topic Using EAP-PEAP for wired in Network Access Control

Using EAP-PEAP for wired

sandeepsingh3200 — Sat, 30 Mar 2024 02:52:34 GMT

We have devices that only support EAP-PEAP and I want to use an AD username to auth the device so it can connect to the WIRED network. My question is if the password for the AD user change will that kick all the devices of the network that were added using the old password?

Re: Using EAP-PEAP for wired

balaji.bandi — Sat, 30 Mar 2024 07:46:50 GMT

As per the information technically yes.

Re: Using EAP-PEAP for wired

Rob Ingram — Sat, 30 Mar 2024 08:19:22 GMT

@sandeepsingh3200 what devices are you referring to? If these are AD domain joined computers this won't be a problem.

However if you are referring to ohter devices such as printers or cameras etc that you have manually configured for authentication, then yes changing the password on AD will cause a problem. If you must change the password for those user accounts, you will have to go to each device and manually set the new password.

Re: Using EAP-PEAP for wired

sandeepsingh3200 — Sat, 30 Mar 2024 22:46:00 GMT

Hello,

These are Linux boxes that are not part of the domain. When these devices try to connect to the WIRED network using (EAP-PEAP) with username “ABC and password “Abc123” for example. Once the device connects use this username and password and in 3 month’s I change the password for username “ABC” will the Linux device still stay connected or will it get kicked it if the network and I will have to retype the password back on the device to reconnect it?

Re: Using EAP-PEAP for wired

Ruben Cocheno — Sat, 30 Mar 2024 23:51:34 GMT

@sandeepsingh3200

It will be kicked out, and you need to retype the password.

Re: Using EAP-PEAP for wired

Rob Ingram — Sun, 31 Mar 2024 06:45:46 GMT

@sandeepsingh3200 the password won't be synced to the linux boxes as the password was manually entered. Once you change the password on AD, the linux boxes will fail to authenticate until you manually change the password. Although not security best practce, you could set the passwords to never expire for those specific user accounts if required.