Authenticated Key Management - Cisco DX650 Administration Manual

Security for Voice Communications in WLANs
The following figure shows an example of EAP-TLS, PEAP-GTC and PEAP-MSCHAPV2 setup in System
Configuration > lobal Authentication Setup.
Figure 11: EAP-TLS, PEAP-GTC and PEAP-MSCHAPV2 Setup

Authenticated Key Management

The following authentication schemes use the RADIUS server to manage authentication keys:
• WPA/WPA2: Uses RADIUS server information to generate unique keys for authentication. Because
these keys are generated at the centralized RADIUS server, WPA/WPA2 provides more security than
WPA pre-shared keys that are stored on the AP and phone.
• Cisco Centralized Key Management (CCKM): Uses RADIUS server and a wireless domain server
(WDS) information to manage and authenticate keys. The WDS creates a cache of security credentials
for CCKM-enabled client devices for fast and secure reauthentication.
With WPA/WPA2 and CCKM, encryption keys are not entered on the phone, but are automatically derived
between the AP and phone. But the EAP username and password that are used for authentication must be
entered on each phone.
Cisco Desktop Collaboration Experience DX650 Administration Guide, Release 10.1(1)
90