Ieee 802.1X Extensible Authentication Protocol Types - Nortel 2300 Series Configuration Manual

IEEE 802.1X Extensible Authentication Protocol Types

Extensible Authentication Protocol (EAP) is a generic point-to-point protocol that supports multiple authenti-
cation mechanisms. EAP has been adopted as a standard by the Institute of Electrical and Electronic Engineers
(IEEE). IEEE 802.1X is an encapsulated form for carrying authentication messages in a standard message
exchange between a user (client) and an authenticator.
Table 28 on page 415 summarizes the EAP protocols (also called types or methods) supported by WSS
Software.
Table 28: EAP Authentication Protocols for Local Processing
EAP Type
EAP-MD5
(EAP with Message
Digest Algorithm 5)
EAP-TLS
(EAP with Transport
Layer Security)
PEAP-MS-
CHAP-V2
(Protected EAP with
Microsoft Challenge
Handshake
Authentication
Protocol version 2)
1. EAP-MD5 does not work with Microsoft wired authentication clients.
Description
Authentication algorithm
that uses a
challenge-response
mechanism to compare
hashes
Protocol that provides
mutual authentication,
integrity-protected
encryption algorithm
negotiation, and key
exchange. EAP-TLS
provides encryption and data
integrity checking for the
connection.
The wireless client
authenticates the server
(either the WSS switch or a
RADIUS server) using TLS
to set up an encrypted
session. Mutual
authentication is performed
by MS-CHAP-V2.
Nortel WLAN Security Switch 2300 Series Configuration Guide
Configuring AAA for Network Users 415
Use
Wired authentication only1
Wireless and wired
authentication.
All authentication is
processed on the WSS
switch.
Wireless and wired
authentication:
• The PEAP portion is
processed on the WSS
switch.
• The MS-CHAP-V2
portion is processed on
the RADIUS server or
locally, depending on the
configuration.
Considerations
This protocol
provides no
encryption or key
establishment.
This protocol
requires X.509
public key
certificates on both
sides of the
connection.
Only the server side
of the connection
requires a certificate.
The client needs
only a username and
password.