IBM Tivoli and Cisco manual 243, Eap-Gtc, Eap-Tls

EAP-FAST configuration	Condition
Require client certificate for provisioning	Checked
Allow Machine Authentication	Checked
Machine PAC TTL	One week
Allow Stateless Session Resume	Checked
Authorization PAC TTL	One hour
Allow inner methods
EAP-GTC	Checked
EAP-MSCHAPv2	Checked
EAP-TLS	Checked
Select one or more of the following EAP-TLS
comparison methods:
Certificate SAN comparison	Checked
Certificate CN comparison	Checked
Certificate Binary comparison	Checked
EAP-TLS Session timeout (minutes)	120
EAP-FAST Master Server	Checked
Actual EAP-FAST Server status	Master

6.Click Submit + Restart.

Chapter 7. Network enforcement subsystem implementation 243