AMX MVP-9000i-GB Instruction Manual page 67

TTLS (EAP Tunneled Transport Layer Security) is an authentication method that does not use a client certificate to authenticate the
panel. However. this method is more secure than PEAP because it does not broadcast the identity of the user. Setup is similar to
PEAP, but differs in the following areas:
An anonymous identity must be specified until the secure tunnel between the panel and the Radius server is setup to

transfer the real identity of the user.
There is no end-user ability to select from the different types of PEAP.

Additional Inner Authentication choices are available to the end-user.

EAP-TTLS security is designed for wireless environments where the Radius server needs to validate directly the identity of the client
(panel) before allowing it access to the network. This validation is done by tunneling a connection through the AP and directly
between the panel and the Radius server. Once the client is identified and then validated, the Radius server disconnects the tunnel
and allows the panel to access the network directly via the target AP.
EAP-TTLS
SSID
(Service Set Identifier):
Identity:
Anonymous Identity:
Password:
Certificate Authority:
Inner Authentication
Type:
Key Mgmt:
Cancel/Save:
Refer to the EAP Authentication section on page 146 and the Using the Wireless Site Survey Tool section on page 34 for further
details on these security options.
MVP-9000i - Instruction Manual
Opens an on-screen keyboard to enter the SSID name used on the target AP.
The SSID is a unique name used by the AP, and is assigned to all panels on that network. An SSID is required by
the AP before the panel is permitted to join the network.
• The SSID is case sensitive and must not exceed 32 characters.
• Make sure this setting is the same for all points in the wireless network.
• With EAP security, the SSID of the AP must be entered. If it is left blank, the panel will try to connect to the first
access point detected that supports EAP. However, a successful connection is not guaranteed because the
detected AP may be connected to a RADIUS server, which may not support this EAP type and/or have the
proper user identities configured.
Opens an on-screen keyboard. Enter an EAP Identity string (used by the panel to identify itself to an
Authentication (RADIUS) Server).
Note: This information is similar to a username used to login to a secured server or workstation. This works in
tandem with the Password string which is similar to the password entered to gain access to a secured workstation.
Typically, this is in the form of a username such as: jdoe@amx.com.
Opens an on-screen keyboard. Enter an IT provided alpha-numeric string which (similar to the username) used
as the identity, but that does not represent a real user.
This information is used as a fictitious name which might be seen by sniffer programs during the initial
connection and setup process between the panel and the Radius server. In this way the real identity (username)
is protected. Typically, this is in the form of a fictitious username such as: anonymous@amx.com
Opens an on-screen keyboard. Enter the network password string specified for the user entered within the
Identity field (used by the panel to identify itself to an Authentication (RADIUS) Server)
Note: This information is similar to the password entered to gain access to a secured workstation.
When pressed, the panel displays an on-screen Certificate Authority (CA) File Location keyboard which allows
you to enter the name of the certificate authority file which is used to validate the server certificate. This field is
optional.
If a server certificate is used, it should first be downloaded into the panel and the Certif icate Authority field
should then be set to the name of that certificate file. No file path should be used for this setting as all
certificates are stored in a specific directory that the user cannot control or change.
Use the on-screen keyboard's Clear button to completely erase any previously stored network path information.
When pressed, this field cycles through the choices of available Inner Authentication mechanism supported by
the Devicescape Secure Wireless Client:
• EAP-MSCHAPv2
• EAP-GTC
• EAP-OTP
• EAP-MD5
• MSCHAPv2
• MSCHAP
• PAP
• CHAP
This button has 4 options:
• WPA-EAP: The default and most common setting for EAP authentication methods. Accepts WPA, WPA2 & TKIP,
or AES.
• 8021X: Used to specify IEEE 802.1x port authentication only.
• CCKM-WPA: Cisco key management option. Used with CCKM and WPA (TKIP encryption only) authentication.
• CCKM-WPA2: Cisco key management option. Used with CCKM and WPA2 (AES encryption only)
authentication.
Note: The Key Mgmt selection must match the security settings on the AP in order for the connection to be
successful.
• Cancel - discard changes and return to the previous page.
• Save - store the new security information, apply changes, and return to the previous page.
Protected Setup Pages
69