Scalability; Using Computer-Only Authentication - Extreme Networks Summit WM Technical Reference Manual

Windows Recommendations and Best Practices
account database (such as different Active Directory forests). RADIUS messages are forwarded to a
member of the corresponding remote RADIUS server group matching the connection request policy.
Investigate whether the wireless APs need RADIUS vendor-specific attributes (VSAs) and configure
●
them during the configuration of the remote access policy on the Advanced tab of the remote access
policy profile.

Scalability

When designing for scalability, use the following best practice:
For a large amount of authentication traffic within an Active Directory forest, use a layer of RADIUS
●
proxies running Windows Server 2003 IAS between the wireless APs and the RADIUS servers.
By default, an IAS RADIUS proxy balances the load of RADIUS traffic across all the members of a
●
remote RADIUS server group on a per authentication basis and uses failover and failback
mechanisms. Members of a remote RADIUS server group can also be individually configured with
priority and weight settings so that the IAS proxy favors specific RADIUS servers.

Using Computer-only Authentication

Some network administrators want to use only computer authentication. By using only computer
authentication, a wireless client computer must perform computer-level 802.1X authentication with a
wireless AP using either a computer certificate (when using EAP-TLS authentication) or the computer's
account name and password (when using PEAP-MS-CHAP v2 authentication) before it can access the
organization network. With computer-only authentication, only valid computers can connect to the
wireless network. Computers that do not have a computer account in the organization's domain cannot
connect. This prevents users from bringing computers from home and connecting to the organization's
wireless LAN. Home computers represent a threat to the organization network because they are not
managed in the same way as member computers and can introduce viruses or other malicious programs
into the organization network.
For more information about computer authentication and user authentication, see "Windows XP
Wireless Deployment Technology and Component Overview" at
prodtechnol/winxppro/maintain/wificomp.mspx
You can configure computer-only authentication using the Wireless Network (IEEE 802.11) Policies
Group Policy extension or through the registry.
62
.
Summit WM Technical Reference Guide, Software Version 5.1
http://www.microsoft.com/technet/