Ingeniero

Network Authentication Types

Before a wireless client device can communicate on your network through the access point, it must authenticate to the access point and to your network. The accesspoint uses four authentication mechanisms or types and can use more than one at the same time:

•Network-EAP—This authentication type provides the highest level of security for your wireless network.By using the Extensible Authentication Protocol (EAP) to interact with an EAP-compatible RADIUS server, the access point helps a wireless client device and the RADIUS server to perform mutualauthentication and derive a dynamic unicast WEP key. The RADIUS server sends the WEP key to the access point, which uses it for all unicast data signals that it sends to or receives from the client. Theaccess point also encrypts its broadcast WEP key (entered in the access point's WEP key slot 1) with the client's unicast key and sends it to the client.

When you enable EAP on your access points andclient devices, authentication to the network occurs in the steps shown in Figure 8-2:

Figure 8-2 Sequence for EAP Authentication







In Steps 1 through 9 in Figure 8-2, a wirelessclient device and a RADIUS server on the wired LAN use 802.1x and EAP to perform a mutual authentication through the access point. The RADIUS server sends an authentication challenge to the client. Theclient uses a one-way encryption of the user-supplied password to generate a response to the challenge and sends that response to the RADIUS server. Using information from its user database, the RADIUSserver creates its own response and compares that to the response from the client. When the RADIUS server authenticates the client, the process repeats in reverse, and the client authenticates theRADIUS server.

When mutual authentication is complete, the RADIUS server and the client determine a WEP key that is unique to the client and provides the client with the appropriate level of...