Eap.conf File - Extreme Networks Summit WM Technical Reference Manual

The only difference with overwrite is that the password does not have to be the MAC address of the
device, but rather it can be anything the administrator configures (and matches on the Summit WM
Controller).
To use the Challenge Handshake Access Protocol (CHAP) which prevents the password from ever being
transmitted between the Summit WM Controller and the RADIUS server switch the Auth-Type setting
to CHAP and change the Auth. Type in the WM-AD settings under the Auth & Acct tab to use CHAP.
#vocera badge example
"0009EF003BAF" Auth-Type := CHAP, User-Password == "0009EF003BAF"
You may also switch to MS-CHAP or MS-CHAPv2 in the Summit WM Controller and then format the
user entry as follows:
#vocera badge example
"0009EF003BAF" Auth-Type := MS-CHAP, User-Password == "0009EF003BAF"
This type of entry supports both MS-CHAP and MS-CHAPv2 authentication types from the Summit
WM Controller.
Note that RADIUS attributes cannot be returned for MAC-based authentication.
Example for 802.1X Authentication
To define a user for PEAP or TTLS authentication where a username/password combination is still
required the user can be formatted as:
"username" Auth-Type := EAP, User-Password == "aDRM123"
However, this will make this user ONLY useful for EAP connections. Otherwise format the user as
Auth-Type 'local' and FreeRADIUS will use the user entry for PAP, CHAP, and EAP auth-type
messages.

eap.conf file

For recent versions of FreeRADIUS the configuration of EAP has been moved from the radiusd.conf file
into a separate file called eap.conf. If you don't have this file look for these configuration items within
the radiusd.conf file itself.
The configuration of EAP support under FreeRADIUS involves the following steps:
1 Generate / Install Certificates
2 Configure eap.conf file
Generate / Install Certificates
In the scripts subdirectory of the FreeRADIUS distribution tarball there is are scripts for creating root,
server, and client certificates. It is recommended to get a certificate generated off of a real CA rather
than one generated by these utilities since the default action of most wireless clients is to check the
certificate being used on the server side against a list of known CAs. Windows' wireless configuration
can relax this requirement by deselecting the checkbox for 'Validate server certificate.
For PEAP and TTLS only a server certificate needs to be installed. For TLS both a server certificate and
a client certificate generated off the same root certificate needs to be installed.
125
Summit WM Technical Reference Guide, Software Version 5.1