Skip to content

Configuring TP-Link Omada SG2008P for Wired 802.1X with EasyRadius

This guide shows you how to protect the Ethernet ports of a TP-Link Omada SG2008P switch with 802.1X, using EasyRadius as the RADIUS server. Once it's set up, a device plugged into a protected port only gets network access after it authenticates with its certificate.

Prerequisites

Before you begin, make sure you have the following in place:

  • Access to the switch's web interface (its local IP address, e.g. 192.168.x.x)

Login page

Note: If the IP is not known, it can be found by using the "Omada Discovery Utility".

  • Access to the EasyRadius dashboard
  • A computer that already has an EasyScep certificate (for example through Intune)
  • An existing EasyRadius Client (for the shared secret)
  • The switch has a default gateway. The switch must be able to reach EasyRadius on the internet. Look in the switch's IP settings and make sure the default gateway points to your router.
  • You know your port layout. Write down which port goes to the router, which ports have access points, printers, or other devices without a certificate, and which port you manage the switch from. These ports must not have 802.1X enabled.

    Safety net: Changes on the switch take effect immediately but are only kept after a reboot once you click Save (top right). Don't save until everything works. If you lock yourself out, unplug the switch's power and plug it back in to return to the last saved configuration (see You've locked yourself out of the switch).

Step 1: Add EasyRadius as the RADIUS server

  1. In the switch's web interface, go to Security → AAA → RADIUS Config.

  2. Click Add in the top right. RADIUS Config page

    FieldValue
    Server IP<EasyRadius server IP> (from the EasyRadius dashboard)
    Shared Key<shared secret> (from the EasyRadius client)
    Authentication Port<port> (from the EasyRadius dashboard; it's not always 1812)
    Accounting PortLeave at the default 1813 (EasyRadius doesn't use accounting)
    Retransmit2
    Timeout5
    NAS IdentifierLeave empty

  3. Click Create. RADIUS Server form

Step 2: Check the Server Group and Method List

  1. Go to Security → AAA → Server Group and check that the server you just added appears in the radius group.

Server Group

  1. Go to the Dot1x method list (under AAA → Method Config or AAA → Dot1x Config, depending on firmware) and check that default points to radius.

Dot1x method list

Step 3: Turn on 802.1X globally

  1. Go to Security → 802.1x → Global Config.
  2. Set:
    SettingValue
    802.1XEnable
    Authentication MethodEAP
    HandshakeDisable
    AccountingDisable (if present)

  3. Click Apply. Global Config

    Important: Handshake must be off. Handshake is a TP-Link feature that only works with TP-Link's own 802.1X client. The built-in Windows client doesn't support it, so with Handshake on, the switch drops the computer and forces it to authenticate again about every minute (see Troubleshooting).

    At this point it's safe to click Save, because no ports are protected yet.

Step 4: Protect the computer's port

  1. Go to Security → 802.1x → Port Config.
  2. Tick only the port the computer with the certificate is connected to.
  3. Set Status to Enable. Leave the other columns at their defaults:
    ColumnValue
    StatusEnable
    MABDisable
    Guest VLAN0
    Port ControlAuto
    Port MethodMAC Based

  4. Click Apply. Port Config

    Warning: Never enable 802.1X on the router uplink, access point ports, printers, or the port you're managing the switch from. They'll be blocked immediately, and you may lose access to the switch. If that happens, see You've locked yourself out of the switch.

Step 5: Connect the computer

  • If the computer has a wired network profile from Intune: plug in the cable. The computer authenticates automatically with its certificate.
  • If there's no wired profile: set up 802.1X manually in Windows (see Manual setup in Windows under Troubleshooting).
  • If Windows asks for a username and password: don't type one. See Windows asks you to sign in.

    Note: A Wi-Fi profile from Intune does not cover Ethernet. A separate Wired network profile is needed (in Intune: Devices → Configuration → Create → Windows 10 and later → Templates → Wired network), using the same SCEP certificate and trusted root certificate as the Wi-Fi profile, with EAP type EAP-TLS.

