DellPowerConnect W- Series ArubaOS 6.2 | User Guide Statefuland WISPr Authent ication | 221
Chapte r 15

Stateful an d WISPr Authe ntication

ArubaOSsupports stat eful802 .1x authentication, stateful NTLM authentication and authentication for Wireless
Internet Service Provider roaming(WISPr). Stateful authentication differs from 802.1X authentication in that the
controllerdoes not manage the authentication process directly, but monitors the authentication messages between a
userand an external authentication server, and then assigns a role to that user based upon the information in those
authentication messages. WISPr authentication allows clients to roam between hotspots using different ISPs.
This chapter describes the following topics:
l"WorkingWith Stateful Authentication" on page 221
l"WorkingWith WISPr Authenticati on" on page 222
l"UnderstandingStateful Authentication Best Practices" on page 222
l"ConfiguringStateful 802.1x Authenticati on" on page 222
l"ConfiguringStateful NTLM Authentication" on page 2 23
l"ConfiguringStateful Kerberos Authentication" on page 224
l"ConfiguringWISPr Authenticatio n"on page 225

Working With Stateful Au thentication

ArubaOSsupports two different types of stateful authentication, stateful 802.1x and stateful NTLM.
lStateful 802.1x authentication: This feature allows the controllerto learn the identity and role of a user
connected to a third-partyAP, and is useful for authenticatingusers to networks with APs from multiple vendors.
Whenan 802 .1x-capableaccess point sends a authentication request to a RAD IUS server,the controller inspects
this request andt heasso ciated responset o learnthe authentication stat e of the user.It t henapplies an identity-
based userrole through the Policy Enforcement Firewall.
lStateful Kerberos authentication: Use stateful Kerberosauthenticatio nto c onfigurea controller to monitor the
Kerberosauthenticat ion messages between a client and a Windows authentication server. If the client
successfullyauthenticates via an Kerberos authentication server, the controller can recognizet hat the clienthas
beenauthenticated and assign that client a specified user role.
lStateful NTLM authentication: NT LAN Manager (NTLM) is a suite of Mic rosoft authentication and session
security protocols. You can use statefulNTLM authenticatio nt o configurea controller to monitor the NTLM
authentication messages between a client and a Windows authentication server. If the client successfully
authenticates via an NTLM authentication server,t heco ntrollercan recognize that the client has been
authenticated and assign that client a specified user role.
The defaultWindows authentication method changed from the older NTLM protocol to the newer Kerberos
protocol, starting with Windows 2000. Therefore,stateful NTLM authentication i s most useful for networks with
legacy,pre-Windows 200 0 clients. Note also that unlike other types of authentication, all users authenticated via
stateful NTLM authentication must be assigned to the user role specified in the Stateful NTLM Authentication