HP ProCurve 9304M Security Manual page 92

Security Guide for ProCurve 9300/9400 Series Routing Switches
on both the clients and the authentication servers, the roll out, maintenance, and scalability of this
authentication method is much more complex than other methods. EAP-TLS is best for installations with
existing PKI certificate infrastructures.
• EAP-TTLS (Internet-Draft) – The EAP Tunneled Transport Level Security (TTLS) is an extension of EAP-TLS
Like TLS, EAP-TTLS provides strong authentication; however it requires only the authentication server to be
validated by the client through a certificate exchange between the server and the client. Clients are
authenticated by the authentication server using user names and passwords.
A TLS tunnel can be used to protect EAP messages and existing user credential services such as Active
Directory, RADIUS, and LDAP. Backward compatibility for other authentication protocols such as PAP, CHAP,
MS-CHAP, and MS-CHAP-V2 are also provided by EAP-TTLS. EAP-TTLS is not considered foolproof and
can be fooled into sending identity credentials if TLS tunnels are not used. EAP-TTLS is suited for
installations that require strong authentication without the use of mutual PKI digital certificates.
• PEAP (Internet-Draft) – Protected EAP Protocol (PEAP) is an Internet-Draft that is similar to EAP-TTLS.
PEAP client authenticates directly with the backend authentication server. The authenticator acts as a pass­
through device, which does not need to understand the specific EAP authentication protocols.
Unlike EAP-TTLS, PEAP does not natively support user name and password to authenticate clients against
an existing user database such as LDAP. PEAP secures the transmission between the client and
authentication server with a TLS encrypted tunnel. PEAP also allows other EAP authentication protocols to
be used. It relies on the mature TLS keying method for its key creation and exchange. PEAP is best suited for
installations that require strong authentication without the use of mutual certificates.
NOTE: If the 802.1X Client will be sending a packet that is larger than 1500 bytes, then the following must be
configured on the HP device:
• On devices with EP modules, default-mtu 1700 must be configured.
• On devices with Standard modules, jumbo 1920 must be configured.
Configuration for these challenge types is the same as for the EAP-MD5 challenge type.
Authenticating Multiple Hosts Connected to the Same Port
HP devices support 802.1X authentication for ports with more than one host connected to them. Figure 4.5
illustrates a sample configuration where multiple hosts are connected to a single 802.1X port.
4 - 6 June 2005