3Com WX2200 3CRWX220095A Three Basic WX Approaches to EAP Authentication, Approach Description

AAA Tools for Network Users 447

Table 38 EAP Authentication Protocols for Local Processing (continued)

EAP Type Description Use Considerations

PEAP-MS-

CHAP-V2

(Protected EAP with Microsoft Challenge Handshake Authentication Protocol version 2)

The wireless client authenticates the server (either the WX switch or a RADIUS server) using TLS to set up an encrypted session. Mutual authentication is performed by MS-CHAP-V2.

Wireless and wired		Only the server
authentication:		side of the
„	The PEAP	connection
		requires a
	portion is
		certificate.
	processed on the
	WX switch.	The client needs
„	The	only a username
		and password.
	MS-CHAP-V2

portion is processed on the RADIUS server or locally, depending on the configuration.

* EAP-MD5 does not work with Microsoft wired authentication clients.

Ways a WX Switch Network users with 802.1X support cannot access the network unless they Can Use EAP are authenticated. You can configure a WX switch to authenticate users

with EAP on a group of RADIUS servers and/or in a local user database on the WX, or to offload some authentication tasks from the server group. Table 39 details these three basic WX authentication approaches.

(For information about digital certificates, see Chapter 20, “Managing Keys and Certificates,” on page 413.)

Table 39 Three Basic WX Approaches to EAP Authentication

Approach	Description
Pass-through	An EAP session is established directly between the client and
	RADIUS server, passing through the WX switch. User information
	resides on the server. All authentication information and certificate
	exchanges pass through the switch or use client certificates issued
	by a certificate authority (CA). In this case, the switch does not
	need a digital certificate, although the client might.
Local	The WX switch performs all authentication using information in a
	local user database configured on the switch, or using a
	client-supplied certificate. No RADIUS servers are required. In this
	case, the switch needs a digital certificate. If you plan to use the
	EAP with Transport Layer Security (EAP-TLS) authentication
	protocol, the clients also need certificates.