Chapter 5: Windows Recommendations And Best Practices; Security; Pki - Extreme Networks Summit WM Technical Reference Manual

5 Windows Recommendations and Best Practices
The following are recommendations and best practices for deploying an IEEE 802.11 WLAN in a large
enterprise.

Security

Microsoft recommends that you use one of the following combinations of security technologies (in order
of most to least secure):
WPA2 with EAP-TLS and both user and computer certificates - EAP-TLS is the strongest 802.1X
●
authentication method supported by Windows-based wireless clients. For the highest security,
configure your PKI to issue both user and computer certificates for wireless access.
WPA2 with PEAP-MS-CHAP v2 and require strong user passwords - If a PKI deployment is not
●
possible or desirable, you can use PEAP-MS-CHAP v2. PEAP-MS-CHAP v2 can be used to provide
strong password-based authentication of wireless clients, but only when used in conjunction with
the requirement of strong user password policies on your network.
WPA with EAP-TLS and both user and computer certificates - If your wireless equipment supports
●
WPA but not WPA2, use WPA with EAP-TLS.
WPA with PEAP-MS-CHAP v2 and require strong user passwords - If your wireless equipment
●
supports WPA but not WPA2 and you do not want to deploy a PKI, use WPA with PEAP-MS-CHAP
v2.
The following combinations of security technologies (in order of most to least secure) are discouraged
from use except if used temporarily when transitioning to a WPA2 or WPA-based security
configuration:
WEP with 802.1X authentication, EAP-TLS with both user and computer certificates, and periodic
●
reauthentication - If your wireless equipment does not support WPA2 or WPA, you can use WEP
with EAP-TLS-based 802.1X authentication and both user and computer certificates. To change the
per-client WEP encryption key for a wireless client session, force your wireless clients to periodically
reauthenticate by configuring your wireless APs or RADIUS-based authentication servers.
WEP with 802.1X authentication, PEAP-MS-CHAP v2, periodic reauthentication, and enforce
●
strong user passwords - If your wireless equipment does not support WPA2 or WPA and you are
not deploying a PKI, you can use the combination of WEP, 802.1X, and PEAP-MS-CHAP v2.
However, you must also require strong user passwords and force your wireless clients to
periodically reauthenticate.

PKI

For the certificates used for wireless access, use the following best practices:
To install computer certificates, use auto-enrollment - This requires the use of a Windows 2000 or
●
Windows Server 2003 Certificate Services server as an enterprise CA at the issuer CA level.
Summit WM Technical Reference Guide, Software Version 5.1
59