Dell 6.2 Configuring A uthentication Term inated on Controller

Figure 59: 802.1XAuthentication with RADI US Server
The supplicantand authentication server must be configured to use the same EAP type. The controller does not
needt o know the EAP type used between the supplicant and authentication server.
For the controllerto communicate wit h theauthenticati on server,you must configure the IP address, authentication
port, andacco untingport of the server on the controller. The authentication servermust be co nfiguredwith the IP
addresso ft heR ADIUS client, which is the controlleri n this case. Both the controllerand the authentication server
must be configuredto use the same shared secret.
NOTE:Additional information on EAP typessupported in a Windows environment, Mi crosoftsupplicants, and
authenticationserver, is avail able at http://technet.microsoft .com/en-us/library/cc782851(WS.10).aspx.
The client communicates with the controller througha GR E tunneli n orderto form an association wit h anA P and
to authenticate to the network. Therefore,the network authentication and encryption configured for an ESSID must
be the same on both the client andthe controller.
Configuring A uthentication Term inated on Controller
User authentication is performed either via the controller’s internal database or a non-802.1X server. See "802.1x
Authentication Profile Basic WebUI Parameters" on page 196 for an overview of the parameters that you need to
configureon 8 02.1X authentication components when 802.1X authentication is terminated on the controller (AAA
FastConnect).
Figure 60: 802.1XAuthentication with Terminationon Controller
In this scenario, the supplicant is configured for EAP-Transport Layer Security (TLS) or EAP -Protected EAP
(PEAP).
lEAP-TLS is used with smart card user authentication. A smart card holds a digital certifi cate which, with the
user-enteredpersonal identification number (PIN), allows the user to be authenticated on the network.E AP-TLS
relieso ndi gital certificates to verify the identities of both the client and server.
EAP-TLS requires that you import server and certification authority (CA ) certificates onto the controller (see
"Configuringand Using Certificates w ith AAA FastConnect" on page 200). The client certi ficate is verified on
the controller(the client certificate must be signed by a known CA) before the user name is checked on the
authentication server.
lEAP-PEAP uses TLS t o create an encrypted tunnel.Within the tunnel, one of the following “inner EAP”
methods is used:
nEAP-Generic Token Card (GTC): Described in RFC 2284, t his EAP method permits the transfer of
unencryptedusernames and passwords from client to server. The main uses for EAP-GTC are o ne-time token
cards suchas SecureID and the use of an LDAP o rR ADIUS server as the userauthenticati on server.You can
also enablecaching of user credentials on the controlleras a backup to an external authentication server.
DellPowerConnect W- Series ArubaOS 6.2 | UserGuide 802.1XAuthentication | 194