topic Re: Recommended Enterprise SSID Authentication in Wireless

Recommended Enterprise SSID Authentication

fiestas.cesar — Mon, 05 Jul 2021 17:21:59 GMT

Hello Team,

We currently have a mix wireless devices from laptops authenticating using certificates and credentials to pre-shard key WPA2 to Pre-shared WPA2 keys with mac filtering.

Although, what would be recommended way (enterprise model) to authenticate for example the Cisco 8821. Should we use.

WEP

PSK

EAP-FAST

EAP-TLS

or PEAP-GTC

Thank you in advance.

Re: Recommended Enterprise SSID Authentication

Sathiyanarayanan Ravindran — Thu, 09 May 2019 18:40:09 GMT

EAP-TLS will be my opinion.

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/213543-configure-eap-tls-flow-with-ise.html

Re: Recommended Enterprise SSID Authentication

balaji.bandi — Thu, 09 May 2019 18:42:18 GMT

There is good article one of vip member have a look for reference :

https://mrncciew.com/2013/03/03/eap-overview/

Re: Recommended Enterprise SSID Authentication

Chris_78 — Thu, 09 May 2019 19:08:46 GMT

I had to go through the same - so EAP-TLS should be the preferred choice from security point, we were deploying certs to our endpoints for VPN purposes so we are also using the same certs for the WIFI. You have to play with Active directory PKI, and NPS. The exact AP should be very easy to configure (we did Aruba sorry to mention that here:))

Good thing this setup should be pretty straight forward and well documented online!

Good luck!

Re: Recommended Enterprise SSID Authentication

fiestas.cesar — Thu, 09 May 2019 20:28:47 GMT

Chris,

Thanks for your time. For best practice when using EAP-TLS did you use one service account for each phone or one service account for all phones?

Re: Recommended Enterprise SSID Authentication

RaffyLindogan — Fri, 10 May 2019 00:42:27 GMT

Hi mate,

What I recommend is have ISE as authentication server.

If you manage the AD, then integrate ISE with AD.

EAP-TLS using machine authentication is the way I suggest as well for windows machine.

For mobile (company provided), then it would be good to have a user cert installed to it using MDM.

And that user is found on AD, so it is easier to manage.

For both non-company laptops and mobile, you have ways to go with BYOD and/or Guest network.

ISE has good feature for redirect and even social media login so it is easier for your users.

Cheers,

Raffy

Re: Recommended Enterprise SSID Authentication

fiestas.cesar — Fri, 10 May 2019 16:45:19 GMT

Raffy,

Thanks for your response, although will still need to have an AD account (service account) to authenticate the phone using this model? also how do we load the certificate into the 8821? Thanks

Re: Recommended Enterprise SSID Authentication

Sathiyanarayanan Ravindran — Sat, 11 May 2019 21:54:17 GMT

Please refer the doc WiFi on 8821 .