Cisco Systems OL-6415-04 manual Combining MAC-Based, EAP, and Open Authentication

Chapter 6 Configuring Authentication Types

Understand Authentication Types

Figure 6-4 Sequence for MAC-Based Authentication

		Wired LAN
	Access point
Client		Server
device	or bridge

1.Authentication request

2.Authentication success

3. Association request

4. Association response	84
	655
(block traffic from client)
		5. Authentication request
		6. Success
		7. Access point or bridge unblocks
		traffic from client

Combining MAC-Based, EAP, and Open Authentication

You can set up the access point to authenticate client devices using a combination of MAC-based and EAP authentication. When you enable this feature, client devices that associate to the access point using

802.11open authentication first attempt MAC authentication; if MAC authentication succeeds, the client device joins the network. If MAC authentication fails, the access point waits for the client device to attempt EAP authentication. See the “Assigning Authentication Types to an SSID” section on page 6-9for instructions on setting up this combination of authentications.

Using WPA Key Management

Wi-Fi Protected Access is a standards-based, interoperable security enhancement that strongly increases the level of data protection and access control for existing and future wireless LAN systems. It is derived from and will be forward-compatible with the upcoming IEEE 802.11i standard. WPA leverages AES-CCM and TKIP (Temporal Key Integrity Protocol) for data protection and 802.1X for authenticated key management.

WPA key management supports two mutually exclusive management types: WPA and WPA-Pre-shared key (WPA-PSK). Using WPA key management, clients and the authentication server authenticate to each other using an EAP authentication method, and the client and server generate a pairwise master key (PMK). Using WPA, the server generates the PMK dynamically and passes it to the access point. Using WPA-PSK, however, you configure a pre-shared key on both the client and the access point, and that pre-shared key is used as the PMK.

Note In Cisco IOS releases 12.3(4)JA and later, you cannot enable both MAC-address authentication and WPA-PSK.

Cisco Wireless ISR and HWIC Access Point Configuration Guide

6-6 OL-6415-04