Xirrus Wi-Fi Array XN16 User Manual page 234

z
Choosing an authentication method: User authentication ensures that
users are who they say they are. For this purpose, the Array allows you to
choose between the following user authentication methods:
• Pre-Shared Key—users must manually enter a key (passphrase)
on the client side of the wireless network that matches the key
stored by the administrator in the Array.
This method should be used only for smaller networks when a
RADIUS server is unavailable. If PSK must be used, choose a
strong passphrase containing between 8 and 63 characters (20 is
preferred). Always use a combination of letters, numbers and
special characters. Never use English words separated by spaces.
• RADIUS 802.1x with EAP—802.1x uses a RADIUS server to
authenticate large numbers of clients, and can handle different
EAP
methods, including EAP-TLS, EAP-TTLS, EAP-PEAP, and LEAP-
Passthrough. The RADIUS server can be internal (provided by
the Wi-Fi Array) or external. An external RADIUS server offers
more functionality and security, and is recommended for large
deployments. When using this method, user names and
passwords must be entered into the RADIUS server for user
authentication.
• MAC Address ACLs (Access Control Lists)—MAC address
ACLs provide a list of client adapter MAC addresses that are
allowed or denied access to the wireless network. Access Control
Lists work well when there are a limited number of users—in this
case, enter the MAC address of each user in the Allow list. In the
event of a lost or stolen MAC adapter, enter the affected MAC
address in the Deny list.
The Wi-Fi Array will accept up to 1,000 ACL entries.
z
PCI DSS or FIPS 140-2 Security—to implement the requirements of these
security standards on the Wi-Fi Array, please see
Implementing PCI DSS
212
(Extensible Authentication
or Appendix E: Implementing FIPS
Wi-Fi Array
Protocol) authentication
Appendix D:
Security.
Configuring the Wi-Fi Array