Ways A Wx Switch Can Use Eap - 3Com WX1200 3CRWX120695A Configuration Manual

Ways a WX Switch
Can Use EAP
Table 38 EAP Authentication Protocols for Local Processing (continued)
EAP Type Description
PEAP-MS- The wireless client
CHAP-V2 authenticates the server
(either the WX switch or a
(Protected EAP
RADIUS server) using TLS
with Microsoft
to set up an encrypted
Challenge
session. Mutual
Handshake
authentication is
Authentication
performed by
Protocol
MS-CHAP-V2.
version 2)
* EAP-MD5 does not work with Microsoft wired authentication clients.
Network users with 802.1X support cannot access the network unless they
are authenticated. You can configure a WX switch to authenticate users
with EAP on a group of RADIUS servers and/or in a local user database on
the WX, or to offload some authentication tasks from the server group.
Table 39 details these three basic WX authentication approaches.
(For information about digital certificates, see Chapter 20, "Managing
Keys and Certificates," on page 413.)
Table 39 Three Basic WX Approaches to EAP Authentication
Approach Description
Pass-through An EAP session is established directly between the client and
RADIUS server, passing through the WX switch. User information
resides on the server. All authentication information and certificate
exchanges pass through the switch or use client certificates issued
by a certificate authority (CA). In this case, the switch does not
need a digital certificate, although the client might.
Local The WX switch performs all authentication using information in a
local user database configured on the switch, or using a
client-supplied certificate. No RADIUS servers are required. In this
case, the switch needs a digital certificate. If you plan to use the
EAP with Transport Layer Security (EAP-TLS) authentication
protocol, the clients also need certificates.
AAA Tools for Network Users
Use Considerations
Wireless and wired Only the server
authentication: side of the
connection
The PEAP
requires a
portion is
certificate.
processed on the
WX switch. The client needs
only a username
The
and password.
MS-CHAP-V2
portion is
processed on the
RADIUS server or
locally,
depending on
the
configuration.
447