topic Re: radius in Wireless

radius

daveman007 — Sat, 03 Jul 2021 21:47:12 GMT

hallo i have version 3.2.78 on my wlc 4402 and i want to configure it for EAP-TLS. it should be secured by 802.1x and wpa2 but i dont know how to do it properly over the webinterface. every suggestion is appreciated.

Re: radius

Jagdeep Gambhir — Wed, 17 Oct 2007 12:00:48 GMT

Dave,

Please check this link,

http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a00807917a6.shtml

Regards,

~JG

Please rate helpful posts

Re: radius

Scott Fella — Wed, 17 Oct 2007 12:05:18 GMT

So you want to use EAP-TLS instead of PEAP. I other words, you want a certificate on each device. Here is a link that might help:

http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a00807917a6.shtml#t20

I have always used WPA2 w/PEAP MSChapv2 and a single certificate on the radius server.

You should maybe upgrade to 4.1.185.0, just in case:

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00805f381f.shtml

Re: radius

daveman007 — Wed, 17 Oct 2007 17:50:34 GMT

Hi thx for replies.

Why would you recommend me peap wit mschapv2 rather than eap-tls.

my problem in addition is that i cant update my wlc 4402 because i am out of warranty.

Re: radius

dennischolmes — Wed, 17 Oct 2007 18:07:43 GMT

The reason for single side server certs is for you head. If you have to deal with all those client certs and manage them every single time a device is lost or stolen, your head will explode. By using PEAP or even the old legacy LEAP, you don't have that headache. Simpler management=fewer tylenols taken.

Re: radius

daveman007 — Wed, 17 Oct 2007 18:12:55 GMT

but the headache for Security lack will i have it or is it more or less the same security level.

Re: radius

Scott Fella — Wed, 17 Oct 2007 18:25:45 GMT

Exactly.... I worked on a project once doing eap-tls......NEVER AGAIN.

You have to look at it this way. Do you have a Root CA configured. If you do or you don't, you should see what MS best practice for having a CA... You will need Excedrin for tension headaches.

Re: radius

daveman007 — Wed, 17 Oct 2007 18:34:14 GMT

I have to reach the result that the guys (students)using their (schoolowned)notebooks are not able to insert other personal notebooks. Is peap good for that?

So using peap how do i have to configure the stuff f.i. my CA?

Re: radius

dennischolmes — Wed, 17 Oct 2007 18:48:12 GMT

That's a whole different scenario now. I would probably utilize PEAP for authentication and a MAC filter for association purposes. You could also validate a machine against RADIUS but again that could turn into a lot of work. Either way, the machine would be controlled and authentication would take place at a much more secure level.

Re: radius

daveman007 — Wed, 17 Oct 2007 18:55:16 GMT

i heard mac filters are not secure because the mac can be changed.

Re: radius

dennischolmes — Wed, 17 Oct 2007 19:02:04 GMT

OK. Let's talk security here. The mac filter is not security. It is a method to dictate which laptop is allowed to associate to your access point. After the laptop has associated the user logs in to the network via PEAP and is authenticated. If the authentication fails, the user is not allowed a session on the network. This protects you if somebody steals the laptop they can't login to the network because their authentication fails. Never uses MAC filters as security, only access control.

Re: radius

daveman007 — Wed, 17 Oct 2007 19:07:20 GMT

but what if the guy takes another laptop changes the mac and copy the certificate (if possibe dont know) and log with his username and password. would it work?

Re: radius

dennischolmes — Wed, 17 Oct 2007 19:14:36 GMT

hmmmm changes the MAC. That CAN be done but only by a very experienced computer guy and the laptop has to be using a flavor of linux. Windows OS does not allow for modification of mac addresses. Even if he gets access to the MAC he doesn't have the logon credentials to defeat your PEAP authentication. So what has he gained? A whole lot of work for absolutely no reward. I'm just trying to make life easy for you here. Certificates will work as well but Jeez at the headaches of managing certificates.

Re: radius

dennischolmes — Wed, 17 Oct 2007 19:17:05 GMT

Here is the configuration for using PEAP to authenticate the machine instead of the user.

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00801df0e4.shtml

Re: radius

daveman007 — Wed, 17 Oct 2007 19:27:39 GMT

ok will do. so you would not recommend eap-tls because of the huge amount of more work. and the same security level.

The peap mschapv2 just works only the certificate commponent doesnt work so i have to work on this.

Re: radius

dennischolmes — Wed, 17 Oct 2007 19:30:29 GMT

It's what I would do. This keeps you free to do other things with your time.

Re: radius

daveman007 — Wed, 17 Oct 2007 19:39:23 GMT

i know sure it is my first wlan with cisco and radius so i had to speak with some who just did it.

i have to speak about it with my employer i suppose he wants tls anyway

Re: radius

dennischolmes — Wed, 17 Oct 2007 19:41:22 GMT

Good luck in either way you choose to proceed.

Re: radius

daveman007 — Wed, 17 Oct 2007 19:44:07 GMT

i know sure it is my first wlan with cisco and radius so i had to speak with some who just did it.

i have to speak about it with my employer i suppose he wants tls anyway

Re: radius

daveman007 — Wed, 17 Oct 2007 19:47:18 GMT

thx dennis

last question about mac filtering because i'll do it independently of the eap version.

So mac filtering means register all macs in my wlc and look which of them is looged with wich username f.i.