Eap Communication Overview - AMX NXD-1000Vi Operation/Reference Manual

EAP Communication Overview

EAP Authentication goes a step beyond just encrypting data transfers, but also requires that a set of credentials
be validated before the client (panel) is allowed to connect to the rest of the network (FIG. 105).
It is important to note that there is no user intervention necessary during this process. It proceeds automatically
based on the configuration parameters entered into the panel.
Client - Panel
(supplicant)
FIG. 105 EAP security method in process
1.
The client (panel) establishes a wireless connection with the WAP specified by the SSID.
2.
The WAP opens up a tunnel between itself and the RADIUS server configured via the access point.
This tunnel means that packets can flow between the panel and the RADIUS server but nowhere else.
The network is protected until authentication of the client (panel) is complete and the ID of the client is
verified.
3.
The WAP (Authenticator) sends an "EAP-Request/Identity" message to the panel as soon as the wireless
connection becomes active.
4.
The panel then sends a "EAP-Response/Identity" message through the WAP to the RADIUS server
providing its identity and specifying which EAP type it wants to use.


5.
If the EAP type is supported, the server then sends a message back to the client (panel) indicating what
information it needs.
This can be as simple as a username (Identity) and password or as complex as multiple CA certificates.
6.
The panel then responds with the requested information.
If everything matches, and the panel provides the proper credentials, the RADIUS server then sends a
success message to the access point instructing it to allow the panel to communicate with other devices on
the network.
At this point, the WAP completes the process for allowing LAN Access to the panel (possibly a restricted
access based on attributes that came back from the RADIUS server).
As an example, the WAP might switch the panel to a particular VLAN or install a set of firewall rules.
NXD-1000Vi 10" Modero® Wall/Flush Mount Touch Panel with Intercom
802.1x
(EAP over Wireless)
If the server does not support the EAP type, then it sends a failure message back to the WAP which
will then disconnect the panel.
As an example, EAP-FAST is only supported by the Cisco server.
LAN
Authenticator (WAP)
Appendix D - Wireless Technology
Authentication Server
(RADIUS Server)
209