3Com OfficeConnect WX1200 Release Note page 2

2 W LAN S
IRELESS WITCH AND
use. Working out client and AAA configuration meth-
ods first provides valuable information as you scale
the deployment.
The selection of client and AAA server software will
depend heavily on the requirements of your deploy-
ment. First, decide which EAP Protocol you will be
using as that will restrict the available clients and serv-
ers. Each protocol has different advantages and disad-
vantages, which you will need to consider in your
deployment. For most enterprise deployments, 3Com
recommends using PEAP-MS-CHAP-V2 as the 802.1X
protocol. The following table compares the EAP pro-
tocols.
Protocol Advantages
PEAP-MS-CHAP-V2 Does not require
client certificates
Compatible with
MSS EAP offload
Native support in
Microsoft Windows
XP and 2000
Broad support in
802.1X clients
EAP-TTLS Does not require
client certificates
Broadest compatibil-
ity with user directo-
ries
C MSS V 3.0 R
ONTROLLER ERSION
Disadvantages
Username/pass-
word-based access
might not be as
strong as certifi-
cate-based access
Requires third-party
802.1X client soft-
ware
Username/pass-
word-based access
might not be as
strong as certifi-
cate-based access
N
ELEASE OTES
Protocol
EAP-TLS
PEAP-TLS
When testing and evaluating MSS, enterprises using
primarily Microsoft platforms are recommended to
use Windows XP clients running PEAP-MS-CHAP-V2
with a Windows 2000 or 2003 server running Inter-
net Authentication Service (IAS) as the RADIUS back
end. This provides a test environment that is quick to
set up and does not require additional third-party
software.
Wireless NICs
Most wireless NICs available now support 802.1X
authentication. The table below lists the NICs that
have been used successfully with MSS. The majority
were tested using recently available drivers using the
Microsoft native 802.1X client and a Microsoft IAS
RADIUS server. 3Com has not experienced any com-
patibility problems with NICs being unable to support
Advantages Disadvantages
Strongest authenti- Client-side certifi-
cation using X.509 cates require full PKI
certificates. infrastructure and
management over-
Native support in
head
Windows XP and
2000
Broad supported in
all 802.1X clients
Strongest authenti- Client-side certifi-
cation using X.509 cates require full PKI
certificates. infrastructure and
management over-
Native support in
head
Windows XP and
2000 Minimal advantage
over EAP-TLS
Broad supported in
all 802.1X clients