Understanding 802.1X Authentication

For the managed device to communicate with the authentication server, you must configure the IP address, authentication port, and accounting port of the server on the managed device. The authentication server must be configured with the IP address of the RADIUSRemote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. client, which is the managed device in this case. Both the managed device and the authentication server must be configured to use the same shared secret.

Additional information on EAP types supported in a Windows environment, Microsoft supplicants, and authentication servers, is available at http:// technet.microsoft.com/en-us/library/cc782851(WS.10).aspx.

The client communicates with the managed device through a GREGeneric Routing Encapsulation. GRE is an IP encapsulation protocol that is used to transport packets over a network. tunnel to form an association with an AP and to get authenticated in the network. Therefore, the network authentication and encryption configured for an ESSIDExtended Service Set Identifier. ESSID refers to the ID used for identifying an extended service set. must be the same on both the client and the managed device.

Configuring Authentication Terminated on a Managed Device

User authentication is performed either via the managed device’s internal database or a non-802.1X802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority. server. See 802.1X Authentication Profile WebUI Parameters for an overview of the parameters that you need to configure on 802.1X802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority. authentication components when 802.1X802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority. authentication is terminated on the managed device (AAAAuthentication, Authorization, and Accounting. AAA is a security framework to authenticate users, authorize the type of access based on user credentials, and record authentication events and information about the network access and network resource consumption. FastConnect).

Figure 2 802.1X Authentication with Termination on Managed device

In this scenario, the supplicant is configured for EAP-TLSEAP–Transport Layer Security. EAP-TLS is a certificate-based authentication method supporting mutual authentication, integrity-protected ciphersuite negotiation and key exchange between two endpoints. See RFC 5216. or EAP-PEAPEAP–Protected EAP. A widely used protocol for securely transporting authentication data across a network (tunneled)..

EAP-TLSEAP–Transport Layer Security. EAP-TLS is a certificate-based authentication method supporting mutual authentication, integrity-protected ciphersuite negotiation and key exchange between two endpoints. See RFC 5216. is used with smart card user authentication. A smart card holds a digital certificateA digital certificate is an electronic document that uses a digital signature to bind a public key with an identity—information such as the name of a person or an organization, address, and so forth. which, with the user-entered PINPersonal Identification Number. PIN is a numeric password used to authenticate a user to a system., allows the user to be authenticated on the network. EAP-TLSEAP–Transport Layer Security. EAP-TLS is a certificate-based authentication method supporting mutual authentication, integrity-protected ciphersuite negotiation and key exchange between two endpoints. See RFC 5216. relies on digital certificatesA digital certificate is an electronic document that uses a digital signature to bind a public key with an identity—information such as the name of a person or an organization, address, and so forth. to verify the identities of both the client and the server.

EAP-TLSEAP–Transport Layer Security. EAP-TLS is a certificate-based authentication method supporting mutual authentication, integrity-protected ciphersuite negotiation and key exchange between two endpoints. See RFC 5216. requires that you import server and CACertificate Authority or Certification Authority. Entity in a public key infrastructure system that issues certificates to clients. A certificate signing request received by the CA is converted into a certificate when the CA adds a signature generated with a private key. See digital certificate. certificates onto the managed device (see Configuring 802.1X Authentication). The client certificate is verified on the managed device (the client certificate must be signed by a known CACertificate Authority or Certification Authority. Entity in a public key infrastructure system that issues certificates to clients. A certificate signing request received by the CA is converted into a certificate when the CA adds a signature generated with a private key. See digital certificate.) before the username is checked on the authentication server.

EAP-PEAPEAP–Protected EAP. A widely used protocol for securely transporting authentication data across a network (tunneled). uses TLSTransport Layer Security. TLS is a cryptographic protocol that provides communication security over the Internet. TLS encrypts the segments of network connections above the Transport Layer by using asymmetric cryptography for key exchange, symmetric encryption for privacy, and message authentication codes for message integrity. to create an encrypted tunnel. Within the tunnel, one of the following “inner EAPExtensible Authentication Protocol. An authentication protocol for wireless networks that extends the methods used by the PPP, a protocol often used when connecting a computer to the Internet. EAP can support multiple authentication mechanisms, such as token cards, smart cards, certificates, one-time passwords, and public key encryption authentication. ” methods is used:

EAP-GTCEAP – Generic Token Card. (non-tunneled).: Described in RFCRequest For Comments. RFC is a commonly used format for the Internet standards documentss. 2284, this EAPExtensible Authentication Protocol. An authentication protocol for wireless networks that extends the methods used by the PPP, a protocol often used when connecting a computer to the Internet. EAP can support multiple authentication mechanisms, such as token cards, smart cards, certificates, one-time passwords, and public key encryption authentication. method permits the transfer of unencrypted usernames and passwords from client to server. The main uses for EAP-GTCEAP – Generic Token Card. (non-tunneled). are one-time token cards such as SecureID and the use of an LDAPLightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. or RADIUSRemote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. server as the user authentication server. You can also enable caching of user credentials on the managed device as a backup to an external authentication server.

EAPExtensible Authentication Protocol. An authentication protocol for wireless networks that extends the methods used by the PPP, a protocol often used when connecting a computer to the Internet. EAP can support multiple authentication mechanisms, such as token cards, smart cards, certificates, one-time passwords, and public key encryption authentication. -Microsoft MS-CHAPv2Microsoft Challenge Handshake Authentication Protocol version 2. MS-CHAPv2 is an enhanced version of the MS-CHAP protocol that supports mutual authentication.: Described in RFCRequest For Comments. RFC is a commonly used format for the Internet standards documentss. 2759, this EAPExtensible Authentication Protocol. An authentication protocol for wireless networks that extends the methods used by the PPP, a protocol often used when connecting a computer to the Internet. EAP can support multiple authentication mechanisms, such as token cards, smart cards, certificates, one-time passwords, and public key encryption authentication. method is widely supported by Microsoft clients. A RADIUSRemote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. server must be used as the backend authentication server.

If you use the internal database of the managed device for user authentication, you need to add the names and passwords of the users to be authenticated. If you use an LDAPLightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. server for user authentication, you need to configure both the LDAPLightweight Directory Access Protocol. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. server and the user IDs and passwords on the managed device. If you use a RADIUSRemote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. server for user authentication, you need to configure the RADIUSRemote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. server on the managed device.