HP Access Control Client Software manual Web-Auth None by default

Designing Access Controls

Choose the Access Control Methods

Authentication	Encryption Options	Advantages	Disadvantages
Method

Web-Auth	•	None by default
	•	Optional encryption
		possible, depending
		on AP
MAC-Auth (local	•	Optional encryption
and RADIUS)		possible, depending
		on AP

•Ideal for public zones

•User-based authentication

•No configuration on endpoints—unless using optional encryption

•No 802.1X supplicant required

•Control over which endpoints connect to the network

•No software on the endpoint

•Possible to combine this method with another access control method

•Web browser and user interaction required—no headless devices

•No encryption by default

•RADIUS server required

•No seamless roaming

•Not scalable

•High administrative overhead

•Susceptible to spoofing

•Hardware-based, rather than user-based, authentication

None	•	Static WEP
	•	WPA/WPA2 with
		Preshared Key (PSK)
		–	TKIP
		–	CCMP-AES

• No 802.1X supplicant required	•	Static WEP is easily cracked
• Less configuration on endpoint	•	No user-based or
• No RADIUS server required		centralized authentication
	•	No dynamic settings
	•	Easily compromised
		password (same for all
		users)

The remainder of this section outlines the factors you should consider when selecting authentication and encryption methods for public or private wireless zones.

Public Wireless Zones. With a public wireless network, the goal is usually to provide convenient access for guests, rather than to provide strong security. Because guests cannot access sensitive materials or confidential information on your network, you do not need to worry about protecting the data that they access.

If you are selecting an access control method for a public wireless zone, you might not even enforce authentication, or you might use Web-Auth, which does not require encryption on its own. If you decide to require encryption, you might be willing to select a weak encryption method, such as static WEP, which all wireless NICs support.

Private Wireless Zones. For private wireless zones, you should typically impose the tightest access control and encryption methods possible—802.1X with WPA/WPA2.

To determine whether your environment supports this option, ask these questions:

3-19