802.1X for printers, cameras and building controls, without a directory

What goes on these ports

Anything with a web interface and 802.1X settings. The most common kinds:

Printers and MFPs

Almost all support EAP-TLS. Many have a single certificate slot, shared with their own HTTPS page.

IP cameras and NVRs

The most common reason to lock a port, because a camera outside means a network point outside.

Door controllers and access panels

Unattended, on the wall, and often on the same switch as everything else.

BMS, HVAC and plant controllers

Long-lived hardware that often uses older TLS. A per-site setting allows for it.

IoT sensors and gateways

Anything with a web interface and 802.1X settings.

Devices with no 802.1X

Some devices, such as TVs, older sensors and some BMS equipment, have no 802.1X settings at all. Register their MAC addresses in Passbeam and choose a class for each. A registered device is only ever placed on that class’s isolated VLAN, and an unregistered MAC address is still refused.

A MAC address can be copied, so use a certificate wherever the device supports 802.1X. More on MAC authentication.

How a camera gets on

1. 1

   Add the client as Appliances only

   You choose this when you create the client. The checklist then has three steps (the certificate authority, the appliances and the network) with no directory or MDM.

2. 2

   Passbeam runs a certificate authority for that network

   One click. It belongs to this client alone and has its own audit trail. There is nothing to build, patch or back up.

3. 3

   Each device makes its own certificate request

   In the device's web interface, create a certificate request. The private key is created on the device and never leaves it, so there is no key file to lose. Paste the request into Passbeam and download the signed certificate. A fleet management tool can create the requests in bulk, which makes a forty-camera site an afternoon's work.

4. 4

   Install the certificate and the root

   Both go into the device's certificate settings: its own certificate, and this client's root certificate so it can trust the network in return. EAP-TLS checks both directions, and the root is the step people forget.

5. 5

   Point the switches at Passbeam

   Two addresses and one secret per site, generated for you. Use RADSec where the equipment supports it and standard RADIUS where it does not. The first device to authenticate confirms everything works end to end.

6. 6

   The port comes up for the camera, and for nothing else

   Every connection is checked against the certificate, its expiry date and the revocation list. A laptop plugged into that port has no certificate from this authority, so the switch treats it as a failure: a guest VLAN, or no access. The authentication log names each device, so you can see exactly which one stopped working.

Without a directory

For users, Passbeam revokes a certificate when the Entra account is disabled. A camera has no account, so when one is removed or replaced, revoke its certificate yourself. It is one click in the Appliances list.

Many printers and cameras have one certificate slot, shared between 802.1X and their own web page. There is a tick box on the form for that case. Some building controllers use older TLS than a modern RADIUS server accepts, so you can allow older TLS at one site without changing any other.

By default an appliance can connect at any of the client’s sites. You can limit it to particular sites, so a certificate issued for the depot does not open a port at head office.

If the building also has people in it

Add the client with Entra ID and Intune (or Entra ID with another MDM), and use the Appliances tab for the devices. The same certificate authority signs the laptops and the cameras, so there is one root to trust and one log to read. People’s certificates are still revoked when their accounts are disabled, and appliances are revoked by hand. Appliances only is for networks with no users on them. The knowledge base explains how to change a client from one to the other later.

What it costs

A camera counts as a device. Up to 10 devices is free, with no time limit: enough to test Passbeam on a small site. Above that, it is £1.75 per device, per month, with no server licence and nothing to buy up front. A device using MAC authentication is £0.75 a month.