topic Not a problem! in Network Access Control

802.1x EAP-TLS vs PEAP-EAP-TLS

craig.cartlidge1 — Mon, 11 Mar 2019 06:54:56 GMT

Can anyone please explain the advantage (if any!) of using PEAP-EAP-TLS as opposed to just EAP-TLS for wired 802.1x deployments.

We are deploying wired 802.1x machine based authentication and have a PKI infrastructure, I was under the impression that we just need to use EAP-TLS since we have a working PKI deployment and all machines have a certificate.

The server guys seem to think we need to use PEAP with EAP-TLS, but cant really explain to me why, this just seems like extra work, is there any advantage ? I can understand using PEAP for things like MS-CHAP authentication, but since we are using EAP-TLS anyway this seems pointless.

Thanks

Hi

Francesco Molino — Thu, 07 Jul 2016 11:46:53 GMT

Eap-tls is based on client certificate authentication while peap-eap-tls is based on server side certificate authentication.

With peap-eap-tls, the 1st phase will be the encrypted tunnel with server side authentication and then all user sensitive information are encrypted. With this method, no user certificate will be required. It's peap v1.

With eap-tls, you will need a user certificate to authenticate.

I attach an image that show you differences. Take a look at column 2 and 4.

Thanks

PS: Please don't forget to rate and mark as correct answer if this solved your issue

This is incorrect. PEAP-EAP

alburger — Thu, 27 Apr 2017 02:28:35 GMT

This is incorrect. PEAP-EAP-TLS encrypts the EAP-TLS certificate transfer with a PEAP Tunnel. Certificates are still required on both the client and server. There is just added security of a TLS tunnel prior to certificate exchange. PEAP-EAP-MSCHAPv2 only requires a server side certificate while the rest of the authentication is performed as user/pass.

Yes your right and I'm sorry.

Francesco Molino — Thu, 27 Apr 2017 03:01:55 GMT

Yes your right and I'm sorry. I'm thinking why i answered this when the question was peap-eap-tls.

Maybe i thought (I red to quickly) it was asked eap-ttls on which client authentication isn't required.

Thanks for having corrected the answer.

Not a problem!

alburger — Thu, 27 Apr 2017 03:18:05 GMT

Not a problem!