Recommended Enterprise SSID Authentication

[fiestas.cesar]

Hello Team,

We currently have a mix wireless devices from laptops authenticating using certificates and credentials to pre-shard key WPA2 to Pre-shared WPA2 keys with mac filtering.

Although, what would be recommended way (enterprise model) to authenticate for example the Cisco 8821. Should we use.

WEP

PSK

EAP-FAST

EAP-TLS

or PEAP-GTC

Thank you in advance. 

[Sathiyanarayanan Ravindran]

EAP-TLS will be my opinion.

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/213543-configure-eap-tls-flow-with-ise.html

[balaji.bandi]

There is good article one of vip member have a look for reference :

https://mrncciew.com/2013/03/03/eap-overview/

[Chris_78]

I had to go through the same - so EAP-TLS should be the preferred choice from security point, we were deploying certs to our endpoints for VPN purposes so we are also using the same certs for the WIFI. You have to play with Active directory PKI, and NPS. The exact AP should be very easy to configure (we did Aruba sorry to mention that here:))

Good thing this setup should be pretty straight forward and well documented online!

Good luck!

[fiestas.cesar]

Chris,

Thanks for your time. For best practice when using EAP-TLS did you use one service account for each phone or one service account for all phones?

[RaffyLindogan · Accepted solution]

Hi mate,

What I recommend is have ISE as authentication server.

If you manage the AD, then integrate ISE with AD.

EAP-TLS using machine authentication is the way I suggest as well for windows machine.

For mobile (company provided), then it would be good to have a user cert installed to it using MDM.

And that user is found on AD, so it is easier to manage.

For both non-company laptops and mobile, you have ways to go with BYOD and/or Guest network.

ISE has good feature for redirect and even social media login so it is easier for your users.

Cheers,

Raffy

[fiestas.cesar]

Raffy,

Thanks for your response, although will still need to have an AD account (service account) to authenticate the phone using this model? also how do we load the certificate into the 8821? Thanks

[Sathiyanarayanan Ravindran]

Please refer the doc WiFi on 8821 .