3Com SuperStack 4 Configuration Manual page 405

Windows 2000 built-in
client
Windows XP built-in
client
Aegis Client Installation
Windows 2000 requires Service Pack 3 and the IEEE 802.1x client patch for
Windows 2000.
1 Downloaded the patches if required from:
http://www.microsoft.com/Downloads/details.aspx?displaylang=en&Famil
yID=6B78EDBE-D3CA-4880-929F-453C695B9637
2 After the updates have been installed, start the Wireless Authentication Service in
Component Services on the Windows 2000 workstation (set the service to startup
type Automatic).
3 Open the Network and Dial up connections folder, right-click the desired Network
Interface and select Properties.
4 Select the Authentication tab and check Enable Network Access Control using IEEE
802.1x
5 Set Smart Card or Certificate as EAP type and select the previously imported
certificate as shown below.
The RADIUS client shipped with Windows XP has a security issue which affects the
port authentication operation. If the RADIUS client is configured to use EAP-MD5,
after a user logs-off, then the next user to log-on will remain authorised with the
original user's credentials. This occurs because the Microsoft client does not
generate an EAPOL-Logoff message when the user logs-off, which leaves the port
authorised. To reduce the impact of this issue, decrease the "session-timeout"
return list attribute to force re-authentication of the port more often. Alternatively,
use a RADIUS client without this security flaw, for example the Aegis client
A patch for the Windows XP RADIUS client may be available from Microsoft since
publishing this guide.
The Aegis Client is a standards-based implementation of IEEE 802.1x and supports
many different encrypted algorithms such as MD5. It works on different Windows
and Linux operating systems, such as Win XP, 2000, NT, 98, ME, Mac OSX. Details
of the Aegis client can be found at
Setting Up the RADIUS Client
http://www.mtghouse.com
417
/