Cisco AIR-CB21AG-W-K9 Installation And Configuration Manual page 62

Configuring EAP-FAST
Table 3-1
Connection Settings
Validate server certificate
Connect to only these servers
Trusted Root CA
Do not prompt user to authorize
new servers or trusted
certificate authorities.
Cisco Aironet 802.11a/b/g Wireless LAN Client Adapters (CB21AG and PI21AG) Installation and Configuration Guide for Windows Vista
3-8
Connection Settings (continued)
Description
Check this box to use an authenticated server certificate to establish
a tunnel. You can check both the Use Protected Access Credentials
(PAC) box and the Validate Server Certificate box at the same time.
If both are checked, you can select one or more Trusted Root CA
certificates from the list of trusted Certificate Authority certificates
that are installed on the host system.
The EAP-FAST module always tries to use the PAC first if both check
boxes are checked. The module uses the server certifcate if the PAC
is missing or rejected by the server.
If both check boxes are unchecked, EAP-FAST functions as PEAP
does without validating server certificate. We do not recommend
leaving both boxes unchecked because the module bypasses
fundamental trust validation.
Default: Off
Check this box to enter an optional server name that must match the
server certificate that is presented by the server. You can enter
multiple server names; separate multiple server names with
semicolons. The EAP-FAST module only allows connections to
continue without prompting if the subject field (CN) in the server
certificate matches the server names that you enter in this field.
Default: Off
You can use an asterisk (*) as a wildcard character in server
Note
names only if the asterisk appears before the first period (.) in
the name.domain.com format. For example, "*.cisco.com"
matches any server name that ends with ".cisco.com." If you
put an asterisk anywhere else in the server name, it is not
treated as a wildcard character.
Select one of more Trusted Root CA certificates from the list of
certificates that are installed on the system. Only trusted CA
certificates that are installed on the host system are displayed in the
drop-down list.
To view details about the selected Trusted Root CA certificate,
double-click the certificate name. Double-clicking the certificate
name opens the Windows certificate property screen, where
certificate details are available.
Default: None
Check this box if you do not want the user to be prompted to authorize
a connection when the server name does not match or the server
certificate is not signed by one of the Trusted Root CA certiticates
that was selected. If this box is checked, the authentication fails.
Default: Off
Chapter 3 Configuring EAP Types
OL-16534-01