topic LOL .. you're made me smile . in Wireless

EAP Authentication Configuration for EAP-FAST and PEAP

LJ Gabrillo — Mon, 05 Jul 2021 08:44:10 GMT

Hi Everyone,

I pretty much got EAP working, however using LEAP
When I get to EAP-FAST and PEAP, I just can't seem to get it to work

What am I missing, I do know that EAP-FAST and PEAP involve certificates. However, how do i set them up on the client side?
Hope you guys can help me on this, stuck on this part xD

Typically no client side

Rasika Nayanajith — Wed, 15 Oct 2014 18:44:53 GMT

Typically no client side certs involve in PEAP (that's why it is most popular EAP method used in enterprise environment). For EAP-FAST no certificate involvement at all.

As long as you installed the certs on your RADIUS you should be able to do the PEAP. Here is a reference post for these using ACS 5.2

http://mrncciew.com/2013/03/03/peap-eap-fast-with-acs-5-2/

HTH

Rasika

**** Pls rate all useful responses ****

EAP is a complicated subject

George Stefanick — Wed, 15 Oct 2014 19:09:03 GMT

EAP is a complicated subject for sure. But it shouldn't be really once you know the foundation.

EAP-PEAP can use server side and client side and EAP-FAST can as well. It all depends how its deployed.

Generally speaking, most deployments of PEAP use server side only and EAP-FAST uses PACS only.

The cert that you install on the radius server for PEAP is passed to the wireless supplicant and is used by the supplicant to hash the logon and password from the user. This hash is passed back to the radius server who has the private key who can decode the hash and pass the user ID and password back to AD for example.

Hope this helps ..

George is the wirelessguru &

Rasika Nayanajith — Wed, 15 Oct 2014 19:09:04 GMT

George is the wirelessguru & master of EAP.

Thanks George,So basically I

LJ Gabrillo — Thu, 16 Oct 2014 00:51:38 GMT

Thanks George,

So basically I need to have an ACS server? Because currently I do not have one
Anyway, is it possible to NOT use ACS?Basically EAP-FAST and PEAP only uses the WLC and no other devices

With regards to the authentication, I know local(duh haha) and as well AD(LDAP) is supported, so yeah.

If you have a small

George Stefanick — Thu, 16 Oct 2014 02:32:27 GMT

If you have a small deployment the WLC can also act as a local radius server, so yes. Or you can use other radius solutions like FREERADIUS, ACS, etc .. Check out this video by Richard http://www.youtube.com/watch?v=YIxG4OEfwtY

Hi George,Thank you for your

LJ Gabrillo — Thu, 16 Oct 2014 02:58:58 GMT

Hi George,

Thank you for your reply,
Basically, I have already tried EAP using LEAP, setup the connecting client(laptop) and poof! I was able to connect

However, when I switched to EAP-FAST or PEAP, I cannot connect anymore.
What steps do I need to do on the connecting client in order for it to work? It is more likely that I missed a step on the client setup side

LOL .. you're made me smile .

George Stefanick — Thu, 16 Oct 2014 03:05:53 GMT

LOL .. you've made me smile .. BTW your blog is awesome!

and additionally, where can I

LJ Gabrillo — Thu, 16 Oct 2014 03:08:14 GMT

...

First I would make sure PEAP

George Stefanick — Thu, 16 Oct 2014 03:19:39 GMT

First I would make sure PEAP or FAST is configured correctly. When testing pay close attention to the logs on the WLC or do the necessary debugs to troubleshoot.

Good read on local eap..
http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-4/configuration/guides/consolidated/b_cg74_CONSOLIDATED/b_cg74_CONSOLIDATED_chapter_0110010.html

To configure your client I will assume it windows 7 or newer?

https://supportforums.cisco.com/document/68096/peap-authentication-configuration-example-windows-7

Thanks George,Looking on your

LJ Gabrillo — Thu, 16 Oct 2014 03:19:40 GMT

Thanks George,

Looking on your link I think I know what is my mistake.
I'll try this solution! haha 😄

Thanks again! :))