfully.

Windows 10 / 11

We’ll install the CA certificate so Windows trusts FreeRADIUS and configure wired 802.1X.

Step 1 — Install the CA Certificate

1. Press Win + R, type mmc → Enter
2. File → Add/Remove Snap-in → Certificates → Add → Computer account → Next → Finish
3. Navigate to: Trusted Root Certification Authorities → Certificates
4. Right-click → All Tasks → Import → select Freeradius+CA.crt → Next → Finish

Windows will now trust the FreeRADIUS server certificate.

Step 2 — Configure Wired 802.1X

1. Open Control Panel → Network and Sharing Center → Change adapter settings
2. Right-click Ethernet → Properties → Authentication tab
3. Check Enable IEEE 802.1X authentication
4. Set Network Authentication Method:
5. PEAP → “Microsoft: Protected EAP (PEAP)”
6. Click Settings → Validate server certificate → Check the box
7. Select your CA certificate from the list (Freeradius+CA)
8. Phase 2 authentication: Secured password (EAP-MSCHAPv2)
9. Click OK and apply.
   • You should be asked for Username and Password, if not remove and then reinsert the Ethernet cable.

Step 3 — Test Connection

• Plug Ethernet → Windows should authenticate with FreeRADIUS
• Check connection status:

Command Prompt → ipconfig → You should see an IP address of the chosen VLAN

© HMS Networks AB 2026