topic Re: PEAP+Radius in Wireless

PEAP+Radius

J_Vansen_S — Sun, 04 Jul 2021 19:34:10 GMT

This is my network setup

cisco ACS4.0(radius)

aironet 1100

3rd party client adapter using winXp

My objective is to authenticate my users(created on the ACS) via the Radius server. Im not quite sure how EAP-MSCHAPv2 and EAP-GTC works. From my understanding MSCHAP is authenticate via windows username n password. So which is my best opinion?

Re: PEAP+Radius

Scott Fella — Fri, 07 Jul 2006 13:09:02 GMT

You can go either way, the only thing is that if you want to go with Cisco PEAP (EAP-GTC) you will have to install Cisco PEAP on all wireless stations. It might be easier to just stick with EAP-MSCHAPv2. You should be able to authenticate users locally on the ACS.

Re: PEAP+Radius

J_Vansen_S — Sat, 08 Jul 2006 00:42:33 GMT

u mentioned "install Cisco Peap on all wireles stations". That means i would need Cisco client adapters on my wireless stations. Is that correct? Anyway thanks for ur reply 🙂

Re: PEAP+Radius

pnschurr — Mon, 10 Jul 2006 01:14:54 GMT

If you're going to use PEAP (or even say it!) then you're stuck with CHAP.

PEAP stacks a bunch of stuff onto other stuff... between client and Radius server (vi AP) you get a protocol stack that looks like this...

EAPOL

EAP

Radius sever asks for PEAP (Server side cert TLS)

CHAP inside TLS.

If XP is booted and user not logged on, then machine ID is exchanged in CHAP.

When user logs onto XP client, user credentials are exchanged in CHAP.

When CHAP is successful, Radius server provides encryption keys to both client and AP.

peter

Re: PEAP+Radius

Scott Fella — Mon, 10 Jul 2006 11:07:51 GMT

there is a small executable that you must run on wireless client devices (that are supported) if you want to run Cisco PEAP. you proboble can fond it somewhere on cisco's web site.