Step 6: Verify and save

  1. Check the EasyRadius log. You should see an accepted login for the computer. EasyRadius log – accepted

    If nothing shows up, see Nothing appears in the EasyRadius log. If the log shows eap_peap or No NT-Password, see The EasyRadius log shows eap_peap.

  2. On the switch, go to Security → 802.1x → Authenticator State and check that the port is authorized. If the port isn't listed, see Nothing appears under Authenticator State.

  3. When everything works, click Save in the top right. To protect more ports, repeat Step 4 while managing the switch from a port that is not protected.

🎉 You're all set! Your device is now connected through the TpLink Omada SG2008P with EasyRadius authentication.

🛠️ Troubleshooting

Manual setup in Windows

Use this when the computer has no wired profile from Intune, or to test before the Intune profile arrives.

1. Start the Wired AutoConfig service

  1. Press Win + R, type services.msc, and press Enter.
  2. Find Wired AutoConfig, click Start, and set Startup type to Automatic.

2. Turn on 802.1X on the Ethernet adapter

  1. Open Control Panel → Network and Sharing Center → Change adapter settings.
  2. Right-click Ethernet → Properties and open the Authentication tab.
  3. Tick Enable IEEE 802.1X authentication.

  4. Under network authentication method, choose Microsoft: Smart Card or other certificate. Do not choose Protected EAP (PEAP). That uses a password, and EasyRadius only accepts certificates.

    5. Certificate settings

    1. Click Settings next to the authentication method.
    2. Choose Use a certificate on this computer.
    3. Under trusted root certificates, tick the same CA that your Wi-Fi uses to verify the EasyRadius server.
    4. Click OK.

    6. Authentication mode

    1. Click Additional settings.
    2. Tick Specify authentication mode.
    3. Choose Computer authentication if the EasyScep certificate is issued to the device (most common with Intune). Otherwise choose User or computer authentication.
    4. Click OK on all windows.

5. Reconnect

Unplug the cable, wait a few seconds, and plug it back in.

You can check the setup with:

netsh lan show profiles
netsh lan show interfaces

The EAP type in the profile should say Microsoft: Smart Card or other certificate.

Common problems

  • Windows asks you to sign in with a username and password: Windows has no profile that tells it to use the certificate. Don't type a password, because it will always be rejected. Follow Manual setup in Windows above, or check that the Intune wired profile has reached the computer.

  • The EasyRadius log shows eap_peap / mschap: FAILED: No NT-Password: The computer is using PEAP with a password instead of the certificate. Change the authentication method to Microsoft: Smart Card or other certificate (manually or in the Intune profile), then unplug and reconnect the cable.

  • The computer authenticates again about every minute: Handshake is on in 802.1x → Global Config. Set it to Disable and click Apply (see Step 3).

  • Nothing appears in the EasyRadius log: The switch isn't reaching EasyRadius. Check the switch's default gateway, the server IP, the authentication port, and the shared key (Step 1). Also check that EasyRadius accepts requests from your site's public IP.

  • Nothing appears under Authenticator State on the switch: The switch hasn't registered the computer on an 802.1X port. Check that 802.1X is enabled in Global Config (Step 3), that Status is Enable on the right port in Port Config (Step 4), that the cable is in that port, and that Wired AutoConfig is running on the computer (Manual setup in Windows).

  • Authentication succeeds but there's no network: 802.1X is working. Look at VLAN and DHCP settings instead.

  • You've locked yourself out of the switch: If you haven't clicked Save: unplug the switch's power, wait 10 seconds, and plug it back in. It starts up with the last saved configuration. If you have saved: hold the Reset button on the front for about 5–10 seconds while the switch is on. This restores factory settings, including the IP address and password, so you'll have to set the switch up again.