Peap Setup - Cisco 7925G Administration Manual

Cisco Unified Wireless IP Phone 7925G, 7925G-EX, and 7926G Web Pages
Step 2 On the System Configuration page, in the EAP-TLS section, enable these fields:
• Allow EAP-TLS
• Certificate CN comparison
Step 3
On the ACS Certification Authority Setup page, add the Manufacturing Root Certificate and Manufacturing
CA Certificate to the ACS server.
Step 4 Enable both the Manufacturing Root Certificate and Manufacturing CA Certificate in the ACS Certificate
Trust List.

PEAP Setup

Protected Extensible Authentication Protocol (PEAP) uses server-side public key certificates to authenticate
clients by creating an encrypted SSL/TLS tunnel between the client and the authentication server.
Note Server validation can be enabled by importing the authentication server certificate.
Before You Begin
Before you configure PEAP authentication for the phone, make sure these Cisco Secure ACS requirements
are met:
• The ACS root certificate must be installed.
• The Allow EAP-MSCHAPv2 setting must be enabled.
• User account and password must be configured.
• For password authentication, you can use the local ACS database or an external one (such as Windows
or LDAP).
Enable PEAP Authentication
With Firmware Release 1.4(7), the Cisco Unified Wireless IP Phone sends a download request to the TFTP
server for the server certificate (WLANRootCA.cer) so the server certificate can be installed automatically.
The server certificate must have a SHA-1 signature and DER encoding. Any preexisting server certificates
are removed automatically. The phone restarts after the certificate is installed. After the certificate is installed,
Server Validation is enabled automatically and cannot be configured when the phone is set to use PEAP
authentication.
Procedure
Step 1 From the phone configuration web page, choose PEAP as the authentication mode.
Step 2
Enter a user name and password.
Cisco Unified Wireless IP Phone 7925G, 7925G-EX, and 7926G Administration Guide
Wireless Security Credentials
91